entityMap|blocks|key|8nk7q|text|我认为cookies可能是你正在寻找的；这是大多数网站唯一识别访问者的方式。|type|unstyled|depth|inlineStyleRanges|entityRanges|data^0^^$0|$]|1|@$2|3|4|5|6|7|8|C|9|@]|A|@]|B|$]]]]

I think cookies might be what you are looking for; this is how most websites uniquely identify visitors.

entityMap|blocks|key|es385|text|如果没有所有者的合作，就不可能识别访问网站的计算机。但是，如果他们允许，您可以存储cookie，以便在计算机再次访问您的站点时识别该计算机。关键是，访问者处于控制之中；他们可以删除cookie，并在任何时候以新访问者的身份出现。|type|unstyled|depth|inlineStyleRanges|entityRanges|data^0^^$0|$]|1|@$2|3|4|5|6|7|8|C|9|@]|A|@]|B|$]]]]

It's not possible to identify the computers accessing a web site without the cooperation of their owners. If they let you, however, you can store a cookie to identify the machine when it visits your site again. The key is, the visitor is in control; they can remove the cookie and appear as a new visitor any time they wish.

entityMap|blocks|key|1ch78|text|Cookie对于确定独立访问者没有什么用处。用户可以清除cookie并刷新站点--然后他又被归类为新用户。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1hvh7|我认为最好的方法是实现一个服务器端解决方案(因为你需要一个地方来存储你的数据)。根据您对这类数据的需求的复杂性，您需要确定什么属于唯一访问。一种明智的方法是允许IP地址在第二天返回并进行唯一访问。同一个IP地址在一天内的多次访问不应该被算作唯一访问。|9q2vq|例如，使用PHP，获取访问者的IP地址并将其存储在文本文件(或sql数据库)中是很容易的。|b4p3c|服务器端解决方案将在所有机器上运行，因为您将在用户首次加载您的站点时对其进行跟踪。不要使用javascript，因为这意味着客户端脚本，而且用户可能在任何情况下都禁用了它。|3i5vr|希望这能有所帮助。^0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|K|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|L|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|M|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|N|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|O|9|@]|A|@]|B|$]]]]

Cookies won't be useful for determining unique visitors. A user could clear cookies and refresh the site - he then is classed as a new user again.

I think that the best way to go about doing this is to implement a server side solution (as you will need somewhere to store your data). Depending on the complexity of your needs for such data, you will need to determine what is classed as a unique visit. A sensible method would be to allow an IP address to return the following day and be given a unique visit. Several visits from one IP address in one day shouldn't be counted as uniques.

Using PHP, for example, it is trivial to get the IP address of a visitor, and store it in a text file (or a sql database).

A server side solution will work on all machines, because you are going to track the user when he first loads up your site. Don't use javascript, as that is meant for client side scripting, plus the user may have disabled it in any case.

Hope that helps.

entityMap|blocks|key|1dvol|text|与前面的解决方案一样，cookie是一种很好的方法，请注意它们标识了|type|unstyled|depth|inlineStyleRanges|entityRanges|data|3vr01|浏览器|3h8mt|不过。如果我在Firefox中访问一个网站，然后在Internet+Explorer中访问，那么两次尝试都会分别存储cookie。一些用户也会禁用cookies+(但更多的人会禁用JavaScript)。|9mq5i|另一种需要考虑的方法是IP和主机名标识(请注意，对于拨号/非静态IP用户，这些可能会有所不同，AOL也使用全套IP)。然而，因为它只识别网络，所以它可能不会像cookie那样工作。^0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|I|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|J|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|K|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|L|9|@]|A|@]|B|$]]]]

As with the previous solutions cookies are a good method, be aware that they identify browsers though. If I visited a website in Firefox and then in Internet Explorer cookies would be stored for both attempts seperately. Some users also disable cookies (but more people disable JavaScript).

Another method to consider would be I.P. and hostname identification (be aware these can vary for dial-up/non-static IP users, AOL also uses blanket IPs). However since this only identifies networks this might not work as well as cookies.

entityMap|blocks|key|2f3ep|text|一种可能性是使用|type|unstyled|depth|inlineStyleRanges|entityRanges|data|dq4n9|flash+cookies|dojs0|无处不在的可用性(95%25的访问者可能会有flash)|5e2cu|每个cookie可以存储更多数据(最多100+KB)|8p4lb|跨浏览器共享，因此更有可能唯一标识一台计算机|al5j4|清除浏览器cookies不会删除flash+cookies。|8augc|你需要创建一个小的(隐藏的)+flash电影来读写它们。|1tvdp|无论你选择哪条路线，都要确保你的用户选择被跟踪，否则你就会侵犯他们的隐私，成为坏人之一。^0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|Q|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|R|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|S|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|T|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|U|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|V|9|@]|A|@]|B|$]]|$2|M|4|N|6|7|8|W|9|@]|A|@]|B|$]]|$2|O|4|P|6|7|8|X|9|@]|A|@]|B|$]]]]

A possibility is using <a href="http://yro.slashdot.org/article.pl?sid=08/10/14/1656251&amp;from=rss" rel="noreferrer">flash cookies</a>:

<ul>
<li>Ubiquitous availability (95 percent of visitors will probably have flash)</li>
<li>You can store more data per cookie (up to 100 KB)</li>
<li>Shared across browsers, so more likely to uniquely identify a machine</li>
<li>Clearing the browser cookies does not remove the flash cookies.</li>
</ul>

You'll need to build a small (hidden) flash movie to read and write them.

Whatever route you pick, make sure your users opt IN to being tracked, otherwise you're invading their privacy and become one of the bad guys.

entityMap|blocks|key|2qml7|text|因为我希望这个解决方案可以在所有机器和所有浏览器上运行(在合理范围内)，所以我尝试使用javascript创建一个解决方案。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|huh4|3h3d1|这不是一个很好的理由吗|egitn|注释|8iu1o|使用javascript？|819nn|正如其他人所说的--+cookies可能是你最好的选择--只要意识到它的局限性就行了。^0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|L|9|@]|A|@]|B|$]]|$2|C|4|-4|6|7|8|M|9|@]|A|@]|B|$]]|$2|D|4|E|6|7|8|N|9|@]|A|@]|B|$]]|$2|F|4|G|6|7|8|O|9|@]|A|@]|B|$]]|$2|H|4|I|6|7|8|P|9|@]|A|@]|B|$]]|$2|J|4|K|6|7|8|Q|9|@]|A|@]|B|$]]]]

<blockquote>
 Because i want the solution to work on all machines and all browsers (within reason) I am trying to create a solution using javascript.
</blockquote>

Isn't that a really good reason not to use javascript?

As others have said - cookies are probably your best option - just be aware of the limitations.

entityMap|blocks|key|bobpi|text|假设你不想让用户控制，你就不能。网络不是这样工作的，你所能期望的最好的就是一些启发式的东西。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|ds2pl|如果是强制访问者安装一些软件并使用TCPA的选项，那么您也许能够完成一些工作。^0|0^^$0|$]|1|@$2|3|4|5|6|7|8|E|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|F|9|@]|A|@]|B|$]]]]

Assuming you don't want the user to be in control, you can't. The web doesn't work like that, the best you can hope for is some heuristics.

If it is an option to force your visitor to install some software and use TCPA you may be able to pull something off.

entityMap|blocks|key|ccj8d|text|实际上，您想要做的事情是无法完成的，因为协议不允许这样做。如果普遍使用静态it，那么您也许能够做到这一点。他们不是，所以你不能。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|6hhst|如果你真的想找出|dtg8n|人|35b9g|，让他们登录。|cfp1n|由于它们可能会在您的网站上移动到不同的页面，因此您需要一种方法来跟踪它们的移动。|3hs17|只要他们登录了，并且你通过cookies/link-parameters/beacons/任何东西跟踪他们在你的站点内的会话，你就可以非常确定他们在这段时间内使用的是同一台计算机。|b57pe|最后，如果您的用户没有使用您自己的本地网络并且没有静态IP地址，那么这样说就不能告诉您他们使用的是哪台计算机。|c3il1|如果你想要做的事情是在用户的合作下完成的，并且每个cookie只有一个用户，并且他们使用单一的web浏览器，那么只需使用cookie即可。^0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|Q|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|R|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|S|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|T|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|U|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|V|9|@]|A|@]|B|$]]|$2|M|4|N|6|7|8|W|9|@]|A|@]|B|$]]|$2|O|4|P|6|7|8|X|9|@]|A|@]|B|$]]]]

Really, what you want to do cannot be done because the protocols do not allow for this. If static IPs were universally used then you might be able to do it. They are not, so you cannot.

If you really want to identify people, have them log in.

Since they will probably be moving around to different pages on your web site, you need a way to keep track of them as they move about.

So long as they are logged in, and you are tracking their session within your site via cookies/link-parameters/beacons/whatever, you can be pretty sure that they are using the same computer during that time.

Ultimately, it is incorrect to say this tells you which computer they are using if your users are not using your own local network and do not have static IP addresses.

