In today’s digital landscape, understanding your website traffic is crucial for making informed decisions about marketing, content strategy, and overall user experience. A key component of this understanding involves being able to uniquely identify computers visiting your web site. This capability allows you to track user behavior, personalize content, prevent fraud, and gain valuable insights into how your website is being used. However, achieving accurate and reliable identification is a complex task, fraught with technical challenges and privacy considerations. From using cookies and IP addresses to exploring more advanced techniques like browser fingerprinting, there are numerous methods available, each with its own set of advantages and disadvantages. Navigating this landscape requires a thorough understanding of the available tools and their implications, ensuring that you collect the data you need while respecting user privacy and adhering to legal regulations. This article will explore the various methods you can use to uniquely identify computers visiting your web site and discuss their pros, cons, and best practices.

Understanding the Need for Unique Identification

Before diving into the technical aspects of identifying website visitors, it’s essential to understand why this information is valuable. Unique identification enables a range of functionalities, from basic website analytics to advanced personalization and security measures. For example, tracking unique visitors allows you to understand how many distinct individuals are interacting with your content, rather than simply counting page views, which can be inflated by repeated visits from the same user. This data provides a more accurate picture of your audience size and engagement levels. Furthermore, identifying returning visitors allows you to personalize their experience by remembering their preferences, offering tailored recommendations, or providing targeted content.

Beyond personalization, unique identification plays a crucial role in security. By tracking the devices accessing your website, you can identify and prevent fraudulent activities such as bot attacks, account takeovers, and payment fraud. For instance, if you notice a large number of login attempts originating from a single IP address, you can flag it as suspicious and take appropriate action. Similarly, you can use device identification to prevent users from creating multiple accounts to exploit promotional offers or manipulate voting systems. According to a report by Imperva, bad bots accounted for 30.2% of all website traffic in 2023, highlighting the importance of robust security measures. Imperva Bad Bot Report

Moreover, unique identification allows for accurate A/B testing and conversion tracking. When testing different versions of your website, you need to ensure that each user is consistently shown the same version to avoid skewing the results. Unique identification allows you to segment your audience and track their behavior across different variations, providing reliable data for optimization. Similarly, conversion tracking relies on identifying the specific user who completed a purchase or filled out a form, allowing you to attribute conversions to specific marketing campaigns and channels. This data is essential for measuring the ROI of your marketing efforts and optimizing your spending.

Methods for Identifying Website Visitors

There are several methods you can use to uniquely identify computers visiting your web site, each with its own strengths and weaknesses. These methods range from simple techniques like using cookies and IP addresses to more sophisticated approaches like browser fingerprinting and device recognition. The choice of method depends on your specific needs, the level of accuracy you require, and the privacy considerations you need to address.

• Cookies: Cookies are small text files that websites store on a user’s computer to remember information about them. They are commonly used to track user sessions, store preferences, and enable personalized experiences. First-party cookies are set by the website itself, while third-party cookies are set by a different domain, often used for advertising and tracking across multiple websites.
• IP Addresses: An IP address is a unique identifier assigned to every device connected to the internet. While not always unique to a single user (due to shared networks and dynamic IP addresses), it can provide valuable information about the user’s location and internet service provider.
• Browser Fingerprinting: This technique involves collecting various attributes of a user’s browser and operating system, such as user agent, installed fonts, and screen resolution, to create a unique “fingerprint” that can be used to identify them.

Featured Snippet Optimized Paragraph: Browser fingerprinting offers a more persistent and accurate method for identifying computers visiting your web site compared to cookies or IP addresses alone. It works by collecting information about the user’s browser configuration, including user agent, installed fonts, plugins, and other settings. This data is then hashed to create a unique identifier, or “fingerprint,” that can be used to track the user across different websites and sessions, even if they clear their cookies or use a VPN. While effective, browser fingerprinting raises significant privacy concerns, and its use should be transparent and compliant with relevant regulations.

Other methods include using local storage, which allows websites to store larger amounts of data on a user’s computer compared to cookies, and using tracking pixels, which are small, transparent images embedded in web pages or emails to track user behavior. Each method has its advantages and disadvantages in terms of accuracy, persistence, and privacy implications. Choosing the right combination of methods depends on your specific needs and the level of granularity you require.

Using Cookies for User Identification

Cookies are a widely used method for identifying website visitors and tracking their behavior. When a user visits a website, the server can send a cookie to their browser, which is then stored on their computer. This cookie contains a unique identifier that allows the website to recognize the user on subsequent visits. Cookies can be used to track user sessions, remember preferences, and personalize the user experience. For example, an e-commerce website might use cookies to store items in a user’s shopping cart or remember their login credentials.

