这是我的情况。我参与了一个创建 P2P 慈善网站的项目，用户可以在该网站上相互联系并互相捐款。由于该网站的性质，我们知道诈骗者将会猖獗。我们有几种预防措施的想法，其中一个想法是将 IP 地址与用户的帐户绑定。这样做的原因是能够检测来自同一 IP 地址的人何时创建多个帐户。
这会可靠吗？为什么，或者为什么不呢？我一直在谷歌上搜索，发现关于这个主题有许多相互矛盾的想法。感谢您提供的任何帮助。
Here is my situation. I am part of a project creating a P2P charity website, where users connect and can give money to one another. Because of the nature of the site, we know scammers are going to be rampant. We have several preventative measure ideas, and one idea that came up was tying an IP address to the user's account. The reason for this would be to be able to detect when someone from the same IP address creates several accounts.
Would this be reliable? Why, or why not? I have been googling and found many conflicting ideas on the subject. Thanks for any help you can give.
发布评论
评论（12）
不，它不可靠。因为：
No, it is not reliable. Because:
不会。
许多连接位于 NAT（多人的一个公共网关 IP 地址）后面，或使用 DHCP（经常更改的 IP 地址）。
IP 地址是识别用户的最差方法之一。
No.
Many connections are behind NAT (One public gateway IP address for many people), or use DHCP (frequently changed IP addresses).
An IP address is one of the worst ways of identifying a user.
不，尤其是因为：
您是否会有很多人注册并有权获得金钱？如果可能的话，我建议使用真人进行手动验证过程。如果不出意外，如果有人参与，您可以声称正在进行尽职调查。
No, not least because:
Will you have many people registering who are entitled to receive money? I'd suggest a manual verification process using real people if at all possible. If nothing else, you can claim to be exercising due diligence if there's a human involved.
我所在的一个讨论区禁止袜子木偶（即同一用户的多个帐户）。他们没有办法自动检测它们，因为没有办法明确识别它们。 IP 地址被捕获，因为它们可以用来帮助识别袜子木偶，但我知道识别这些地址的过程是费力的、手动的且容易出错。
只有当怀疑有人使用袜子木偶用于恶意或破坏性目的时，才会采取这种做法。就您而言，除了仔细手动监控使用习惯，使用您收集的有关用户的信息尝试识别可疑习惯之外，没有真正的答案。但您也必须接受 80% 的袜子木偶不会被发现的事实，并尽您所能警告其他用户这种可能性。
顺便说一句，您更大的问题可能是Munchausen by Internet，我们也被。
There is a dicussion board I am part of that bans sock puppets ( that is, multiple accounts by the same user ). They have no means of automatically detecting them, becasue there is no means of definitively identifying them. IP addresses are captured, because they can be used to help identify sock puppets, but I know that the process of identifying these is laborious, manual, and error-prone.
This is only undertaken when there is suspicion that someone is using sock puppets for malicious or disruptive purposes. In your case, there is no real answer other than careful and manual monitoring of usage habits, using the information that you gather about users to attempt to identify suspicious habits. But you also have to accept that 80% of sock puppets will go undetected, and do what you can to warn other users of the possibility.
Your bigger issue, incidentally, may be Munchausen by Internet which we were also caught by.
完全不可靠...
拨号的人每次“拨号”时都会有不同的 IP 地址。
DSL 用户每次重置或重新连接帐户时都会有不同的 IP 地址，除非他们付费购买静态 IP。
特定 LAN 上的许多用户将共享一个公共 IP 地址。
特定用户可以从家庭、工作、公共热点登录，并且在每个位置拥有不同的 IP。
Totally unreliable...
Somebody on dial-up will have a different IP address every time they "dial-up".
DSL users will have a different IP address every time they reset or reconnect their account unless they pay for a static IP.
Many users on a particular LAN will be sharing one public IP address.
A particular user can login from home, work, public hotspot and have a different IP from each location.
否：例如，任何公司代理都只有一个外部 IP 地址，因此从网络内部注册的每个人都将显示为具有相同的 IP 地址。
No: for example, any company proxy will only have one external IP address, so everyone registering from within the network will appear to have the same IP address.