If what you want to do is being done with the cooperation of the users and there is only one user per cookie and they use a single web browser, just use a cookie.

entityMap|blocks|key|eg4ap|text|您只能通过HTTP连接获得少量信息。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|a5a3i|IP+-但正如其他人所说，由于ISP的动态分配策略，即使不是大多数互联网用户，也有许多互联网用户无法解决这一问题。|ah0oh|Useragent字符串-几乎所有浏览器都会为每个请求发送浏览器类型。然而，这可以由用户在今天的许多浏览器中设置。|3kkqe|请求字段的集合-还有其他字段随每个请求一起发送，例如支持的编码等。如果在聚合中使用这些字段，可以帮助识别用户的计算机，但同样依赖于浏览器，并且可以更改。|ee48d|cookie+-设置cookie是识别机器的另一种方法，更具体地说是识别机器上的浏览器，但正如其他人所说，用户可以删除或关闭cookie，并且只适用于浏览器，而不适用于机器。|23q0c|因此，正确的回答是，您无法实现仅通过HTTP+over+IP协议实现的功能。但是，结合使用cookie、IP和HTTP请求中的字段，您很有可能猜测它是哪台机器。用户倾向于只使用一种浏览器，而且通常来自一台机器，所以这可能是相当可靠的，但这将根据audience...techies的不同而有所不同，这些浏览器更有可能搞乱这些东西，并使用更多的机器/浏览器。此外，这甚至可以与某些尝试相结合，以对IP进行地理定位，并使用该数据。但在任何情况下，都没有始终正确的解决方案。^0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|M|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|N|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|O|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|P|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|Q|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|R|9|@]|A|@]|B|$]]]]

There is only a small amount of information that you can get via an HTTP connection.

<ol>
<li>IP - But as others have said, this is not fixed for many, if not most Internet users due to their ISP's dynamic allocation policies.</li>
<li>Useragent String - Nearly all browsers send what kind of browser they are with every request. However, this can be set by the user in many browsers today.</li>
<li>Collection of request fields - There are other fields sent with each request, such as supported encodings, etc. These, if used in the aggregate can help to ID a user's machine, but again are browser dependent and can be changed.</li>
<li>Cookies - Setting a cookie is another way to identify a machine, or more specifically a browser on a machine, but as others have said, these can be deleted, or turned off by the users, and are only applicable on a browser, not a machine.</li>
</ol>

So, the correct response is that you cannot achieve what you would live via the HTTP over IP protocols alone. However, using a combination of cookies, as well as IP, and the fields in the HTTP request, you have a good chance at guessing, sort of, what machine it is. Users tend to use only one browser, and often from one machine, so this may be fairly relieable, but this will vary depending on the audience...techies are more likely to mess with this stuff, and use more machines/browsers. Additionally, this could even be coupled with some attempt to geo-locate the IP, and use that data as well. But in any case, there is no solution that will be correct all of the time.

entityMap|blocks|key|8rqv8|text|我猜结论是我不能以编程方式唯一地识别正在访问我的网站的计算机。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|cen1t|我有以下问题。当我使用一台从未访问过我的在线银行网站的机器时，系统会要求我提供额外的身份验证。然后，如果我第二次回到网上银行网站，我不会被要求额外的身份验证。阅读了我的问题的答案后，我决定这肯定是涉及到一个cookie。因此，我删除了IE中的所有cookie，并重新登录到我的网上银行网站，完全期望再次被问及身份验证问题。令我惊讶的是，我没有被邀请。这不会让人相信银行正在做一些不涉及cookie的pc标签吗？|ehhup|此外，今天在谷歌了很多次后，我发现了下面的公司，他们声称销售一种解决方案，可以唯一地识别访问网站的机器。|6q9a7|http://www.the41.com/products.asp|fu9d5|..。|fn7qv|如果你能进一步澄清我发现的这些相互矛盾的信息，我将不胜感激。^0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|M|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|N|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|O|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|P|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|Q|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|R|9|@]|A|@]|B|$]]]]

I guess the verdict is i cannot programmatically uniquely identify a computer which is visiting my web site.

I have the following question. When i use a machine which has never visited my online banking web site i get asked for additional authentification. then, if i go back a second time to the online banking site i dont get asked the additional authentification. reading the answers to my question i decided it must be a cookie involved. therefore, i deleted all cookies in IE and relogged onto my online banking site fully expecting to be asked the authentification questions again. to my surprise i was not asked. doesnt this lead one to believe the bank is doing some kind of pc tagging which doesnt involve cookies?

further, after much googling today i found the following company who claims to sell a solution which does uniquely identify machines which visit a web site. <a href="http://www.the41.com/products.asp" rel="nofollow noreferrer">http://www.the41.com/products.asp</a>.

i appreciate all the good information if you could clarify further this conflicting information i found i would greatly appreciate it.

entityMap|blocks|key|64ng|text|除了使用cookie的建议之外，唯一可用于查询的综合标识属性集包含在HTTP请求标头中。因此，可以使用它们的某个子集来为用户代理(即，浏览器)创建伪唯一标识符。此外，默认情况下，这些信息中的大多数可能已经记录在web服务器软件的所谓“访问日志”中，如果没有，可以很容易地配置为这样做。然后，可以开发一个实用程序，它可以简单地扫描该日志的内容，创建|type|unstyled|depth|inlineStyleRanges|entityRanges|data|83vvs|指纹|d305h|例如，由IP地址和用户代理字符串等组成的每个请求的可用数据越多，即使包括特定cookie的内容，也增加了该指纹的唯一性的质量。然而，正如许多其他人已经声明的那样，HTTP协议并不能使这100%25万无一失--充其量它只能是一个相当好的指示器。^0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|G|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|H|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|I|9|@]|A|@]|B|$]]]]

The suggestions to use cookies aside, the only comprehensive set of identifying attributes available to interrogate are contained in the HTTP request header. So it is possible to use some subset of these to create a pseudo-unique identifier for a user agent (i.e., browser). Further, most of this information is possibly already being logged in the so-called "access log" of your web server software by default and, if not, can be easily configured to do so. Then, a utlity could be developed that simply scans the content of this log, creating fingerprints of each request comprised of, say, the IP address and User Agent string, etc. The more data available, even including the contents of specific cookies, adds to the quality of the uniqueness of this fingerprint. Though, as many others have stated already, the HTTP protocol doesn't make this 100% foolproof - at best it can only be a fairly good indicator.

entityMap|blocks|key|bi031|text|当我使用一台从未访问过我的在线银行网站的机器时，系统会要求我提供额外的身份验证。然后，如果我第二次回到网上银行网站，我不会被问到额外的身份验证……我删除了IE中的所有cookie，并重新登录到我的在线银行网站，完全期待再次被问到身份验证问题。令我惊讶的是，我没有被邀请。这不会让人相信银行正在做一些不涉及cookie的pc标签吗？|type|unstyled|depth|inlineStyleRanges|entityRanges|data|es89d|46v7o|这是银行使用的一种非常常见的身份验证类型。|2aqa|假设您正在通过example-isp.com访问您的银行网站。第一次访问时，系统会要求您提供密码以及额外的身份验证。一旦你通过了，银行就知道用户"thatisvaliant“已经通过了认证，可以通过example-isp.com访问该网站。|9252a|将来，当你通过example-isp.com访问网站时，它不会要求额外的身份验证(除了你的密码之外)。如果您尝试通过另一个-isp.com访问银行，银行将再次执行相同的例程。|v0rj|总而言之，根据你的IP地址，银行识别的是你的ISP和/或netblock。显然，并不是你在ISP的每个用户都是你，这就是为什么银行仍然要求你提供密码。|32g7o|您是否曾接到信用卡公司的电话，询问您在不同国家使用信用卡是否正常？同样的概念。^0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|N|9|@]|A|@]|B|$]]|$2|C|4|-4|6|7|8|O|9|@]|A|@]|B|$]]|$2|D|4|E|6|7|8|P|9|@]|A|@]|B|$]]|$2|F|4|G|6|7|8|Q|9|@]|A|@]|B|$]]|$2|H|4|I|6|7|8|R|9|@]|A|@]|B|$]]|$2|J|4|K|6|7|8|S|9|@]|A|@]|B|$]]|$2|L|4|M|6|7|8|T|9|@]|A|@]|B|$]]]]

<blockquote>
 When i use a machine which has never visited my online banking web site i get asked for additional authentification. then, if i go back a second time to the online banking site i dont get asked the additional authentification...i deleted all cookies in IE and relogged onto my online banking site fully expecting to be asked the authentification questions again. to my surprise i was not asked. doesnt this lead one to believe the bank is doing some kind of pc tagging which doesnt involve cookies?
</blockquote>

This is a pretty common type of authentication used by banks.

Say you're accessing your bank website via example-isp.com. The first time you're there, you'll be asked for your password, as well as additional authentication. Once you've passed, the bank knows that user "thatisvaliant" is authenticated to access the site via example-isp.com.

In the future, it won't ask for extra authentication (beyond your password) when you're accessing the site via example-isp.com. If you try to access the bank via another-isp.com, the bank will go through the same routine again.

So to summarize, what the bank's identifying is your ISP and/or netblock, based on your IP address. Obviously not every user at your ISP is you, which is why the bank still asks you for your password.

