c# - How can I certify the client? -

i have following scenario: client connects on tcp server. client sends credentials server (password, username, mac address). server validates credentials , handles client if data correct.

but right? want ensure 1 (on user profile registered) computer can use client. means client , computer must identified. i'm sure suggestion above pretty wrong. how can better?

this tricky problem, comments pointed out, users may fake machine information pretend computer.

what recommend hash machine information (e.g. sha-256), isn't obvious what information use identify computer. of course can learned attackers in multiple ways (monitoring, disassembly, etc).

here tips on data use uniquely identify machine. pick several characteristics, put them , hash them. of course means if user changes e.g. hard drive (and use serial identify computer), cannot connect anymore. suppose need offer "re-create key" function anyway in case users switch or modify computer.

this approach makes harder trick system, using multiple pieces of information , hashing them, forcing users a) figure out information use , b) how hash (definitely use salt). however, still possible that. question is: how high requirements? typical user won't able bypass this, if that's want should sufficient.

i'm not sure whether there can "perfect" solution problem, want protect system user. means encryption keys, certificates or whatever use known , available user. on top of that, users have access client application , analyze it. can modify computer in ways cannot prevent of forsee. in all, think best can make huge pain in backside bypass guards, nobody want bother / can minimize number of users may so.

the other thing can think of fancy logging , monitoring on server, e.g. detect user connected multiple times 1 machine, alerting or aborting 1 connection. again, can reduce abuse, not prevent it.