Machine Unique ID need.

[mishu007]

I am developing a Page Where i need Client Machine Unique ID.Suddenly i got a solution that i need to delevop a applet progrem where the the applet will download into the machine and run on the machine and return the Machine unique ID. But i dont know how to implement that?? :( if you have any code plz help me.

[CornedBee]

It's impossible. An applet cannot download to the machine, cannot run anything on the machine, and certainly can't retrieve sensitive information like the Machine UID - whatever that is. (The only thing I can think of is the CPUID, and it's easy to disable fetching that.)

Why do you need such a UID? Why not just create a UID and store it in a cookie, so that the browser identifies itself every time it returns?

[mishu007]

Actually i need a system where the client can login after verifying his user ID, Password and the Machine ID. So he cant login if he use any other machine as if he knows the user Id and Password.

Is there any other way to do that?

And what you are telling me that I need to generate a UID and store that on the time of Registration. So that browser identifies itself every time it returns. But if the user deletes the cookies then how could the System identifies that?

Plz help me.. I need a solution.

[CornedBee]

There is one way to do that: using SSL. SSL, if you configure the server correctly, can require that the client has a certificate, too. This requires the client to acquire and install a certificate, though - not exactly something trivial.

Also, he could just install the same certificate on more than one computer.

Why do you need to match login to PC? What if someone, like me, has one desktop computer and one notebook, or one work computer and one at home? I know I would be majorly annoyed if I couldn't login from both computers.

And you still haven't explained what the machine ID is.

[mishu007]

Sorry to say i forgot to tell about Machine Id. Actually Its a Combination of Motherboard ID, CPU ID and Hard Drive ID. The Combination is always Unique. I have a program in C++, which generates the Machine Unique ID. But all I need to do is to install in the client machine when the client open that page.

Actually i don't have any options. Because My client told me something like this... If anybody knows the UserID and Password still he cant login into that system. The system needs to be recognized the particular Machine.

Is the any alternative solution??

And you are telling me about the SSL options. Is there anyway to protect the system that the client can login through the particular machine where the certificate is installed?

[CornedBee]

There is no way to prevent a particular SSL certificate from being installed on more than one computer.

The only way to get your C++ code to run is to write an ActiveX control that contains it and make Internet Explorer load that. This means that:
1) All operating systems but Windows and all browsers but Internet Explorer are automatically denied access to your system.
2) The user must approve installing and executing an ActiveX control.

Depending on the purpose of the system you're developing (any hints?), the first one may not be much of a problem, although I strongly detest all such solutions. The second, however, is a potential security risk. Assuming you get the user to approve installation of an unknown ActiveX control (for really special-purpose applications, this is of course possible, unless, which is not unlikely either, admin-set restrictions prevent the user from doing so), the control can be used by any other web page, probably without prompting - and if there is a prompt, it's "Do you want to allow active contents to be executed?" which is totally meaningless, because Flash Player creates exactly the same prompt. In other words, once the user has installed the control, any web page at all can uniquely identify the user's computer.

To me, that would be absolutely inacceptable.

I still see absolutely no reason to limit the computers that can log in. Tell your client, in more polite terms of course, that this requirement is idiotic and technically not feasible with reasonable effort and compromises and must therefore be droped.