Have you ever had a credit card company call to verify that things are OK when you use a credit card in a different country? Same concept.

entityMap|blocks|key|49m1v|text|我会使用cookie和flash+cookie的组合来实现这一点。创建GUID并将其存储在cookie中。如果cookie不存在，请尝试从闪存cookie中读取它。如果仍未找到，则创建它并将其写入闪存cookie。这样，您就可以在不同的浏览器之间共享相同的GUID。|type|unstyled|depth|inlineStyleRanges|entityRanges|data^0^^$0|$]|1|@$2|3|4|5|6|7|8|C|9|@]|A|@]|B|$]]]]

I would do this using a combination of cookies and flash cookies. Create a GUID and store it in a cookie. If the cookie doesn't exist, try to read it from the flash cookie. If it's still not found, create it and write it to the flash cookie. This way you can share the same GUID across browsers.

entityMap|blocks|key|eki47|text|这些人已经开发出一种指纹识别方法，用于以高精度识别用户：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|fkqfa|https://panopticlick.eff.org/static/browser-uniqueness.pdf|7lemd|我们通过版本和配置信息来调查现代web浏览器在多大程度上受到“设备指纹”的影响，这些信息将在请求时传输到网站。我们实现了一种可能的指纹识别算法，并从访问我们测试方的大量浏览器样本中收集了这些指纹，|6ppr4|panopticlick.eff.org|7tfsh|..。我们观察到我们指纹的分布至少包含18.1比特的熵，这意味着如果我们随机选择一个浏览器，我们最多预计286777个其他浏览器中只有一个会共享它的指纹。在支持Flash或Java的浏览器中，情况更糟，平均每个浏览器至少携带18.8比特的识别信息。在我们的样本中，94.2%25的带有Flash或Java的浏览器是独一无二的。|fn4mu|通过观察返回的访问者，我们估计随着时间的推移，浏览器指纹可能会以多快的速度变化。在我们的样本中，指纹变化非常快，但即使是一个简单的启发式方法通常也能够猜测出一个指纹是以前观察到的浏览器指纹的“升级”版本，99.1%25的猜测是正确的，而误报率只有0.86%25。|fcbph|我们讨论了浏览器指纹识别在实践中造成的隐私威胁，以及可能适合防止它的对策。在防止指纹性和某些类型的可调试性之间存在权衡，在当前的浏览器中，这与隐私有很大的权衡。矛盾的是，如果反指纹隐私技术没有被足够多的人使用，那么它们可能会弄巧成拙；我们表明，一些隐私措施目前成为这种悖论的受害者，但其他措施没有...^0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|O|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|P|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|Q|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|R|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|S|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|T|9|@]|A|@]|B|$]]|$2|M|4|N|6|7|8|U|9|@]|A|@]|B|$]]]]

These people have developed a fingerprinting method for recognising a user with a high level of accuracy:

<a href="https://panopticlick.eff.org/static/browser-uniqueness.pdf" rel="noreferrer">https://panopticlick.eff.org/static/browser-uniqueness.pdf</a>

<blockquote>
 We investigate the degree to which modern web browsers
 are subject to “device fingerprinting” via the version and configuration information that they will transmit to websites upon request. We
 implemented one possible fingerprinting algorithm, and collected these
 fingerprints from a large sample of browsers that visited our test side,
 <a href="https://panopticlick.eff.org/static/panopticlick.eff.org" rel="noreferrer">panopticlick.eff.org</a>. We observe that the distribution of our finger-
 print contains at least 18.1 bits of entropy, meaning that if we pick a
 browser at random, at best we expect that only one in 286,777 other
 browsers will share its fingerprint. Among browsers that support Flash
 or Java, the situation is worse, with the average browser carrying at least
 18.8 bits of identifying information. 94.2% of browsers with Flash or Java
 were unique in our sample.
 
 By observing returning visitors, we estimate how rapidly browser fingerprints might change over time. In our sample, fingerprints changed quite
 rapidly, but even a simple heuristic was usually able to guess when a fingerprint was an “upgraded” version of a previously observed browser’s
 fingerprint, with 99.1% of guesses correct and a false positive rate of only
 0.86%.
 
 We discuss what privacy threat browser fingerprinting poses in practice,
 and what countermeasures may be appropriate to prevent it. There is a
 tradeoff between protection against fingerprintability and certain kinds of
 debuggability, which in current browsers is weighted heavily against privacy. Paradoxically, anti-fingerprinting privacy technologies can be self-
 defeating if they are not used by a sufficient number of people; we show
 that some privacy measures currently fall victim to this paradox, but
 others do not...
</blockquote>

entityMap|blocks|key|5pe4o|text|你可能想试着在一个evercookie中设置一个唯一的ID+(它可以跨浏览器工作，请看他们的常见问题)：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|2etc2|http://samy.pl/evercookie/|9c5ij|还有一家名为ThreatMetrix的公司，许多大公司都在使用它来解决这个问题：|e4st5|http://threatmetrix.com/our-solutions/solutions-by-product/trustdefender-id/|call3|他们相当昂贵，他们的一些其他产品也不是很好，但他们的设备id工作得很好。|cg0ok|最后，还有panopticlick思想的开源jquery实现：|d3rkh|https://github.com/carlo/jquery-browser-fingerprint|bjjrh|它现在看起来还不成熟，但可以进一步扩展。|7qngi|希望能有所帮助！^0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|S|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|T|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|U|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|V|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|W|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|X|9|@]|A|@]|B|$]]|$2|M|4|N|6|7|8|Y|9|@]|A|@]|B|$]]|$2|O|4|P|6|7|8|Z|9|@]|A|@]|B|$]]|$2|Q|4|R|6|7|8|10|9|@]|A|@]|B|$]]]]

You may want to try setting a unique ID in an evercookie (it will work cross browser, see their FAQs):
<a href="http://samy.pl/evercookie/" rel="noreferrer">http://samy.pl/evercookie/</a>

There is also a company called ThreatMetrix that is used by a lot of big companies to solve this problem:
<a href="http://threatmetrix.com/our-solutions/solutions-by-product/trustdefender-id/" rel="noreferrer">http://threatmetrix.com/our-solutions/solutions-by-product/trustdefender-id/</a>
They are quite expensive and some of their other products aren't very good, but their device id works well.

Finally, there is this open source jquery implementation of the panopticlick idea:
<a href="https://github.com/carlo/jquery-browser-fingerprint" rel="noreferrer">https://github.com/carlo/jquery-browser-fingerprint</a>
It looks pretty half baked right now but could be expanded upon.

Hope it helps!

entityMap|blocks|key|el1al|text|cookie和非cookie方法都存在缺陷。但是，如果您能够原谅cookie方法的缺点，这里有一个想法。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|ca3fc|如果你已经在你的网站上使用Google+Analytics，那么你不需要自己编写代码来跟踪不同的用户。Google+Analytics通过|2077e|cookie值，如中所述|2t5u3|Google文档|d8oel|..。通过重用这个值，您不会创建额外的cookie有效负载，这对页面请求具有效率优势。|b4vf8|您可以轻松地编写一些代码来访问该值，或者使用|18ncb|此脚本的|9a9eq|17ajo|函数。^0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|R|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|S|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|T|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|U|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|V|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|W|9|@]|A|@]|B|$]]|$2|M|4|N|6|7|8|X|9|@]|A|@]|B|$]]|$2|O|4|-4|6|7|8|Y|9|@]|A|@]|B|$]]|$2|P|4|Q|6|7|8|Z|9|@]|A|@]|B|$]]]]

There are flaws with both cookie and non-cookie approaches. But if you can forgive the shortcomings of the cookie approach, here's an idea.

If you're already using Google Analytics on your site, then you don't need to write code to track unique users yourself. Google Analytics does that for you via the <code>__utma</code> cookie value, as described in <a href="https://developers.google.com/analytics/resources/concepts/gaConceptsCookies">Google's documentation</a>. And by reusing this value you're not creating additional cookie payload, which has efficiency benefits with page requests.

And you could write some code easily enough to access that value, or use <a href="http://www.dannytalk.com/read-google-analytics-cookie-script/">this script's</a> <code>getUniqueId()</code> function.

entityMap|blocks|key|b1nat|text|我的帖子可能不是一个解决方案，但我可以提供一个例子，这个功能已经实现了。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4dfkn|如果您访问的注册页面|89p8b|第一次在你的电脑上，这是很好的。但是，如果您刷新该页面或再次打开该页面，它将标识您以前访问过该页面。真正的美妙之处在这里--即使你重新安装Windows或其他操作系统，它也能识别出来。|5gof7|我在某处读到他们存储CPU+ID，虽然我找不到他们是怎么做的，但我非常怀疑这一点，他们可能会使用MAC地址来做这件事。|7q75r|如果我找到了我一定会分享的|ak19o|方法|8o8n0|去做这件事。^0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|O|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|P|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|Q|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|R|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|S|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|T|9|@]|A|@]|B|$]]|$2|M|4|N|6|7|8|U|9|@]|A|@]|B|$]]]]

My post might not be a solution, but I can provide an example, where this feature has been implemented.

If you visit the signup page of <code>www.supertorrents.org</code> for the first time from you computer, it's fine. But if you refresh the page or open the page again, it identifies you've previously visited the page. The real beauty comes here - it identifies even if you re-install Windows or other OS.

