Is there a way to disallow multiple votes from one user without forcing authentication? [closed]

Question

I'm looking for a way to prohibit voting rigging (cache/cookie-clearing, etc.) without requiring the user to jump through hoops (registration, authentication, etc.). Any ideas?

Answer 1

You can combine several methods:

• The aforementioned IP authentication.
• Store information in a cookie or session.
• Measure number of "same" votes within a very short time period (although these you can just mark as suspect)

Each is easily overcome for those who know how, but the question, like Dan Petker said, is how important is the vote?

Alternatively you can use an easy authentication technique like OpenID or Facebook, which will enable most users to finish the process extremely quickly.

Answer 2

One option is to associate each vote with the user's IP address. If you see another vote come in from the same IP address, you could disallow it.

This solution has two major drawbacks, however. The first is that there isn't a one-to-one mapping of computers to IP addresses in a lot of home networking setups these days. For example, if you have three computers all hooked up to a single router/modem then they'll all likely share the same IP and so only one vote from the three computers would be allowed even though you should be allowing all three.

The other drawback is that all it takes is someone using Tor or another anonymizing software to circumvent this restriction altogether.

I guess it all depends on just how secure you need this voting process to be, and how hard you want to make it for would-be attackers to cause trouble. If security and integrity of the voting process is top-priority, then you'll really need to consider requiring some sort of registration/authentication to make sure things aren't rigged.

Edit: Another idea...

I was thinking about this problem from a slightly different angle and I had another idea. In your question you mention you don't want users to jump through hoops and suggest that registration/authentication would be considered a "hoop". What if registration didn't have to be a hoop? You could make the registration process so dead simple that users wouldn't consider it a reason to refrain from voting.

For example, I only found out about ui.stackexchange today and I wanted to dive in and start answering questions/upvoting/etc. right away. To do that, though, I had to register. However, stackexchange uses OpenID as a way to create your account, which means that with two clicks I was registered here and ready to go.

Is this something you could do on your site? Without having implemented the technologies directly, it seems like OpenID, Facebook Connect, etc. all offer quick, easy ways of adding authentication to a site without forcing the user to fill out long registration forms - the best of both worlds!

Answer 3

Combine a few different aspects: IP address, user-agent, Flash version, etc. The resulting identity won't be guaranteed to be 100% unique, but it's a lot closer to your goal than just an IP.

Answer 4

The question you need to ask is:

How serious a problem is it if a user votes multiple times?

For example, if there's something real at stake - money, a physical prize etc. then there is a greater temptation to try to rig the vote. In these cases you probably have to insist on user registration (but going the OpenID/Facebook Connect route as Dan Petker suggests might be the least painful way here).

If, however, it's "only fun" you could end up expending a lot of time (and money) trying to stop something that most people won't indulge in. The amount of effort you expend should be proportional to the cost of voter fraud.

Having said that though, it's amazing the efforts that some people will go to to "game" voting systems to award themselves more points, so you could end up going the full registration route anyway.

Answer 5

The techniques used by the EFF for the Panopticlick project may be very relevant here :

"When you visit a website, you are allowing that site to access a lot of information about your computer's configuration. Combined, this information can create a kind of fingerprint — a signature that could be used to identify you and your computer".

The statistical results of this experiment are available but technical information is limited to a short paper - both linked from the home page. Nevertheless, it provides good inspiration about browser fingerprinting, which is the technology that will solve most of your problem.

Answer 6

You can use a cookie or IP address to make sure they don't vote more than one time.