What data can I pull from the user?

[Outer]

I know of USER_AGENT and IP Address, but I need more than that.

What other information can I retrieve from the user?

 

[Atomical]

800 lines? More like four. I'll give you that script for free. Better yet, search freshmeat.net.

 

[iNod]

lol..

The script I posted above search your IP in Ip 2 Country DB. Does the http_user_agent and takes that and extracts it based on what that is it displays your complete OS not Windows NT 5.1 it displays Windows XP, Linux Redhat,etc it displays your browser.. Actual name not Mozilla/54432

It is 800+ lines..

iNod

 

[Zubair1]

its hard tracking users with their i.p address's thanks to BIG ISP'S like AOL
giving users dynamic, which from that their i.p changes on every visit.

you really can't know if the person is the same as who you thought it was,
any body has solutions or ideas for this.?

 

[primacomputer]

Before you start looking at writing a solution like this I think you should go back to basics and read up a bit on various authentication systems and how they work. I think you'll find you are barking up the wrong tree.

I have a passive fingerprinting system that keys off the user agent, network, route, etc. It also has an option to see around many proxy servers by using other protocols. In addition have an active fingerprinting system that profiles the users TCP/IP stack as well as any services they are running. This is very effective at detecting the same person logging in as different users. Even if they change their IP, clear their cookies, and restart their browser. But it it far from foolproof, and I wouldn't even dream of relying on it to replace session ids.

If you're worried about security try SSL. Then use the session ids/ cookies that are relatively secure within the SSL tunnel. If you want to keep an eye out for users who are cheating then add some fingerprinting and profiling on top of that. Session ids and SSL were designed to do what you want. Don't try to reinvent the wheel, especially if you haven't yet learned to make fire.

 

[Atomical]

This is really over kill. Either the poster has an inane sense of how to accomplish security or he's programming NSA's website. The best idea is to store the information you know about the user and force them to relogin if that information changes. I doubt anyone will have success brute forcing session id's. You could even modify php's session generator to be a mix of md5 and whatever else they use.