I read somewhere that they store the CPU ID. Although I couldn't find how do they do it, I seriously doubt it, and they might use MAC Address to do it.

I'll definitely share if I find how to do it.

entityMap|blocks|key|8aa9v|text|有一种流行的方法叫做画布指纹，在这篇科学文章中描述了：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|8pf3b|网络永远不会忘记:荒野中的持久跟踪机制|9f3hd|..。一旦你开始寻找它，你会惊讶于它的使用频率。该方法创建唯一的指纹，该指纹对于每个浏览器/硬件组合是一致的。|3f2mk|本文还回顾了其他持久跟踪方法，如evercookie、重新生成http和Flash+cookie以及cookie同步。|c3kam|有关画布指纹的更多信息，请单击此处：|edgm1|3p326|Pixel+Perfect:+HTML5中的指纹画布|da6g7|https://en.wikipedia.org/wiki/Canvas|3ravh|_|dr958|指纹识别^0|0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|T|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|U|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|V|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|W|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|X|9|@]|A|@]|B|$]]|$2|K|4|-4|6|7|8|Y|9|@]|A|@]|B|$]]|$2|L|4|M|6|7|8|Z|9|@]|A|@]|B|$]]|$2|N|4|O|6|7|8|10|9|@]|A|@]|B|$]]|$2|P|4|Q|6|7|8|11|9|@]|A|@]|B|$]]|$2|R|4|S|6|7|8|12|9|@]|A|@]|B|$]]]]

There is a popular method called canvas fingerprinting, described in this scientific article: <a href="https://securehomes.esat.kuleuven.be/~gacar/persistent/the_web_never_forgets.pdf">The Web Never Forgets:
Persistent Tracking Mechanisms in the Wild</a>. Once you start looking for it, you'll be surprised how frequently it is used. The method creates a unique fingerprint, which is consistent for each browser/hardware combination.

The article also reviews other persistent tracking methods, like evercookies, respawning http and Flash cookies, and cookie syncing.

More info about canvas fingerprinting here: 

<ul>
<li><a href="https://cseweb.ucsd.edu/~hovav/dist/canvas.pdf">Pixel Perfect: Fingerprinting Canvas in HTML5</a></li>
<li><a href="https://en.wikipedia.org/wiki/Canvas_fingerprinting">https://en.wikipedia.org/wiki/Canvas_fingerprinting</a></li>
</ul>

entityMap|blocks|key|bkm0g|text|小窍门：|type|unstyled|depth|inlineStyleRanges|entityRanges|data|8pgn7|创建2个注册页面：|aa54h|4d8ss|第一个注册页面：|4h4h7|不需要任何电子邮件或安全检查(只需用户名和密码)|dr9g|14hmb|第二个注册页面：|aqnu0|安全级别高(邮件验证请求、安全镜像等)|dd36u|为了让客户满意并便于注册，默认注册页面应为|d2qi5|(第一个注册页面)|6mdoe|但是在|2dohi|2d1ir|有一个隐藏的限制。这是IP限制。如果IP尝试第二次注册(例如小于1小时)，而不是显示区块页面。您可以显示|eruvg|(第二个注册页)|bsuko|自动。|6hr1s|在|936h6|85h7b|您可以设置(例如:阻止来自一个ip的2次尝试，持续1小时或24小时)，并且在(例如)1小时后，您可以自动从该ip开放访问|s17t|请注意：|44k6m|5i7qc|和|9vkve|bvegp|不应该在单独的页面中。你只做了一个页面。(例如:+register.php)，并智能地在第一个样式和第二个样式之间切换^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|1E|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|1F|9|@]|A|@]|B|$]]|$2|E|4|-4|6|7|8|1G|9|@]|A|@]|B|$]]|$2|F|4|G|6|7|8|1H|9|@]|A|@]|B|$]]|$2|H|4|I|6|7|8|1I|9|@]|A|@]|B|$]]|$2|J|4|-4|6|7|8|1J|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|1K|9|@]|A|@]|B|$]]|$2|M|4|N|6|7|8|1L|9|@]|A|@]|B|$]]|$2|O|4|P|6|7|8|1M|9|@]|A|@]|B|$]]|$2|Q|4|R|6|7|8|1N|9|@]|A|@]|B|$]]|$2|S|4|T|6|7|8|1O|9|@]|A|@]|B|$]]|$2|U|4|R|6|7|8|1P|9|@]|A|@]|B|$]]|$2|V|4|W|6|7|8|1Q|9|@]|A|@]|B|$]]|$2|X|4|Y|6|7|8|1R|9|@]|A|@]|B|$]]|$2|Z|4|10|6|7|8|1S|9|@]|A|@]|B|$]]|$2|11|4|12|6|7|8|1T|9|@]|A|@]|B|$]]|$2|13|4|R|6|7|8|1U|9|@]|A|@]|B|$]]|$2|14|4|15|6|7|8|1V|9|@]|A|@]|B|$]]|$2|16|4|17|6|7|8|1W|9|@]|A|@]|B|$]]|$2|18|4|R|6|7|8|1X|9|@]|A|@]|B|$]]|$2|19|4|1A|6|7|8|1Y|9|@]|A|@]|B|$]]|$2|1B|4|Y|6|7|8|1Z|9|@]|A|@]|B|$]]|$2|1C|4|1D|6|7|8|20|9|@]|A|@]|B|$]]]]

A Trick:

<ol>
<li>Create 2 Registration Pages:

First Registration Page: without any email or security check (just with username and password)

Second Registration Page: with high security level (email verification request and security image and etc.)</li>
<li>For customer satisfaction, and easy registration, default
registration page should be the (First Registration Page) but in the
(First Registration Page) there is a hidden restriction. It's IP
Restriction. If an IP tried to register for second time, (for example less than 1 hour) instead of
showing the block page. you can show the (Second Registration Page)
automatically.</li>
<li>in the (First Registration Page) you can set (for example: block 2
attempts from 1 ip for just 1 hour or 24 hours) and after (for example) 1 hour, you can open access from that ip automatically</li>
</ol>

Please note: (First Registration Page) and (Second Registration Page) should not be in separated pages. you make just 1 page. (for example: register.php) and make it smart to switch between First PHP Style and Second PHP Style

entityMap|blocks|key|e5n89|text|引言|type|unstyled|depth|inlineStyleRanges|entityRanges|data|1osf4|我不知道是否有或者永远不会有一种方法来单独使用浏览器来唯一地识别机器。主要原因是：|fg1ma|您需要将数据保存在用户的计算机上。用户可以随时删除此数据。除非你有办法重新创建这些数据，这对每一台机器都是唯一的，否则你就卡住了。|8vsgn|验证。您需要防范欺骗、会话劫持等。|6l8r0|即使有方法可以不使用cookies来跟踪计算机，也总会有一种方法绕过它，并且软件将自动执行此操作。如果你真的需要跟踪基于计算机的东西，你将不得不编写一个本机应用程序(Apple+Store+/+Android+Store+/+Windows+Program+/等)。|kfoi|我可能无法回答您提出的问题，但我可以向您展示如何实现会话跟踪。使用会话跟踪，您可以尝试跟踪浏览会话，而不是访问站点的计算机。通过跟踪会话，您的数据库模式将如下所示：|ft7fr|sesssion:
++sessionID:+string
++//+Global+session+data+goes+here

