91

First, I don't think it's realistic to expect users to have JavaScript disabled on the modern web. So let's take a look at what Panopticlick can gather through JavaScript alone, along with the uniqueness score of my particular browser: User Agent (1 in 4,184) HTTP_ACCEPT Headers (1 in 14) Browser Plugin Details (1 in 1.8 million) Time Zone (1 in 24) Screen ...


28

It's just to try and ensure that you enter the correct address, without typos. Since email addresses are usually the primary contact information for websites, it's considered worth the extra effort to try and make sure it gets entered correctly. It's sometimes called two-pass verification.


11

Browser fingerprinting relies on a very heterogeneous browser/device-ecosystem. One thing to consider is that we are moving towards a more and more homogenous ecosystem as more and more surfing is done on smartphones and tablets/pads which tend to be a lot less fragmented in this sense. IPhones/iPads will for instance all look essentially identical.


10

Is browser fingerprinting a sufficient method for uniquely identifying anonymous users? No, at best it can uniquely identity a Computer. There is no way it can differentiate between 2 new (and like) computers on the same network (Same IP) with out a cookie\session. What if you incorporate biometric data like mouse gestures or typing patterns? This ...


6

I would agree with @vincentcr, but would add one more environment to consider: the corporate network. Here you are likely to find many dozens or hundreds of (potential) users with the exact same browser, plugins, fonts etc. The additional factors @vincentcr suggests also fail here - IP addresses are likely to be the same if the users are behind a corporate ...


5

In my projects, I give them a name but not necessarily a domain. So my package names (and namespaces) are usually just "projectname.libraryname", regardless where the code is hosted. I am used to .NET where this is handeled quite freely.


4

Even if there are a huge number of combinations, they are not all distributed evenly. Think how many people on, say, a macbook, will just use the stock configuration. Or those who never install any plugin: I suspect those are the majority of users. And at the extreme end, you have the fastest growing segment of devices: mobile phone and tablet users, ...


4

I suspect a lot of it is "Grandma's Cooking Secret" programming where the programmer does it because they saw someone else do it. It's following tradition without thinking. There could some logic originally behind it, such as users in 1996 not knowing that much about how to format email addresses. It could have been done then to avoid errors but then why ...


3

Using browser fingerprinting you can identify an individual user on the web, and the only drawback is that you need to make javascript compulsory for every user. It work on two principles: Detect the browser fingerprint based on 8 parameters Detect if someone has changed his fingerprint by changing any parameter. The success of fingerprinting depends ...


2

Some browsers can also be identified via HSTS Supercookies. This is where you can embed a page with requests to random sets of secure and non secure resources for each visitor, then monitor the pattern of their requests on a returning visit. If each resource is requested in the same pattern, then you can use that information to identify the user. These are ...


2

It is just the old way of confirming the email address. In old days, you had to enter the same email twice in order to verify it, in the new way, you have to click on a link inside the email to verify it. The new way is far better and makes the first one obsolete. In this particular case, there is an extra emphasis on email just because it is money related ...


2

I can't remember where I've seen it, but I've seen it suggested to use a structure like this: YourIdentifier.YourProduct.YourComponent YourIdentifier can be something like a domain you own, your (fairly unique) internet alias, etc etc. The component name is left off for "core" code of your product. For instance, I have a small MVC framework named BarelyMVC,...


1

It's only code, doesn't have to mean anything, i.e. no information should be encoded in the code. Since there's no length limitation, why not use words? This is not my original idea, btw, I got it from what3words It meets the desired properties: Uniqueness, what3words can map earth in 3x3 square meters space. Even if that's the maximum, you have plenty of ...


1

I’ve done this before, where data in a third party service needs to be in sync with data stored in my in-house SQL database. The best way that I could come up with was to start a local database transaction, provisionally insert the local data, reach out to the third-party service and do my data creation / insert there, verify the third-party service call ...


1

I came across this question on random, but here's how I would do it: On your users table, create a column called lastActivity and make it a DateTime type. When connecting via the websocket, have the client authenticate the socket connection, (like sending an authToken or however you like). When authenticating, you set the id of the user as a property on ...


1

There's no rule that Java package names or .NET namespaces be domain names. There isn't even a requirement that they be unique, although that's certainly a Good Idea. I actually think you were right to use com.googlecode.oldproj, and in your shoes I wouldn't have switched to com.oldproj unless I was trying to get publicity for the new domain name.


1

Short Answer: It is done to prevent the typo (mistakenly entering email address) ! Without this check, user may enter a wrong email address and never get registration feedback email, because he has entered wrong email address. In addition, this checking measure is prevent mass spamming by CaptCHA implementation in place.


Only top voted, non community-wiki answers of a minimum length are eligible