Hello, my question is about tracking smart phone access to a website.
I work in a marketing office, and we’re working on a system to do giveaways.
The basic idea of the system is this:
The user scans a QR Code off of a poster.
The QR Code takes him to a site and generates a random number (using random.org for true randomness)
The random number is compared to another number, also randomly decided, and checks to see if theyre the same number.
If they are the same number the user is a winner and they’re given a verification code (20 digit long randomly generated string) and the same code is saved to a database. If the number doesn’t match, they’re told they didn’t win and asked to try again tomorrow. (they can only enter once per day)
Now all of this is well and good, and nearly completely programmed (in php), then i got to the part where they can only enter once per day… now usually in a normal pc & web browser setting, you could track the IP address and prevent the same IP address from accessing the page twice. Now this is almost the same for a smart phone I believe, in terms of there also being an IP that you can track.
My question is… How are IP Addresses assigned to smart phones? If the user is connecting via 3 or 4G, could they just load the page and then close the browser on their phone and reload it, would there be a new IP? Or perhaps, if they travel to a different area, does the phone have a different IP than before if it’s using a different signal tower? I basically just want to ensure that users cant scan the QR Code over and over again until they get the winning result, but if the user can just restart their browser and change their IP then keeping track of the IP addresses and blocking them after one try wont work.
In a related question, if the IP Address of a smart phone changes frequently, any ideas on alternate methods of only allowing one try per day?
Phone IPs change a lot. I just turned off wifi and connected to 4G, got the IP, connected to my wifi, got the IP, then turned off wifi and connected with 4G again. Both connections to the 4G network were different IPs although they only happened 20 seconds apart. Presumably, every time I connect to the cell network, I will be assigned whatever IP is available at the moment.
Ah yeah I wish I had a smartphone, that would’ve been a much easier solution to my question! As for cookies, if the user had the thought they’d be able to clear their cookies and access the page again no problem, unfortunately but it was a good suggestion! And thanks for the smartphone test
On my iPhone, my IP address is a private one - 10.26.34.53, so presumably AT&T is doing some sort of NAT with phones on their network, and the public IP address will be the same for many phones. It also means that every time you turn the phone off and on, you get a different address.
And, sure enough, I tried it and my new address is 10.60.97.201
You might be better off using SMS, because the phone number is unique, and won’t change.
the SMS thing is an idea… I’m not sure what would be involved with programming a PHP script to receive SMS messages, but it’s definitely something to look into. However, it does leave me with 1 problem. My boss is stuck on QR Codes, so if i’m not using QR Codes in this, i’ll still have to listen to him talk about how I need to use them lol… I wonder, is it even possible to create a website that can receive SMS messages?
At this time, and until IPv6 is deployed widely, you should assume that pretty much every cell phone is behind a NAT gateway, where one IP address can serve tens of thousands of people in a given day, and any one person could show up as multiple IPs in the course of a day, even if they don’t change location.
If you’re using a website, is some sort of cookie a possibility? Not sure if there’s any difference in their use between normal and mobile web browser software, but I assume it’s possible to set one in some way.
Instead of having them send an SMS, how about they use a QR code to the website, enter their phone number (of course, you’ll have a bullet-proof “won’t spam you” privacy policy, right?), and you send THEM a SMS to their phone number once a day?
You can either pay for the service or you can text most carriers free via email, like 1231231234@vztext.com. That might leave out Google Voice users, but I don’t know how much you care about them.
The SMS thing is sort of a possibility, but it doesn’t fit well. I don’t need to contact them so much as for them to contact me. The problem lies in restricting the ability to keep reloading the page until they receive the winning code. I think the simplest solution for my needs may just be to ask them for an additional piece of information. It’d have to be something unique and provable, such as the last 4 of some kind of ID or perhaps a phone number that i could call - if it rings in their pocket, i know it’s their number and i wouldn’t allow entry more than once per day per number. If they try to reenter with random numbers obviously i wouldn’t be able to call it and confirm with them standing next to me while claiming their price, thus eliminating the possibility of entering once a day without having more than one phone. with the ID method I could just have them show me the Id and verify their last 4 of the ID # (I work on an air force base, everyone has an ID card)…
To surmise, I believe I have found my answer! Thank you all for your assistance
Have them enter some identifying information (their name, phone number, SSN, etc.), save those for the day and verify that they are only entered once.
To prevent people entering false info, just specify in your rules that the prize is given only if the info they entered is accurate. So for example, if they enter various made-up names to keep trying, it won’t work – they only win the prize if the name they entered is their actual name.
but it was a good suggestion! And thanks for the smartphone test 