++computers:+[{
+++++BrowserID:+string
+++++ComputerID:+string
+++++FingerprintID:+string
+++++userID:+string
+++++authToken:+string
+++++ipAddresses:+["203.525....",+"203.525...",+...]
+++++//+Computer+session+data+goes+here
++},+...]|code-block|syntax|javascript|3crj8|基于会话的跟踪的优势：|6tsr7|对于已登录的用户，您始终可以从这些用户生成相同的会话id|52des|/|bsr00|2md4v|..。|18lae|您仍然可以使用以下命令跟踪访客用户|948tg|5ck2i|即使几个人使用同一台电脑(即网吧)，如果他们登录了，你也可以单独跟踪他们。|86lcp|基于会话的跟踪的缺点：|8vg99|会话是基于浏览器的，而不是基于计算机的。如果用户使用两个不同的浏览器，则会导致两个不同的会话。如果这是一个问题，你可以在这里停止阅读。|b7k27|如果用户未登录，会话将过期。如果用户未登录，则他们将使用访客会话，如果用户删除cookie和浏览器缓存，该会话将无效。|bi1hb|实现|e9grq|有许多方法可以实现这一点。我不认为我可以涵盖所有这些，我只列出我最喜欢的，这将使这篇文章成为一个|7oq0t|固执己见的回答|evd41|..。请记住这一点。|cjva5|基础知识|3flhq|我将使用所谓的永久cookie来跟踪会话。即使用户删除了他的cookie或更新了他的浏览器，这些数据也会自动重新创建。然而，如果用户同时删除cookie和浏览缓存，它将无法存活。|81hdb|为了实现这一点，我将使用浏览器缓存机制(|c89i5|RFC|9jks0|)、WebStorage接口(|1h41d|MDN|ahdl7|)和浏览器cookies+(|ajq6t|18c15|avc1v|谷歌分析|ckbbe|)。|4mshe|法律|3u7kf|为了使用跟踪ids，您需要将它们添加到您的隐私政策和使用条款中，最好是在副标题下|3obu0|跟踪|785db|..。我们将在这两个应用程序上使用以下密钥|egmm|和|63q9u|_|2ef65|气体|96lbq|：谷歌分析数据|44suu|3nk8|a1r8a|utma|455v0|：Google+Analytics+tracking+cookie|99ao8|侧边|3700b|：SessionID|9nmb|确保在使用跟踪的所有页面上包含隐私政策和使用条款的链接。|20nvh|我在哪里存储我的会话数据？|ef96i|您可以将会话数据存储在网站数据库中，也可以存储在用户的计算机上。由于我通常工作在较小的网站(让10000个连续连接)，使用第三方应用程序(Google+Analytics+/+Clicky+/等)，所以对我来说最好将数据存储在客户端计算机上。这有以下优点：|32a4l|没有数据库查找/开销/负载/延迟/空间等。|7kn7l|用户可以随时删除他们的数据，而不需要给我写烦人的电子邮件。|9fmkl|缺点：|9adh6|数据必须经过加密/解密和签名/验证，这会在客户端(没那么糟糕)和服务器(bah!)上产生cpu开销。|5jaid|当用户删除其cookies和缓存时，数据将被删除。(这才是我真正想要的)|fsl00|当用户离线时，数据不可用于分析。(仅适用于当前浏览用户的分析)|ag2ea|UUIDS|7gc67|BrowserID|2mkdt|：从浏览器用户代理字符串生成的唯一id。|46v9s|ComputerID|dakb|：由用户IP地址和HTTPS会话密钥生成。|brpca|FingerPrintID|2r1fr|：基于改进的基于JavaScript的指纹识别|bqp7k|fingerprint.js|53nqj|evsfu|SessionID|60aav|：用户第一次访问站点时生成的随机密钥。|1qeqn|GoogleID|s48r|：生成自|6faag|曲奇。|cdaeb|机制|s68v|前几天我在看|casei|温迪·威廉姆斯秀|42ek1|当主持人建议她的观众每月至少删除一次浏览器历史记录时，她完全被吓坏了。删除浏览器历史记录通常有以下影响：|8ii15|删除访问过的网站的历史记录。|1bde6|删除cookies和|8mfpi|(哇，天哪)。|mlpv|大多数现代浏览器都提供了这个选项，但不害怕成为朋友。因为有一个解决方案。浏览器有一个缓存机制来存储脚本/图像和其他东西。通常，即使我们删除了我们的历史记录，这个浏览器缓存仍然保留着。我们所需要的只是一种在这里存储数据的方法。有两种方法可以做到这一点。更好的方法是使用SVG图像，并将数据存储在其标记中。这样，即使使用闪存禁用JavaScript，仍然可以提取数据。但是，由于这有点复杂，我将演示另一种方法，它使用JSONP+(|6ehc2|维基百科|182g4|)|1vig4|example.com/assets/js/tracking.js|977uo|(实际上是tracking.php)|8nb2q|var+now+=+new+Date();
var+window.__sid+=+"SessionID";+//+Server+generated

setCookie("sid",+window.__sid,+now.setFullYear(now.getFullYear()+%2B+1,+now.getMonth(),+now.getDate()+-+1));

if(+"localStorage"+in+window+)+{
++window.localStorage.setItem("sid",+window.__sid);
}|e03ka|现在我们可以随时获取会话密钥：|et5bt|如何让tracking.js在浏览器中卡住？|ek8cc|我们可以使用以下命令来实现这一点|16jbs|缓存控制|2r6et|3cjk9|上次修改时间|evf8t|3bghr|ETag|f04eb|HTTP标头。我们可以使用|23vpb|作为etag标头的值：|eugis|setHeaders({
++"ETag":+SessionID,
++"Last-Modified":+new+Date(0).toUTCString(),
++"Cache-Control":+"private,+max-age=31536000,+s-max-age=31536000,+must-revalidate"
})|b8opj|header告诉浏览器这个文件基本上永远不会被修改。|548br|通知代理和网关不要缓存文档，但通知浏览器将其缓存1年。|430j6|当浏览器下一次请求文档时，它将发送|4p5qu|aqkkh|标题。我们可以使用它们返回一个|91gjk|回应。|41d64|example.com/assets/js/tracking.php|9tpbs|$sid+=+getHeader("If-None-Match")+?:+getHeader("if-none-match")+?:+getHeader("IF-NONE-MATCH")+?:+"";+
$ifModifiedSince+=+hasHeader("If-Modified-Since")+?:+hasHeader("if-modified-since")+?:+hasHeader("IF-MODIFIED-SINCE");

if(+validateSession($sid)+)+{
++if(+sessionExists($sid)+)+{
++++continueSession($sid);
++++send304();
++}+else+{
++++startSession($sid);
++++send304();
++}
}+else+if(+$ifModifiedSince+)+{
++send304();
}+else+{
++startSession();
++send200();
}|1gj4s|现在，每次浏览器请求|eak4r|我们的服务器将响应一个|847c3|结果，并强制执行|b24ef|en4l|我还是不明白。给我解释一下|7kf9t|假设用户清除了他们的浏览历史记录并刷新了页面。用户计算机上只剩下一份|5laho|在浏览器缓存中。当浏览器请求|528e|它会收到一个|fbjj1|响应，该响应使它执行|8i1tl|它收到了。|6vg58|执行并还原|d796g|被删除了。|7sd0s|验证|ba8i3|假设Haxor+X在我们的客户还在登录时窃取了他们的cookie。我们如何保护他们？密码学和浏览器指纹识别来拯救。请记住我们对以下内容的原始定义|6m6j0|是：|9itqa|BrowserID%7CComputerID%7CrandomBytes(256)|7ps67|我们可以将其更改为：|emj72|Timestamp%7CBrowserID%7CComputerID%7Cencrypt(randomBytes(256),+hk)%7Csign(Timestamp%7CBrowserID%7CComputerID%7CrandomBytes(256),+hk)|d480k|在哪里|8004p|1l2vn|现在我们可以验证我们的|f6qad|使用以下算法：|7249v|if(+getTimestamp($sid)+is+older+than+1+year+)+return+false;
if(+getBrowserID($sid)+!==+createBrowserID($_Request,+$_Server)+)+return+false;
if(+getComputerID($sid)+!==+createComputerID($_Request,+$_Server)+return+false;

$hk+=+sign(getTimestamp($sid)+%2B+getBrowserID($sid)+%2B+getComputerID($sid),+$SERVER["key"]);

if(+!verify(getTimestamp($sid)+%2B+getBrowserID($sid)+%2B+getComputerID($sid)+%2B+decrypt(getRandomBytes($sid),+hk),+getSignature($sid),+$hk)+)+return+false;

