How to detect new Machine like Facebook?

Question

I am actually trying to detect a person, using a computer, Just like facebook. Whenever you sign into facebook using different machine, it detects the new machine and asks you t

Answer 1

I recently tried this myself with the following results:

---

MACBOOK = My laptop

DELL = My friends laptop

I logged in to Facebook on MACBOOK in SWEDEN, and was asked to name the device.

My friend logged in to Facebook on DELL in SWEDEN and was asked to name the device.

We both went to JAPAN.

I logged in to Facebook on MACBOOK in JAPAN, I was not requested to name the device again.

My friend logged in to Facebook on DELL in JAPAN, and was not requested to name the device again.

I logged in to Facebook on DELL in JAPAN, and was asked to name the device.

---

So, from that I conclude two different options:

1. A persistant cookie for each Facebook user that logins on the device.
2. Somehow Facebook can match MAC-adresses.

Since 2. is never achievable without you installing plugins or whatnot, we are left with 1.

Exploring the cookies I have with Facebook, I discover 13 of them. Using Google Chrome for this is really useful. Just go to chrome://settings/cookies and you'll get a list.

The Facebook cookie named "lu" contains the following information:

Name:   lu
Content:    (data)
Domain: .facebook.com
Path:   /
Send For:   Any kind of connection
Accessible to Script:   No (HttpOnly)
Created:    Thursday, June 9, 2011 8:58:10 PM
Expires:    Saturday, June 8, 2013 8:58:10 PM

This is the only cookie they have that don't expire on browser close, the same day or a few days ahead. My educated guess would be that (data) would consist of the device information they check for this feature.

I would also guess that they store the information in their database, and upon logging in they match the data against you again. If you match in certain predefined ways (like, both the ip adress and the browser is still the same), you automatically gets approved. This would explain why you could format your computer and still have the device approved.

I am guessing that if you delete all cookies and then move to a different internet provider, you would be required to register the device again.