Identify the user on the site by the running program (not the fact that on the same computer)?

Question

Nginx

I've been thinking about this riddle. Is it possible to identify a user on the site (note, not to authenticate, but simply to find out who it is) without asking him anything? You can use Javascript AJAX, PHP, installed programs on the server and on the client's computer.
Those. there are, say, 10 people. They have clients connected to the server running. They go to the site and click the button and the client shows the inscription "You clicked!" only to the user who actually just clicked the button.
At first, I thought to force the user to enter e-mail. But after all, someone can enter someone else's e-mail and thus the message will be seen by the wrong person. Then the idea came to compare the IP of the client connected to the server and the IP of the user who came to the site. But the question arises: are these addresses guaranteed to match? The answer is no, because you can come to the site under a proxy, and the client may not use a proxy (or even be running on the phone - this is also allowed, but it is permissible to request this during registration).
So this is a riddle for the habro community: is it even possible for the user in the simplest way (that is, without obliging him to remember the password) to find out which of the running clients belongs to him and display a message there, without false output from other users of the system?

Answer 1

Let your program launch its own web server (very light), which listens on port, say 19999. After clicking on the button, let the javascript send a request there via AJAX / IFRAME.
In a similar way, as I understand it, the client from WebMoney works.

Answer 2

Well, with a high degree of probability, you can use flash cookies. Set it as a “client” when connecting, and read it in the browser through a special flash drive and jsk
. And then the internet again...

Answer 3

Yes, bind by IP, the probability that the ip will match for two simultaneously connected users is not great, of course, if this is a service with a mediocre number of visitors.
You can also take a hash from IP + monitor resolution (this parameter is easy to get both through javaScript and software that is installed on the user's machine) You
can also make the program install the necessary cookie with a unique identifier on all browsers during installation.

Answer 4

I think at this time (2.30 in Ukraine) it’s already bad :), but the first option that came to mind is a browser plugin (which, for example, takes the session ID from the client and gives it to the site). Of course, this will only work if the client and browser are open in the same environment.

Answer 5

More specifically:
it should work in popular browsers: Firefox, Opera, Chrome, Safari, IE - i.e. without plug-ins (after all, you still need to install these plug-ins, and the user is a lazy creature) and without embedding the browser into the client.
A client is a constantly running program that waits for its user to click on a button on the site. It can be launched both from a phone and from a computer (but not at the same time (or at the same time with an indication of priority))
The server part is a tandem of a server application, PHP and mySQL.
Well, the button on the site can be anything implemented that can send a request to PHP.
All this bundle can send any information in any direction (within the framework of technology, of course).

Answer 6

It is not feasible for a phone without two simultaneous sessions. With password entry both in the browser and in the client.
For a computer, it can be implemented in two ways:
-sniff traffic, respectively, receive a session.
-prescribe in hosts when starting 127.0.0.1 needed.host, and force the client to broadcast all requests and responses.
Both methods have a lot of problems and disadvantages. Use such solutions only if you are absolutely sure that you want to walk with crutches.
If not, then just the same as in the phone - entering passwords both there and there.

Answer 7

If you plan to have a little more than a few users, you can look here:
panopticlick.eff.org/
It is quite possible that such information will be more than enough.
(the solution is of course not with a 100% guarantee)

Answer 8

You can register your protocol like skype:// and make your own program the handler.
Make a link on the site.