return+true;|5m095|现在为了让Haxor的攻击起作用，他们必须：|fse2k|有相同的|5rn1l|..。这意味着他们必须有相同的ISP提供商作为受害者(棘手)。这将使我们的受害者有机会在他们自己的国家采取法律行动。Haxor还必须从受害者(硬)获取HTTPS会话密钥。|217a3|fqaed|..。任何人都可以伪造User-Agent字符串(令人讨厌)。|eorjr|能够创造自己的假货|9rieq|(非常难)。因为我们使用时间戳来生成加密/签名密钥，所以基本上就像为每个会话生成一个新的密钥，所以卷标签不起作用。最重要的是，我们加密随机字节，所以简单的字典攻击也是不可能的。|38t5l|我们可以通过转发来改进验证|4ln37|7mdk2|(通过ajax或隐藏字段)和匹配。|4bt3t|if(+GoogleID+!=+getStoredGoodleID($sid)+)+return+false;
if(+byte_difference(FingerPrintID,+getStoredFingerprint($sid)+>+10%25)+return+false;^0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|7J|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|7K|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|7L|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|7M|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|7N|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|7O|9|@]|A|@]|B|$]]|$2|M|4|N|6|O|8|7P|9|@]|A|@]|B|$P|Q]]|$2|R|4|S|6|7|8|7Q|9|@]|A|@]|B|$]]|$2|T|4|U|6|7|8|7R|9|@]|A|@]|B|$]]|$2|V|4|W|6|7|8|7S|9|@]|A|@]|B|$]]|$2|X|4|W|6|7|8|7T|9|@]|A|@]|B|$]]|$2|Y|4|Z|6|7|8|7U|9|@]|A|@]|B|$]]|$2|10|4|11|6|7|8|7V|9|@]|A|@]|B|$]]|$2|12|4|Z|6|7|8|7W|9|@]|A|@]|B|$]]|$2|13|4|14|6|7|8|7X|9|@]|A|@]|B|$]]|$2|15|4|16|6|7|8|7Y|9|@]|A|@]|B|$]]|$2|17|4|18|6|7|8|7Z|9|@]|A|@]|B|$]]|$2|19|4|1A|6|7|8|80|9|@]|A|@]|B|$]]|$2|1B|4|1C|6|7|8|81|9|@]|A|@]|B|$]]|$2|1D|4|1E|6|7|8|82|9|@]|A|@]|B|$]]|$2|1F|4|1G|6|7|8|83|9|@]|A|@]|B|$]]|$2|1H|4|1I|6|7|8|84|9|@]|A|@]|B|$]]|$2|1J|4|1K|6|7|8|85|9|@]|A|@]|B|$]]|$2|1L|4|1M|6|7|8|86|9|@]|A|@]|B|$]]|$2|1N|4|1O|6|7|8|87|9|@]|A|@]|B|$]]|$2|1P|4|1Q|6|7|8|88|9|@]|A|@]|B|$]]|$2|1R|4|1S|6|7|8|89|9|@]|A|@]|B|$]]|$2|1T|4|1U|6|7|8|8A|9|@]|A|@]|B|$]]|$2|1V|4|1W|6|7|8|8B|9|@]|A|@]|B|$]]|$2|1X|4|1Q|6|7|8|8C|9|@]|A|@]|B|$]]|$2|1Y|4|-4|6|7|8|8D|9|@]|A|@]|B|$]]|$2|1Z|4|20|6|7|8|8E|9|@]|A|@]|B|$]]|$2|21|4|22|6|7|8|8F|9|@]|A|@]|B|$]]|$2|23|4|24|6|7|8|8G|9|@]|A|@]|B|$]]|$2|25|4|26|6|7|8|8H|9|@]|A|@]|B|$]]|$2|27|4|28|6|7|8|8I|9|@]|A|@]|B|$]]|$2|29|4|2A|6|7|8|8J|9|@]|A|@]|B|$]]|$2|2B|4|2C|6|7|8|8K|9|@]|A|@]|B|$]]|$2|2D|4|2E|6|7|8|8L|9|@]|A|@]|B|$]]|$2|2F|4|2G|6|7|8|8M|9|@]|A|@]|B|$]]|$2|2H|4|2I|6|7|8|8N|9|@]|A|@]|B|$]]|$2|2J|4|2E|6|7|8|8O|9|@]|A|@]|B|$]]|$2|2K|4|2E|6|7|8|8P|9|@]|A|@]|B|$]]|$2|2L|4|2M|6|7|8|8Q|9|@]|A|@]|B|$]]|$2|2N|4|2O|6|7|8|8R|9|@]|A|@]|B|$]]|$2|2P|4|2Q|6|7|8|8S|9|@]|A|@]|B|$]]|$2|2R|4|2S|6|7|8|8T|9|@]|A|@]|B|$]]|$2|2T|4|2U|6|7|8|8U|9|@]|A|@]|B|$]]|$2|2V|4|2W|6|7|8|8V|9|@]|A|@]|B|$]]|$2|2X|4|2Y|6|7|8|8W|9|@]|A|@]|B|$]]|$2|2Z|4|30|6|7|8|8X|9|@]|A|@]|B|$]]|$2|31|4|32|6|7|8|8Y|9|@]|A|@]|B|$]]|$2|33|4|34|6|7|8|8Z|9|@]|A|@]|B|$]]|$2|35|4|36|6|7|8|90|9|@]|A|@]|B|$]]|$2|37|4|38|6|7|8|91|9|@]|A|@]|B|$]]|$2|39|4|3A|6|7|8|92|9|@]|A|@]|B|$]]|$2|3B|4|3C|6|7|8|93|9|@]|A|@]|B|$]]|$2|3D|4|3E|6|7|8|94|9|@]|A|@]|B|$]]|$2|3F|4|3G|6|7|8|95|9|@]|A|@]|B|$]]|$2|3H|4|3I|6|7|8|96|9|@]|A|@]|B|$]]|$2|3J|4|3K|6|7|8|97|9|@]|A|@]|B|$]]|$2|3L|4|3M|6|7|8|98|9|@]|A|@]|B|$]]|$2|3N|4|3O|6|7|8|99|9|@]|A|@]|B|$]]|$2|3P|4|3Q|6|7|8|9A|9|@]|A|@]|B|$]]|$2|3R|4|Z|6|7|8|9B|9|@]|A|@]|B|$]]|$2|3S|4|3T|6|7|8|9C|9|@]|A|@]|B|$]]|$2|3U|4|3V|6|7|8|9D|9|@]|A|@]|B|$]]|$2|3W|4|3X|6|7|8|9E|9|@]|A|@]|B|$]]|$2|3Y|4|3Z|6|7|8|9F|9|@]|A|@]|B|$]]|$2|40|4|41|6|7|8|9G|9|@]|A|@]|B|$]]|$2|42|4|43|6|7|8|9H|9|@]|A|@]|B|$]]|$2|44|4|45|6|7|8|9I|9|@]|A|@]|B|$]]|$2|46|4|47|6|7|8|9J|9|@]|A|@]|B|$]]|$2|48|4|49|6|7|8|9K|9|@]|A|@]|B|$]]|$2|4A|4|4B|6|7|8|9L|9|@]|A|@]|B|$]]|$2|4C|4|4D|6|7|8|9M|9|@]|A|@]|B|$]]|$2|4E|4|4F|6|7|8|9N|9|@]|A|@]|B|$]]|$2|4G|4|4H|6|7|8|9O|9|@]|A|@]|B|$]]|$2|4I|4|4J|6|7|8|9P|9|@]|A|@]|B|$]]|$2|4K|4|4L|6|7|8|9Q|9|@]|A|@]|B|$]]|$2|4M|4|4N|6|7|8|9R|9|@]|A|@]|B|$]]|$2|4O|4|4P|6|7|8|9S|9|@]|A|@]|B|$]]|$2|4Q|4|4R|6|O|8|9T|9|@]|A|@]|B|$P|Q]]|$2|4S|4|4T|6|7|8|9U|9|@]|A|@]|B|$]]|$2|4U|4|4V|6|7|8|9V|9|@]|A|@]|B|$]]|$2|4W|4|4X|6|7|8|9W|9|@]|A|@]|B|$]]|$2|4Y|4|4Z|6|7|8|9X|9|@]|A|@]|B|$]]|$2|50|4|-4|6|7|8|9Y|9|@]|A|@]|B|$]]|$2|51|4|52|6|7|8|9Z|9|@]|A|@]|B|$]]|$2|53|4|2C|6|7|8|A0|9|@]|A|@]|B|$]]|$2|54|4|55|6|7|8|A1|9|@]|A|@]|B|$]]|$2|56|4|57|6|7|8|A2|9|@]|A|@]|B|$]]|$2|58|4|59|6|7|8|A3|9|@]|A|@]|B|$]]|$2|5A|4|5B|6|O|8|A4|9|@]|A|@]|B|$P|Q]]|$2|5C|4|5D|6|7|8|A5|9|@]|A|@]|B|$]]|$2|5E|4|5F|6|7|8|A6|9|@]|A|@]|B|$]]|$2|5G|4|5H|6|7|8|A7|9|@]|A|@]|B|$]]|$2|5I|4|2C|6|7|8|A8|9|@]|A|@]|B|$]]|$2|5J|4|5K|6|7|8|A9|9|@]|A|@]|B|$]]|$2|5L|4|5M|6|7|8|AA|9|@]|A|@]|B|$]]|$2|5N|4|5O|6|7|8|AB|9|@]|A|@]|B|$]]|$2|5P|4|5Q|6|O|8|AC|9|@]|A|@]|B|$P|Q]]|$2|5R|4|5S|6|7|8|AD|9|@]|A|@]|B|$]]|$2|5T|4|5U|6|7|8|AE|9|@]|A|@]|B|$]]|$2|5V|4|5W|6|7|8|AF|9|@]|A|@]|B|$]]|$2|5X|4|Z|6|7|8|AG|9|@]|A|@]|B|$]]|$2|5Y|4|5Z|6|7|8|AH|9|@]|A|@]|B|$]]|$2|60|4|61|6|7|8|AI|9|@]|A|@]|B|$]]|$2|62|4|63|6|7|8|AJ|9|@]|A|@]|B|$]]|$2|64|4|65|6|7|8|AK|9|@]|A|@]|B|$]]|$2|66|4|67|6|7|8|AL|9|@]|A|@]|B|$]]|$2|68|4|69|6|7|8|AM|9|@]|A|@]|B|$]]|$2|6A|4|6B|6|7|8|AN|9|@]|A|@]|B|$]]|$2|6C|4|6D|6|7|8|AO|9|@]|A|@]|B|$]]|$2|6E|4|6F|6|7|8|AP|9|@]|A|@]|B|$]]|$2|6G|4|6H|6|7|8|AQ|9|@]|A|@]|B|$]]|$2|6I|4|6J|6|7|8|AR|9|@]|A|@]|B|$]]|$2|6K|4|6L|6|O|8|AS|9|@]|A|@]|B|$P|Q]]|$2|6M|4|6N|6|7|8|AT|9|@]|A|@]|B|$]]|$2|6O|4|6P|6|O|8|AU|9|@]|A|@]|B|$P|Q]]|$2|6Q|4|6R|6|7|8|AV|9|@]|A|@]|B|$]]|$2|6S|4|Z|6|7|8|AW|9|@]|A|@]|B|$]]|$2|6T|4|6U|6|7|8|AX|9|@]|A|@]|B|$]]|$2|6V|4|6W|6|7|8|AY|9|@]|A|@]|B|$]]|$2|6X|4|6Y|6|O|8|AZ|9|@]|A|@]|B|$P|Q]]|$2|6Z|4|70|6|7|8|B0|9|@]|A|@]|B|$]]|$2|71|4|72|6|7|8|B1|9|@]|A|@]|B|$]]|$2|73|4|74|6|7|8|B2|9|@]|A|@]|B|$]]|$2|75|4|72|6|7|8|B3|9|@]|A|@]|B|$]]|$2|76|4|77|6|7|8|B4|9|@]|A|@]|B|$]]|$2|78|4|79|6|7|8|B5|9|@]|A|@]|B|$]]|$2|7A|4|7B|6|7|8|B6|9|@]|A|@]|B|$]]|$2|7C|4|7D|6|7|8|B7|9|@]|A|@]|B|$]]|$2|7E|4|2C|6|7|8|B8|9|@]|A|@]|B|$]]|$2|7F|4|7G|6|7|8|B9|9|@]|A|@]|B|$]]|$2|7H|4|7I|6|O|8|BA|9|@]|A|@]|B|$P|Q]]]]

