Re: Arranging free trials for online services.
On 12/3/2012 12:45 PM, Roedy Green wrote:
I was disturbed when a grammar checking online service wanted my
credit card before they would even let me see the product. I
declined.
Then I started to wonder what such a service could to prevent people
from getting endless free trials. Software you install can hide
something in the registry, but what can online software do?
Send an email and require the user to reply to it. Email is a pretty
good unique identifier (few people share email addresses nowadays), and
some analysis on the replied email message can catch some people who are
using multiple email addresses to try to subvert the free trial.
Alternatively, a Facebook account seems an increasingly acceptable
alternative nowadays...
It would be nice if people had unique ids. Perhaps someday everyone
will get a code-signing cert to use as online ID.
We call these online IDs "email addresses." Despite all the constant
crowing about the death of email, email addresses remain the single most
common identifier on the internet.
You could track IP, but a student at a university plugging in anywhere
to a campus net would get a different IP and many students would get
the same IP.
You could run some JWS signed code to snoop on the CPU ID, but that
can be turned off and AMD chips don't have one.
There are several pieces of data which tend to be consistent over short
periods of time that you can combine for fingerprinting:
List of installed fonts
Number of CPUs
IP address
Browser User-Agent
All other HTTP request headers
Computer's username
Computer's local hostname
Many of these you can get by snooping the request data; the rest can be
triggered by watchdog plugins (Java applets or Flash objects). If you
take all of this data and let 1 or 2 pieces change, then you should be
able to build a sufficiently good unique identifier. The purpose of
security isn't to make your system unbreakable; it's to make it more
annoying to break than the person next door.
--
Beware of bugs in the above code; I have only proved it correct, not
tried it. -- Donald E. Knuth