9 ms·
The thing is though, what they seemed to object to was trying to login (not using the same session cookie) across different IP addresses. At least that was the
by VBprogrammer 7y ago
The thing is though, what they seemed to object to was trying to login (not using the same session cookie) across different IP addresses. At least that was the case when I opened the site on my laptop. Maybe my phone did login on the dodgy wifi and then when I reconnected via the 4g it tried to use that session, perhaps causing my account to be flagged. I'm not really convinced though.
It clearly makes sense to tie the session to the IP address but the 10 minute delay doesn't make much sense to me.
- nybble41 7y ago> It clearly makes sense to tie the session to the IP address... At one point that might have been true but not any more. Mobile devices are the norm, and handoffs between cell towers and WiFi access points are handled transparently without any user interaction. Consequently, people expect their sessions to continue working despite changes in their IP address. Use TLS connections and set expiration times on the session cookies, but ignore the source IP address.
- rtkwe 7y agoYour IP doesn't change per tower transition, your data from the tower goes through more centralized servers. For example my IP sitting physically in RTP in North Carolina is actually exiting AT&Ts network in Atlanta, Georgia.
- nybble41 7y agoFor clean handoffs within the same network, sure. But you also have roaming to consider, and the device may lose its connection temporarily and be assigned a new address when it returns.
- wool_gather 7y agoIs there actually any advantage to having a dynamic pool of IP addresses like this? Associating a number from your IP block to a subscriber number seems far, far simpler and better.
- mnoorenberghe 7y agoIf you’re suggesting each subscriber gets a static IP then that’s much worse for privacy.
- wool_gather 7y agoI'm speaking from the provider's point of view: they don't care about privacy. In fact, in the US there is a federal law that requires them to be able to associate network activity with a subscriber at the request of law enforcement.
- zAy0LfpBZLC8mAC 7y agoLocality/size of routing tables. If you had a hundred million subscribers with fixed IP addresses moving all over the country, you essentially could not aggregate any routes, but would have to have a hundred million routes in your routing table, and/or you would have to push all the traffic from and to all subscribers through one central router, which in particular would add latency for any subscribers that currenty are at the other end of the country.
- Spooky23 7y agoYour cellular traffic is proxied in most cases, and how carriers present it varies.