<h1>Introduction</h1>
I don't know if there is or ever will be a way to uniquely identify machines using a browser alone. The main reasons are:
<ul>
<li>You will need to save data on the users computer. This data can be
deleted by the user any time. Unless you have a way to recreate this
data which is unique for each and every machine then your stuck.</li>
<li>Validation. You need to guard against spoofing, session hijacking, etc.</li>
</ul>
Even if there are ways to track a computer without using cookies there will always be a way to bypass it and software that will do this automatically. If you really need to track something based on a computer you will have to write a native application (Apple Store / Android Store / Windows Program / etc).
I might not be able to give you an answer to the question you asked but I can show you how to implement session tracking. With session tracking you try to track the browsing session instead of the computer visiting your site. By tracking the session, your database schema will look like this:
<pre><code>sesssion:
 sessionID: string
 // Global session data goes here
 
 computers: [{
 BrowserID: string
 ComputerID: string
 FingerprintID: string
 userID: string
 authToken: string
 ipAddresses: [&quot;203.525....&quot;, &quot;203.525...&quot;, ...]
 // Computer session data goes here
 }, ...]
</code></pre>
Advantages of session based tracking:
<ol>
<li>For logged in users, you can always generate the same session id from the users <code>username</code> / <code>password</code> / <code>email</code>.</li>
<li>You can still track guest users using <code>sessionID</code>.</li>
<li>Even if several people use the same computer (ie cybercafe) you can track them separately if they log in.</li>
</ol>
Disadvantages of session based tracking:
<ol>
<li>Sessions are browser based and not computer based. If a user uses 2 different browsers it will result in 2 different sessions. If this is a problem you can stop reading here.</li>
<li>Sessions expire if user is not logged in. If a user is not logged in, then they will use a guest session which will be invalidated if user deletes cookies and browser cache.</li>
</ol>
<h1>Implementation</h1>
There are many ways of implementing this. I don't think I can cover them all I'll just list my favorite which would make this an opinionated answer. Bear that in mind.
<h2>Basics</h2>
I will track the session by using what is known as a forever cookie. This is data which will automagically recreate itself even if the user deletes his cookies or updates his browser. It will not however survive the user deleting both their cookies and their browsing cache.
To implement this I will use the browsers caching mechanism (<a href="https://www.rfc-editor.org/rfc/rfc2616#section-13.3" rel="nofollow noreferrer">RFC</a>), WebStorage API (<a href="https://developer.mozilla.org/en-US/docs/Web/API/Web_Storage_API" rel="nofollow noreferrer">MDN</a>) and browser cookies (<a href="https://www.rfc-editor.org/rfc/rfc6265" rel="nofollow noreferrer">RFC</a>, <a href="https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage" rel="nofollow noreferrer">Google Analytics</a>).
<h2>Legal</h2>
In order to utilize tracking ids you need to add them to both your privacy policy and your terms of use preferably under the sub-heading Tracking. We will use the following keys on both <code>document.cookie</code> and <code>window.localStorage</code>:
<ul>
<li>_ga: Google Analytics data</li>
<li>__utma: Google Analytics tracking cookie</li>
<li>sid: SessionID</li>
</ul>
Make sure you include links to your Privacy policy and terms of use on all pages that use tracking.
<h2>Where do I store my session data?</h2>
You can either store your session data in your website database or on the users computer. Since I normally work on smaller sites (let than 10 thousand continuous connections) that use 3rd party applications (Google Analytics / Clicky / etc) it's best for me to store data on clients computer. This has the following advantages:
<ol>
<li>No database lookup / overhead / load / latency / space / etc.</li>
<li>User can delete their data whenever they want without the need to write me annoying emails.</li>
</ol>
and disadvantages:
<ol>
<li>Data has to be encrypted / decrypted and signed / verified which creates cpu overhead on client (not so bad) and server (bah!).</li>
<li>Data is deleted when user deletes their cookies and cache. (this is what I want really)</li>
<li>Data is unavailable for analytics when users go off-line. (analytics for currently browsing users only)</li>
</ol>
<h2>UUIDS</h2>
<ul>
<li>BrowserID: Unique id generated from the browsers user agent string. <code>Browser|BrowserVersion|OS|OSVersion|Processor|MozzilaMajorVersion|GeckoMajorVersion</code></li>
<li>ComputerID: Generated from users IP Address and HTTPS session key.
<code>getISP(requestIP)|getHTTPSClientKey()</code></li>
<li>FingerPrintID: JavaScript based fingerprinting based on a modified <a href="https://github.com/Valve/fingerprintjs2/" rel="nofollow noreferrer">fingerprint.js</a>. <code>FingerPrint.get()</code></li>
<li>SessionID: Random key generated when user 1st visits site. <code>BrowserID|ComputerID|randombytes(256)</code></li>
<li>GoogleID: Generated from <code>__utma</code> cookie. <code>getCookie(__utma).uniqueid</code></li>
</ul>
<h2>Mechanism</h2>
The other day I was watching the <a href="http://www.wendyshow.com" rel="nofollow noreferrer">wendy williams show</a> with my girlfriend and was completely horrified when the host advised her viewers to delete their browser history at least once a month. Deleting browser history normally has the following effects:
<ol>
<li>Deletes history of visited websites.</li>
<li>Deletes cookies and <code>window.localStorage</code> (aww man).</li>
</ol>
Most modern browsers make this option readily available but fear not friends. For there is a solution. The browser has a caching mechanism to store scripts / images and other things. Usually even if we delete our history, this browser cache still remains. All we need is a way to store our data here. There are 2 methods of doing this. The better one is to use a SVG image and store our data inside its tags. This way data can still be extracted even if JavaScript is disabled using flash. However since that is a bit complicated I will demonstrate the other approach which uses JSONP (<a href="https://en.wikipedia.org/wiki/JSONP" rel="nofollow noreferrer">Wikipedia</a>)
example.com/assets/js/tracking.js (actually tracking.php)
<pre><code>var now = new Date();
var window.__sid = &quot;SessionID&quot;; // Server generated

setCookie(&quot;sid&quot;, window.__sid, now.setFullYear(now.getFullYear() + 1, now.getMonth(), now.getDate() - 1));

if( &quot;localStorage&quot; in window ) {
 window.localStorage.setItem(&quot;sid&quot;, window.__sid);
}
</code></pre>
Now we can get our session key any time:
<code>window.__sid || window.localStorage.getItem(&quot;sid&quot;) || getCookie(&quot;sid&quot;) || &quot;&quot;</code>
How do I make tracking.js stick in browser?
We can achieve this using <a href="https://www.rfc-editor.org/rfc/rfc2616#section-14.9" rel="nofollow noreferrer">Cache-Control</a>, <a href="https://www.rfc-editor.org/rfc/rfc2616#section-14.29" rel="nofollow noreferrer">Last-Modified</a> and <a href="https://www.rfc-editor.org/rfc/rfc2616#section-14.19" rel="nofollow noreferrer">ETag</a> HTTP headers. We can use the <code>SessionID</code> as value for etag header:
<pre><code>setHeaders({
 &quot;ETag&quot;: SessionID,
 &quot;Last-Modified&quot;: new Date(0).toUTCString(),
 &quot;Cache-Control&quot;: &quot;private, max-age=31536000, s-max-age=31536000, must-revalidate&quot;
})
</code></pre>
<code>Last-Modified</code> header tells the browser that this file is basically never modified. <code>Cache-Control</code> tells proxies and gateways not to cache the document but tells the browser to cache it for 1 year.
The next time the browser requests the document, it will send <code>If-Modified-Since</code> and <code>If-None-Match</code> headers. We can use these to return a <code>304 Not Modified</code> response.
example.com/assets/js/tracking.php
<pre><code>$sid = getHeader(&quot;If-None-Match&quot;) ?: getHeader(&quot;if-none-match&quot;) ?: getHeader(&quot;IF-NONE-MATCH&quot;) ?: &quot;&quot;; 
$ifModifiedSince = hasHeader(&quot;If-Modified-Since&quot;) ?: hasHeader(&quot;if-modified-since&quot;) ?: hasHeader(&quot;IF-MODIFIED-SINCE&quot;);

