Question

I want to detect multi accounts in a browser game: If a user has more than one account, I want to know this.

For various reasons, I don’t want to detect the multi accounts by comparing IPs anymore. Users can share IPs and IPs are easy to change. So this is not a good method.

Instead, I want to detect the accounts using cookies. Do you think this is a good solution?

<?php
$uniqueHash = md5($_SERVER['REMOTE_ADDR'].mt_rand(1, 100000)); // identify a single user
if (isset($_COOKIE['uniqueHash'])) {
    // UPDATE dbTable SET uniqueHash = '".$_COOKIE['uniqueHash']."' WHERE id = x
}
else {
    setcookie('uniqueHash', $uniqueHash, time()+3600*24*30, '/', '.domain.com', FALSE, TRUE)
}
?>

After that, I can select all users who have the same uniqueHash value from the database table.

Is this improvable? Or a totally bad solution?

What about flash cookies? They’re better, right? But I can’t use them when I have no flash on my site, can I?

Thanks in advance!

Answer 1

If you create log containing date for login, ip, hash and UserID – you might be able to get an idea if a user is a multi account or not. Detecting it automatically will be nearly impossible, if im visiting a friend of mine, I might login on his computer to check my account?

So log all the data, then have a “multihunter”-human look into if its the same player or not.