Recognize Website User without Login?
authentication, identity, openid, web-applications
Solution
What you want to do is what cookies were invented for. But browsers have gotten wise to people being tracked without their permission, and now limit 3rd party cookies.
The Electronic Frontier Foundation recently put up a proof of concept for uniquely identifying a visitor based on attributes of their browser. It's uses things things like:
- `User-Agent` string
- `http-accept` values
- timezone
- screen resolution and color depth
- the installed plugins
- if cookies are enabled
It's not guaranteed to be unique, but my browser certainly is, and it will get you on your way to doing the bad things that people don't like.
Problem
I'd like to create a piece of code that can be embedded on many different websites (widget). Is there any way that my code can identify a user without them logging in? I.e, can I use any of the established identity mechanisms floating around the web to reliably identify them across instances of this widget? I don't need to (nor should I be able to) tap into any information about this user, just identify them. The websites will be heterogeneous; there's no guarantee that they will have any common aspects, so the widget code needs to be entirely self contained.