if( validateSession($sid) ) {
 if( sessionExists($sid) ) {
 continueSession($sid);
 send304();
 } else {
 startSession($sid);
 send304();
 }
} else if( $ifModifiedSince ) {
 send304();
} else {
 startSession();
 send200();
}
</code></pre>
Now every time the browser requests <code>tracking.js</code> our server will respond with a <code>304 Not Modified</code> result and force an execute of the local copy of <code>tracking.js</code>.
I still don't understand. Explain it to me
Lets suppose the user clears their browsing history and refreshes the page. The only thing left on the users computer is a copy of <code>tracking.js</code> in browser cache. When the browser requests <code>tracking.js</code> it recieves a <code>304 Not Modified</code> response which causes it to execute the 1st version of <code>tracking.js</code> it recieved. <code>tracking.js</code> executes and restores the <code>SessionID</code> that was deleted.
<h2>Validation</h2>
Suppose Haxor X steals our customers cookies while they are still logged in. How do we protect them? Cryptography and Browser fingerprinting to the rescue. Remember our original definition for <code>SessionID</code> was:
<pre><code>BrowserID|ComputerID|randomBytes(256)
</code></pre>
We can change this to:
<pre><code>Timestamp|BrowserID|ComputerID|encrypt(randomBytes(256), hk)|sign(Timestamp|BrowserID|ComputerID|randomBytes(256), hk)
</code></pre>
Where <code>hk = sign(Timestamp|BrowserID|ComputerID, serverKey)</code>.
Now we can validate our <code>SessionID</code> using the following algorithm:
<pre><code>if( getTimestamp($sid) is older than 1 year ) return false;
if( getBrowserID($sid) !== createBrowserID($_Request, $_Server) ) return false;
if( getComputerID($sid) !== createComputerID($_Request, $_Server) return false;

$hk = sign(getTimestamp($sid) + getBrowserID($sid) + getComputerID($sid), $SERVER[&quot;key&quot;]);

if( !verify(getTimestamp($sid) + getBrowserID($sid) + getComputerID($sid) + decrypt(getRandomBytes($sid), hk), getSignature($sid), $hk) ) return false;

return true; 
</code></pre>
Now in order for Haxor's attack to work they must:
<ol>
<li>Have same <code>ComputerID</code>. That means they have to have the same ISP provider as victim (Tricky). This will give our victim the opportunity to take legal action in their own country. Haxor must also obtain HTTPS session key from victim (Hard).</li>
<li>Have same <code>BrowserID</code>. Anyone can spoof User-Agent string (Annoying).</li>
<li>Be able to create their own fake <code>SessionID</code> (Very Hard). Volume atacks won't work because we use a time-stamp to generate encryption / signing key so basically its like generating a new key for each session. On top of that we encrypt random bytes so a simple dictionary attack is also out of the question.</li>
</ol>
We can improve validation by forwarding <code>GoogleID</code> and <code>FingerprintID</code> (via ajax or hidden fields) and matching against those.
<pre><code>if( GoogleID != getStoredGoodleID($sid) ) return false;
if( byte_difference(FingerPrintID, getStoredFingerprint($sid) &gt; 10%) return false;
</code></pre>

entityMap|blocks|key|868ar|text|您可以使用|type|unstyled|depth|inlineStyleRanges|entityRanges|data|4m0ia|fingerprintjs2|aqk6b|new+Fingerprint2().get(function(result,+components)+{
++console.log(result)+//+a+hash,+representing+your+device+fingerprint
++console.log(components)+//+an+array+of+FP+components
++//submit+hash+and+JSON+object+to+the+server+
})|code-block|syntax|javascript|4j615|在此之后，您可以根据现有用户检查所有用户，并检查JSON相似性，因此即使他们的指纹发生变化，您仍然可以跟踪他们^0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|L|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|M|9|@]|A|@]|B|$]]|$2|E|4|F|6|G|8|N|9|@]|A|@]|B|$H|I]]|$2|J|4|K|6|7|8|O|9|@]|A|@]|B|$]]]]

You can use <a href="https://github.com/Valve/fingerprintjs2" rel="nofollow noreferrer">fingerprintjs2</a>

<pre><code>new Fingerprint2().get(function(result, components) {
 console.log(result) // a hash, representing your device fingerprint
 console.log(components) // an array of FP components
 //submit hash and JSON object to the server 
})
</code></pre>

After that you can check all your users against existing and check JSON similarity, so even if their fingerprint mutates, you still can track them

entityMap|blocks|key|bmorm|text|我将从简单到复杂给出我的想法。在上面的所有步骤中，你可以创建会话，问题本质上转化为匹配会话和请求。|type|unstyled|depth|inlineStyleRanges|entityRanges|data|d7re3|a)+(困难:容易)使用客户端硬件明确地存储某种类型的会话id/散列(存在相当多的隐私/安全问题，因此确保您对存储的任何内容进行散列)，解决方案包括：|dgrev|cookies存储|4eaga|浏览器存储/webDB/(更奇特的浏览器解决方案)|f1fka|具有在文件中存储内容的权限的扩展。|9b31o|由于用户可以在他不想要的情况下清空他的缓存，这一事实使上述情况受到了影响。|a7nkr|b)+(难度:中等)基于登录的身份验证。大多数现代web框架都提供了这样的解决方案，其核心思想是让用户自愿识别自己的身份，这非常简单，但却增加了架构的复杂性。|8et9d|上面的内容由于额外的复杂性和本质上的非公开内容而受到影响。|dfatq|C)(困难:+hard+-R&D)基于元数据的身份识别，(浏览器ip/语言/browser+/和其他隐私入侵的东西，所以要确保你让你的用户知道，否则你可能会被起诉)不完美的解决方案可能会变得更加复杂(用户以特定的频率键入或使用具有特定模式的鼠标？您甚至可以应用ML解决方案)。声称的解决方案|7njk2|最强大的，因为用户即使没有明确的要求，他也可以被识别出来。这是直接侵犯隐私(见GDPR)，并不完美，例如。ip地址可以更改。^0|0|0|0|0|0|0|0|0|0^^$0|$]|1|@$2|3|4|5|6|7|8|U|9|@]|A|@]|B|$]]|$2|C|4|D|6|7|8|V|9|@]|A|@]|B|$]]|$2|E|4|F|6|7|8|W|9|@]|A|@]|B|$]]|$2|G|4|H|6|7|8|X|9|@]|A|@]|B|$]]|$2|I|4|J|6|7|8|Y|9|@]|A|@]|B|$]]|$2|K|4|L|6|7|8|Z|9|@]|A|@]|B|$]]|$2|M|4|N|6|7|8|10|9|@]|A|@]|B|$]]|$2|O|4|P|6|7|8|11|9|@]|A|@]|B|$]]|$2|Q|4|R|6|7|8|12|9|@]|A|@]|B|$]]|$2|S|4|T|6|7|8|13|9|@]|A|@]|B|$]]]]

I will give my ideas starting from simpler to more complex.
In all the above you can create sessions and the problem essentialy translates to match session with request.
a) (difficulty: easy) use client hardware to store explicitely a session id/hash of some sort (there are quite some privace/security issues so make sure you hash anything you store ), solutions include:
<ul>
<li>cookies storage</li>
<li>browser storage/webDB/ (more exotic browser solutions )</li>
<li>extensions with permission to store things in files.</li>
</ul>
The above suffer from the fact the the user can just empty his cache in case he doesn want.
b) (difficulty: medium) Login based authentication.
Most modern web frameworks provide such solution the core idea is you let the user voluntarily identify himself, quite straghtforward but adds complexity in the architecture.
The above suffer from additional complexity and making essentially non public content.
c)(difficulty: hard -R&amp;D) Identification based on metadata, (browser ip/language /browser / and other privace invasice stuff so make sure you let your users know or you miay get sued )
non perfect solution can get more complicated (a user typing with specific frequency or using mouse with specific patterns ? you even apply ML solutions ).
The claimed solutions
The most powerful since the user even without wanting explicitely he can be identified. It is straight invasion of privacy(see GDPR) and not perfect eg. ip can change .

I need to figure out a way uniquely identify each computer which visits the web site I am creating. Does anybody have any advice on how to achieve this?
Because i want the solution to work on all machines and all browsers (within reason) I am trying to create a solution using javascript.
Cookies will not do.
I need the ability to basically create a guid which is unique to a computer and repeatable, assuming no hardware changes have happened to the computer. Directions i am thinking of are getting the MAC of the network card and other information of this nature which will id the machine visiting the web site.

How do I uniquely identify computers visiting my web site?

身份验证

数据存储

数据库

服务器

Android

Windows

HTML5

JSON

Java

 我需要找出一种方法来唯一地识别访问我正在创建的网站的每台计算机。有没有人对如何做到这一点有什么建议？ 因为我希望这个解决方案可以在所有机器和所有浏览器上运行(在合理范围内)，所以我尝试使用javascript创建一个解决方案。 Cookies是不行的。 我需要的能力，基本上创建一个guid，这是唯一的计算机和可重复的...

问如何唯一标识访问我的网站的计算机？
EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何唯一标识访问我的网站的计算机？EN

社区

活动

资源

关于

腾讯云开发者

热门产品

热门推荐

更多推荐

问如何唯一标识访问我的网站的计算机？
EN