Is it reliable to use the IP address to identify a user on your website?

Question

Here is my situation. I am part of a project creating a P2P charity website, where users connect and can give money to one another. Because of the nature of the site, we kno

Answer 1

Recent legal case perhaps worth reading up on : http://yro.slashdot.org/story/11/05/03/2020205/An-IP-Address-Does-Not-Point-To-a-Person-Judge-Rules

Answer 2

No: for example, any company proxy will only have one external IP address, so everyone registering from within the network will appear to have the same IP address.

Answer 3

Totally unreliable...

1. Somebody on dial-up will have a different IP address every time they "dial-up".

2. DSL users will have a different IP address every time they reset or reconnect their account unless they pay for a static IP.

3. Many users on a particular LAN will be sharing one public IP address.

4. A particular user can login from home, work, public hotspot and have a different IP from each location.

Answer 4

No, not least because:

1. IP Addresses can change over time, thanks to DHCP leases expiring.
2. People access websites from many different locations including home, work, coffee shops, etc.
3. When behind a NAT firewall or a proxy server, many people can share the same IP address.

Will you have many people registering who are entitled to receive money? I'd suggest a manual verification process using real people if at all possible. If nothing else, you can claim to be exercising due diligence if there's a human involved.

Answer 5

If you want to identify users, you can use a cookie. One solution uses a combination of cookies, local storage, flash, and other state information that can be stored in a browser: http://samy.pl/evercookie/

Nothing is 100% reliable. These cookies can be erased by a determined user, or in some browsers with one click. Ultimately, in many countries outside of the USA, a user has the right not to be tracked.

Answer 6

It could be somewhat useful as part of a defense-in-depth approach, but I wouldn't call it "reliable".