最近的法律案例也许值得一读：http://yro.slashdot.org/story/11/05/03/2020205/An-IP-Address-Does-Not-Point-To-a-Person-Judge-Rules
Recent legal case perhaps worth reading up on : http://yro.slashdot.org/story/11/05/03/2020205/An-IP-Address-Does-Not-Point-To-a-Person-Judge-Rules
我从事 ASP 服务的开发工作，最近我们通过了必要的第 3 方安全审核，以获得允许我们为某个政府机构托管数据的状态。因此，如果我可以分享一些我在培训中收集到的信息，也许会有所帮助。
首先，IP 地址可用于帮助您完成想要完成的任务，但它们本身肯定不好。麦当劳的无线网络就是一个例子。麦当劳的每个人都连接到相同的无线网络，并通过 NAT 使用相同的公共 IP 地址，该地址将本地地址（即 192.168.0.xxx）转换为位于其后面的所有计算机的公共地址。 NAT 保留条目，以便知道哪些流量被允许返回网络，以及该流量将流向哪台计算机。
我们发现一个好的安全措施是使用所有 GET/POST 提交中包含的加密会话密钥。该会话密钥包含一个 GUID，它是对当前会话的查找。因此，即使有人破解了您的会话加密，他们仍然需要猜测 GUID 才能找到有效的会话。最重要的是，通过跟踪 IP 地址，如果它突然发生变化，我们可以立即使会话无效（我们还设置了白名单，以防有人对多条互联网线路进行负载平衡，这可能会导致 IP 频繁更改）。 cookie 也可以用来代替 IP 地址跟踪，因为同一 NAT 后面的两个人如果能找到窃取对方会话密钥的方法，就可能互相劫持对方。
加密 cookie 也是加强安全性的好方法。但请确保您使用的是经过尝试和测试的框架，因为它们已经为您解决了已知的漏洞。不管你相信与否，我们的安全公司告诉我们，.NET 已成为他们所知道的顶级安全框架之一。当我听到这句话时，我差点从椅子上摔下来。
I do development for an ASP service, and we have recently went through a required 3rd party security audit to obtain status allowing us to host data for a certain government agency. So if I may share some of the information I gleaned turning the trainings, perhaps it would help.
First, IP addresses can be used to assist in what you are trying to accomplish, but they are definately not good by themselves. An example would be the wireless at McDonalds. Everyone at McDonalds is connected to the same wireless and are using the same public IP address through a NAT, which translates from a local address (i.e. 192.168.0.xxx) to a public address for all computers located behind it. The NAT keeps entries so it knows what traffic is allowed to come back into the network, and which computer it is going to.
We found that a good security measure is to use an encrypted session key that is included with all GET/POST submits. That session key contains a GUID which is a lookup to the current session. So even if someone breaks your session encryption, they still need to guess at a GUID in order to find a valid session. On top of that, by tracking IP addresses, if it changes suddenly, we can immediately invalidate the session (we also have whitelisting in case someone is load balancing multiple internet lines, which can cause the IP to change frequently). A cookie can also be used in place of the IP address tracking, as two people behind the same NAT can potentially hijack each other if they can find a way to steal the other person's session key.
Encrypted cookies are also a good way to enforce security. But make sure you are using a framework that is tried and tested, as they have already closed the known vulnerabilities for you. Believe it or not, our security company told us that .NET has emerged as one of the top secure frameworks that they know of. I almost fell out of my chair when I heard that.
个人认为不太靠谱。
主要原因是那些使用共享 IP 的人。这包括从企业内部连接的大多数用户和通过同一 WIFI 集线器连接的家庭用户。
多个用户很可能使用相同的 IP 地址访问您的网站。
除此之外，IP 地址会随着时间的推移而变化，您已经失去了对用户的跟踪。
还值得记住的是，多个用户通常会使用同一台物理计算机。您是否想让一个家庭只有一名成员能够注册等？
Personally I don't think it'll be reliable.
The main reason will be for those using a shared IP. That includes most users connecting from inside a business and home users connecting through the same WIFI hub.
It's more than likely for multiple users to be coming to your site with the same IP address.
Adding to that the fact that IP addresses change over time and you're already losing track of your users.
It's also worth remembering that oftentimes multiple users will be using the same physical computer. Are you wanting to have only one member of a household able to signup etc?
作为深度防御方法的一部分，它可能有点用处，但我不会称其为“可靠”。
It could be somewhat useful as part of a defense-in-depth approach, but I wouldn't call it "reliable".
如果您想识别用户，可以使用cookie。一种解决方案结合使用 cookie、本地存储、闪存和可存储在浏览器中的其他状态信息：http:// /samy.pl/evercookie/
没有什么是 100% 可靠的。这些 cookie 可以由确定的用户删除，或者在某些浏览器中一键删除。最终，在美国以外的许多国家/地区，用户有权不被跟踪。
If you want to identify users, you can use a cookie. One solution uses a combination of cookies, local storage, flash, and other state information that can be stored in a browser: http://samy.pl/evercookie/
Nothing is 100% reliable. These cookies can be erased by a determined user, or in some browsers with one click. Ultimately, in many countries outside of the USA, a user has the right not to be tracked.
作为未来的替代方案：全新英特尔® 商用处理器可提供领先的安全性、可管理性和性能
只要浏览器和 CPU 之间的连接不受到干扰（我相信这一点）使用浏览器比使用桌面应用程序面临更大的风险。
As an alternative for the future: New Intel® Business Processors Deliver Leading Security, Manageability and Performance
As long as the connection between the browser and the CPU isn't interviened which I believe there is more risk of with a browser than a desktop application.