How do I prevent multiple Internet Identity accounts from the same device?

Developers
1

For certain apps, we don’t want a single user to be able to create a bunch of burner accounts. Normal apps use phone or email verification to try to prevent it, although it’s not perfect.

My understanding of Internet Identity is that a single user can create multiple IIs, each authenticated via multiple devices (one primary, one or more backups). Then, any of those IIs can be used to register an account with some other IC-hosted app, assuming that app is using Internet Identity for managing login. In other words, creating burner or fake accounts is even easier with Internet Identity, it seems.

Is there a way for that app to know that this II and that II share a common underlying device, and prevent two accounts from being registered? Or does that break the Internet Identity model?

Completely separate question… why does Internet Identity require a device with Face ID / Touch ID (or a YubiKey) if the user can choose to authenticate with the device password instead? Is it because the initial generation of the key pair requires biometric authentication via the TPM chip or HSM device, but future logins using the private key can be done with just the device password?

Thanks!!!

2

There is not, and that is intentional: users should be able to register multiple times, and not be tracked across different applications. So if you really want to limit registrations to one per person, you need to take different measures.

Better to have a completely separate post then :slight_smile: