Tell me more ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.
up vote 1 down vote favorite

We have a site that allows users to generate their own content. If users generate illegal content, we'll be submitting a report to the authorities. In the event that we do have to report a user, we want as much info as possible on that user. With that said, I have two questions:

  • Is tracking the user's ip address enough to identify them?
  • And, we track the user's ip address in the sessions table which gets wiped clean periodically. Should we archive the sessions data to retain that info or should we put an ip_address field in the our Post and Comments tables instead?
share|improve this question
3  
An IP address is not sufficient. I'm not enough of an expert to turn this into an answer, but I know there are plenty of situations where a large group of people (perhaps an entire company?) will appear to the outside world as a single IP address. – Dan Pichelman Apr 9 at 13:32
1  
If an IP is enough to identify a user may depend on local law. In copyright cases some US judges have decided that it does not while here in Germany it normally is. Beyond that everybody could use a VPN service or similar to hide his identity. Or they may use a public IP from schools, libraries etc. If you want to be 100% sure of a users identity you may want to require registration based on some credit card information (but beware of pre paid cards) – thorsten müller Apr 9 at 13:32
1  
I hope your site clearly and largely (as in really big letters) states that you intend to go out of your way to help prosecute people who use your site. Otherwise, I think what you are trying to do is quite despicable. – Dunk Apr 9 at 18:35
@dunk - in order to get my posts answered, I keep them short and therefore don't include all the details. But to answer your question, the site has clear guidelines of what is allowed and what is not. We clearly state that we report illegal/criminal activity to the authorities; a similar policy held by large user generated sites you're most likely familiar with. – hugo Apr 9 at 20:49

1 Answer

up vote 5 down vote

An IP address identifies devices (at a certain point of time), not people. The use of proxies lets many devices appear under the same IP address.

The only way to identify users is to let them create an account and log in in order to generate content. And not even this guarantees that the user using the account is the user owning the account.

share|improve this answer
Is there any other identifiable information, such as Network? Or, is identifying users in general a tricky area? We do collect account info upon signup but, to your point, you never really know if it the user's real info. I am not too knowledgable in this area and, for now, just gathering requirements. – hugo Apr 9 at 16:32
There is no way (not even DNA tests) to identify a person with 100% certainity. However, it is reasonable to rely on username/password combinations (if a secure connection like HTTPS is provided). It is in responsibility of the user to prevent others from using his credentials, not yours. – nibra Apr 10 at 10:41

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.