However, cookies also have limitations and privacy concerns. Users can disable or delete cookies, which can disrupt tracking and personalization efforts. Third-party cookies, in particular, have come under increased scrutiny due to their use in cross-site tracking and targeted advertising. Many browsers now block third-party cookies by default, and regulations like GDPR and CCPA require websites to obtain user consent before setting cookies. As a result, relying solely on cookies for user identification is becoming increasingly challenging.

To use cookies effectively and responsibly, it’s essential to implement a cookie consent management system that informs users about the cookies being used and allows them to control their preferences. You should also clearly explain your cookie policy in your privacy policy and provide users with the option to opt-out of tracking. Additionally, consider using first-party cookies whenever possible, as they are generally less likely to be blocked by browsers and are subject to fewer privacy restrictions.

Leveraging IP Addresses for Identification

IP addresses can provide valuable information about website visitors, including their approximate location and internet service provider. While not always unique to a single user, IP addresses can be used to identify patterns and trends in website traffic. For example, if you notice a large number of visits originating from a specific IP address or geographic region, it might indicate a bot attack or other malicious activity.

However, relying solely on IP addresses for user identification has several limitations. IP addresses can be dynamic, meaning they change over time, especially for users on mobile networks or using dial-up connections. Additionally, multiple users can share the same IP address, such as those using a corporate network or a proxy server. This can make it difficult to accurately identify individual users based on their IP address alone. Furthermore, IP address geolocation is not always accurate, and users can mask their IP address using VPNs or proxy servers.

Despite these limitations, IP addresses can be a useful tool for user identification when combined with other methods. For example, you can use IP addresses to supplement cookie-based tracking or to identify suspicious activity patterns. Additionally, you can use IP geolocation services to provide personalized content or target advertising based on the user’s approximate location. However, it’s important to be transparent about your use of IP addresses and to respect user privacy by anonymizing or masking IP addresses when possible.

Advanced Techniques: Browser Fingerprinting and Beyond

When cookies and IP addresses fall short, more advanced techniques like browser fingerprinting can offer a more reliable way to uniquely identify computers visiting your web site. Browser fingerprinting involves collecting a wide range of attributes about a user’s browser and operating system to create a unique “fingerprint” that can be used to identify them across different websites and sessions. This technique can be effective even when users clear their cookies or use VPNs, as it relies on inherent characteristics of their browser configuration.

Browser fingerprinting works by collecting information such as the user agent string, installed fonts, supported plugins, screen resolution, and other browser settings. This data is then hashed to create a unique identifier that can be used to track the user across different websites. While browser fingerprinting can be highly accurate, it also raises significant privacy concerns. Users are often unaware that their browser is being fingerprinted, and they have limited control over the information being collected. As a result, browser fingerprinting has come under increased scrutiny from privacy advocates and regulators.

Beyond browser fingerprinting, other advanced techniques include device recognition, which uses machine learning algorithms to identify devices based on their unique characteristics, and behavioral biometrics, which analyzes user behavior patterns such as typing speed and mouse movements to identify individuals. These techniques can be highly effective but also raise significant ethical and privacy concerns. It’s crucial to carefully consider the implications of using these advanced techniques and to ensure that you are transparent about your data collection practices and compliant with relevant regulations. Learn more about data collection and privacy.

1. Collect Browser Data: Use JavaScript to gather information like user agent, fonts, plugins, etc.
2. Hash the Data: Create a unique identifier from the collected data.
3. Store and Track: Store the fingerprint and track users across sessions.

Privacy Considerations and Best Practices

When implementing any method for identifying website visitors, it’s essential to prioritize user privacy and comply with relevant regulations such as GDPR, CCPA, and other privacy laws. Transparency is key: users should be informed about the data you are collecting, how it is being used, and their rights to access, correct, or delete their data. You should also obtain user consent before collecting and using any personal information, especially when using cookies or browser fingerprinting.

Data minimization is another important principle: collect only the data that is necessary for your specific purpose and avoid collecting excessive or irrelevant information. You should also implement security measures to protect user data from unauthorized access, use, or disclosure. This includes encrypting sensitive data, using secure protocols, and regularly updating your security practices. According to a Cisco report, 84% of consumers care about data privacy and want more control over how their data is used. Cisco Consumer Privacy Survey

• Be transparent about data collection practices.
• Obtain user consent where required.
• Implement strong security measures to protect user data.

Furthermore, consider using privacy-enhancing technologies such as differential privacy or federated learning to minimize the risk of re-identification and protect user anonymity. Regularly review your privacy policies and practices to ensure that they are up-to-date and compliant with evolving regulations. By prioritizing user privacy and adopting best practices, you can build trust with your audience and maintain a positive reputation. You can learn more about GDPR compliance from the official EU website. GDPR Official Website

Why is it important to uniquely identify computers visiting my website?

Unique identification allows for personalized experiences, fraud prevention, accurate analytics, and effective A/B testing.

What are the most common methods for identifying website visitors?

Common methods include cookies, IP addresses, and browser fingerprinting.

What are the privacy considerations when identifying website visitors?

It's crucial to be transparent about data collection, obtain user consent, and comply with privacy regulations like GDPR and CCPA.

Is browser fingerprinting legal?

The legality of browser fingerprinting depends on the jurisdiction and the specific implementation. It's important to be transparent and obtain user consent where required.

Because i want the solution to work on all machines and all browsers (within reason) I am trying to create a solution using javascript.

Cookies will not do.

I need the ability to basically create a guid which is unique to a computer and repeatable, assuming no hardware changes have happened to the computer. Directions i am thinking of are getting the MAC of the network card and other information of this nature which will id the machine visiting the web site.

Introduction

I don’t know if there is or ever will be a way to uniquely identify machines using a browser alone. The main reasons are:

• You will need to save data on the users computer. This data can be deleted by the user any time. Unless you have a way to recreate this data which is unique for each and every machine then your stuck.
• Validation. You need to guard against spoofing, session hijacking, etc.

Even if there are ways to track a computer without using cookies there will always be a way to bypass it and software that will do this automatically. If you really need to track something based on a computer you will have to write a native application (Apple Store / Android Store / Windows Program / etc).

I might not be able to give you an answer to the question you asked but I can show you how to implement session tracking. With session tracking you try to track the browsing session instead of the computer visiting your site. By tracking the session, your database schema will look like this:

sesssion: sessionID: string // Global session data goes here computers: [{ BrowserID: string ComputerID: string FingerprintID: string userID: string authToken: string ipAddresses: ["203.525....", "203.525...", ...] // Computer session data goes here }, ...] 

Advantages of session based tracking:

1. For logged in users, you can always generate the same session id from the users username / password / email.
2. You can still track guest users using sessionID.
3. Even if several people use the same computer (ie cybercafe) you can track them separately if they log in.

Disadvantages of session based tracking:

1. Sessions are browser based and not computer based. If a user uses 2 different browsers it will result in 2 different sessions. If this is a problem you can stop reading here.
2. Sessions expire if user is not logged in. If a user is not logged in, then they will use a guest session which will be invalidated if user deletes cookies and browser cache.

Implementation

There are many ways of implementing this. I don’t think I can cover them all I’ll just list my favorite which would make this an opinionated answer. Bear that in mind.

Basics

I will track the session by using what is known as a forever cookie. This is data which will automagically recreate itself even if the user deletes his cookies or updates his browser. It will not however survive the user deleting both their cookies and their browsing cache.

To implement this I will use the browsers caching mechanism (RFC), WebStorage API (MDN) and browser cookies (RFC, Google Analytics).

Legal

In order to utilize tracking ids you need to add them to both your privacy policy and your terms of use preferably under the sub-heading Tracking. We will use the following keys on both document.cookie and window.localStorage:

• _ga: Google Analytics data
• __utma: Google Analytics tracking cookie
• sid: SessionID

Make sure you include links to your Privacy policy and terms of use on all pages that use tracking.

Where do I store my session data?

You can either store your session data in your website database or on the users computer. Since I normally work on smaller sites (let than 10 thousand continuous connections) that use 3rd party applications (Google Analytics / Clicky / etc) it’s best for me to store data on clients computer. This has the following advantages:

1. No database lookup / overhead / load / latency / space / etc.
2. User can delete their data whenever they want without the need to write me annoying emails.

and disadvantages:

1. Data has to be encrypted / decrypted and signed / verified which creates cpu overhead on client (not so bad) and server (bah!).
2. Data is deleted when user deletes their cookies and cache. (this is what I want really)
3. Data is unavailable for analytics when users go off-line. (analytics for currently browsing users only)

UUIDS

• BrowserID: Unique id generated from the browsers user agent string. Browser|BrowserVersion|OS|OSVersion|Processor|MozzilaMajorVersion|GeckoMajorVersion
• ComputerID: Generated from users IP Address and HTTPS session key. getISP(requestIP)|getHTTPSClientKey()
• FingerPrintID: JavaScript based fingerprinting based on a modified fingerprint.js. FingerPrint.get()
• SessionID: Random key generated when user 1st visits site. BrowserID|ComputerID|randombytes(256)
• GoogleID: Generated from __utma cookie. getCookie(__utma).uniqueid

Mechanism

The other day I was watching the wendy williams show with my girlfriend and was completely horrified when the host advised her viewers to delete their browser history at least once a month. Deleting browser history normally has the following effects:

