如何通过Javascript管理用户身份？
我运行一个允许免费试用的 SaaS。基本上，如果您注册，您会立即获得价值几美元的免费服务。我一直仅根据 IP 地址来确定新用户，并且在前几个月效果很好。现在人们终于意识到更改 IP 地址并骗取我的免费试用奖金是非常容易的。
我想做的基本上是创建所有可能的 javascript 浏览器变量的哈希值并将其存储在 MySQL 数据库中。
如果我注意到之前 100 个注册中已有 10 个使用相同的浏览器哈希注册了免费试用...我将不会为该帐户启用免费试用奖励。
我该从哪里开始呢？ （在哪里可以找到所有 javascript 浏览器变量设置的列表，例如窗口大小、操作系统、浏览器和版本号、国家/地区、语言等...？或者 jquery 是否已经提供类似的内容？）
我考虑过实施电话验证通过 twilio...但这会花费我的钱，花费我的用户的钱，并最终导致免费试用的减少。
编辑：这里的目标是尽可能限制欺诈活动，并且不妨碍最轻微的实际活动！
当然这个解决方案并不完美，但加上我已经拥有的其他解决方案将会有所帮助。我愿意接受一些损失，但希望尽可能限制它。
I run a SaaS that allows free trials. Basically if you register you get a few dollars worth of free services immediately. I have been determining new users based on IP address alone and it has worked well for the first few months. Now people are finally catching on that it is trivially easy to change their IP address and scam me out of free trial bonuses.
What I want to do is basically create a hash of all possible javascript browser variables and store it in a MySQL database.
If I notice that the same browser hash has signed up for a free trial 10 out of the previous 100 registrations... I will not enable a free trial bonus to that account.
Where do I even start? (Where can I find a list of all javascript browser variable settings like window size, operating system, browser and version number, country, language etc...? Or does jquery offer something like this already?)
I have thought about implementing phone verification via twilio... but that would cost me money, cost my users money, and ultimately lead to fewer free trials.
EDIT: THE GOAL HERE IS TO LIMIT FRAUDULENT ACTIVITY AS MUCH AS POSSIBLE, AND NOT HINDER REAL ACTIVITY IN THE SLIGHTEST!
Sure this solution is not perfect, but added with the others I already have it will help. I am willing to accept some loss, but would like to limit it as much as possible.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
您可能想做的是查看浏览器指纹 http://panopticlick.eff.org/
尽管这无论如何都不是万无一失的，如果您将其与 cookie 和用户 IP 地址混合，您应该会得到适合大多数用户的东西。
已更新
如果我的想法是限制欺诈活动，我会实施基于短信的代码，类似于 Gmail 的工作原理。您必须输入您的手机号码才能获得免费试用，如果您批量购买短信，您应该能够以每条 2 便士左右的价格获得它们，而且实施起来很容易，只需找到具有 API 的短信供应商即可。
尽管您可以使用上面的技术，但它过于复杂，并且仍然不会万无一失，并且可以轻松解决。
What you might want to do is take a look at browser finger printing http://panopticlick.eff.org/
Although this is not fool proof by any means if you mix it with cookies and the users IP address you should get something that works for most users.
Updated
If the idea is to limit fraudulent activity I would implement a SMS based code, similar to how Gmail works. You have to enter your mobile number to get the free trail, If you buy SMS's in bulk you should be able to get them for about 2p each, and its easy to implment just find a SMS supplier with a API.
Although you can use the technique above it is overly complex and still wont be fool proof, and can easily be worked around.
这确实不可靠。
问题
如果有任何变化（例如浏览器更新，更不用说它可以只是切换），您的哈希将不会匹配，并且同一个人将能够再次开始试用。
当您存储一些会话/cookie 数据时，也会出现同样的问题 - cookie 可以被清除（cookie 通常存储会话标识符）。
解决
方案您面临的问题可能只能通过注册来解决 - 您可以使用OAuth 并允许人们使用其他提供商（Google、Facebook、Twitter、Linkedin 等）的现有帐户进行注册
This is really unreliable.
Problem
If anything changes (for example the browser is updated, not mentioning it can be just switched), your hash will not be matched and the same person will be able to start the trial again.
Same problem when you store some session / cookie data - the cookies can be cleaned (and cookies usually store identifiers for sessions).
Solution
The problem you are facing can be solved probably only by registration - you can simplify this as much as possible by using OAuth and allowing people to sign up using their existing accounts from other providers (Google, Facebook, Twitter, Linkedin etc.)
您正在尝试在 JavaScript 中唯一地标识一个人。这在网络上通常是不可能做到的——部分是出于设计目的，为了保持匿名。您在这里可以做的最好的事情就是设置一个 cookie，并在用户尝试更改其 IP 地址时检查该 cookie。
他们始终能够清除 cookie，但这就是您所能做的。
You are trying to uniquely identify a person in javascript. This is something that is generally impossible to do on the web - partly by design, to maintain anonymity. The best you can do here is set a cookie, and check for the cookie when the user try's to change their IP address.
They will always be able to clear their cookies, but that's about all you can do.
您是否考虑过实施验证码？
这不会阻止愿意手动创建多个帐户的用户，但肯定会击败在几分钟内创建数百个帐户的机器人。
我喜欢验证码：
http://www.google.com/recaptcha，它是免费的，它为视觉障碍人士提供了解决方案受损，它有助于书籍数字化。
Have you considered implementing captcha ?
It would not be a deterrent against users willing to create multiple accounts manually but would definitely defeat the bots creating hundred of accounts in minutes.
I like recaptcha :
http://www.google.com/recaptcha, it's free, it has solutions for people that are visually impaired and it help digitising books.