how to prevent users from create multiple accounts on free-daily limited service

Question

The idea is we have a website for free downloads

but there will be daily limit of daily downloads for each user (say 5 dl per day per user) so there will be users with multiple accounts.

1. IP detection is not good; cause I have many users from one ip (users from one organization)
2. email verification and unique email account is not good; u can create more than one account
3. sms confirmation is not good; users can use his/her friend cell phone number to register another account

I saw a website that solved this issue (partially) www.gameknot.com

They detect users by computer name or MAC address or something else I am not sure, I registered 3 users there, they detected me, said :"these three users are using same computer" !! and banned all three accounts.

When I reinstalled another windows the problem solved, I have one user there.

So I asked myself, "how they did this"?

Is there any suggestion as to how I can handle this issue?

Answer 1

If I would implement such a system, to have only one signon per user or something like that I would do something like this:

1: create an ID of the machine, based on IP, maybe using JavaScript/Java Applet/Flash you can get MAC or I don't know what things in consideration. For simplicity let's say I compute the host ID like this:

ID = MD5(PUBLIC_IP) + MD5(LOCAL_IP) + MD5(MAC)

2: User1 log in and let's pretend I computed host ID = 666. WE look up a table in DB let's say table_hosts that containt this data (user, host_id)

3: User1 used all 5 downloads (keep track of them using session or records from database)

4: User1 try to login as User2 and now we compute the ID = 666, the same ID = 666, we lookup out table_hosts and find out that the same host ID was used doring that day by User1 too. Now we can ban the accounts with that ID, give warnings like 20% until ban etc

Hope I could help, but remember be creative, that's all that matter!

LE: Because others put in discussion shared machines the ID may be calculated like this:

ID = MD5(PUBLIC_IP) + MD5(LOCAL_IP) + MD5(MAC) + MD5(NameOfLoggedOnUser)

But this have it's disadvantage too, the abuser may create 2 or more accounts on it's machine. Anyway I repeat be creative and yeah we should not forget that any lock can be lock picked.