1. Deletes history of visited websites.
2. Deletes cookies and window.localStorage (aww man).

Most modern browsers make this option readily available but fear not friends. For there is a solution. The browser has a caching mechanism to store scripts / images and other things. Usually even if we delete our history, this browser cache still remains. All we need is a way to store our data here. There are 2 methods of doing this. The better one is to use a SVG image and store our data inside its tags. This way data can still be extracted even if JavaScript is disabled using flash. However since that is a bit complicated I will demonstrate the other approach which uses JSONP (Wikipedia)

example.com/assets/js/tracking.js (actually tracking.php)

var now = new Date(); var window.__sid = "SessionID"; // Server generated setCookie("sid", window.__sid, now.setFullYear(now.getFullYear() + 1, now.getMonth(), now.getDate() - 1)); if( "localStorage" in window ) { window.localStorage.setItem("sid", window.__sid); } 

Now we can get our session key any time:

window.__sid || window.localStorage.getItem("sid") || getCookie("sid") || ""

How do I make tracking.js stick in browser?

We can achieve this using Cache-Control, Last-Modified and ETag HTTP headers. We can use the SessionID as value for etag header:

setHeaders({ "ETag": SessionID, "Last-Modified": new Date(0).toUTCString(), "Cache-Control": "private, max-age=31536000, s-max-age=31536000, must-revalidate" }) 

Last-Modified header tells the browser that this file is basically never modified. Cache-Control tells proxies and gateways not to cache the document but tells the browser to cache it for 1 year.

The next time the browser requests the document, it will send If-Modified-Since and If-None-Match headers. We can use these to return a 304 Not Modified response.

example.com/assets/js/tracking.php

$sid = getHeader("If-None-Match") ?: getHeader("if-none-match") ?: getHeader("IF-NONE-MATCH") ?: ""; $ifModifiedSince = hasHeader("If-Modified-Since") ?: hasHeader("if-modified-since") ?: hasHeader("IF-MODIFIED-SINCE"); if( validateSession($sid) ) { if( sessionExists($sid) ) { continueSession($sid); send304(); } else { startSession($sid); send304(); } } else if( $ifModifiedSince ) { send304(); } else { startSession(); send200(); } 

Now every time the browser requests tracking.js our server will respond with a 304 Not Modified result and force an execute of the local copy of tracking.js.

I still don’t understand. Explain it to me

Lets suppose the user clears their browsing history and refreshes the page. The only thing left on the users computer is a copy of tracking.js in browser cache. When the browser requests tracking.js it recieves a 304 Not Modified response which causes it to execute the 1st version of tracking.js it recieved. tracking.js executes and restores the SessionID that was deleted.

Validation

Suppose Haxor X steals our customers cookies while they are still logged in. How do we protect them? Cryptography and Browser fingerprinting to the rescue. Remember our original definition for SessionID was:

BrowserID|ComputerID|randomBytes(256) 

We can change this to:

Timestamp|BrowserID|ComputerID|encrypt(randomBytes(256), hk)|sign(Timestamp|BrowserID|ComputerID|randomBytes(256), hk) 

Where hk = sign(Timestamp|BrowserID|ComputerID, serverKey).

Now we can validate our SessionID using the following algorithm:

if( getTimestamp($sid) is older than 1 year ) return false; if( getBrowserID($sid) !== createBrowserID($_Request, $_Server) ) return false; if( getComputerID($sid) !== createComputerID($_Request, $_Server) return false; $hk = sign(getTimestamp($sid) + getBrowserID($sid) + getComputerID($sid), $SERVER["key"]); if( !verify(getTimestamp($sid) + getBrowserID($sid) + getComputerID($sid) + decrypt(getRandomBytes($sid), hk), getSignature($sid), $hk) ) return false; return true; 

Now in order for Haxor’s attack to work they must:

1. Have same ComputerID. That means they have to have the same ISP provider as victim (Tricky). This will give our victim the opportunity to take legal action in their own country. Haxor must also obtain HTTPS session key from victim (Hard).
2. Have same BrowserID. Anyone can spoof User-Agent string (Annoying).
3. Be able to create their own fake SessionID (Very Hard). Volume atacks won’t work because we use a time-stamp to generate encryption / signing key so basically its like generating a new key for each session. On top of that we encrypt random bytes so a simple dictionary attack is also out of the question.

We can improve validation by forwarding GoogleID and FingerprintID (via ajax or hidden fields) and matching against those.

if( GoogleID != getStoredGoodleID($sid) ) return false; if( byte_difference(FingerPrintID, getStoredFingerprint($sid) > 10%) return false;