Best method to prevent gaming with anonymous voting

user_94278 0
Viewed 1947

I am about to write a voting method for my site. I want a method to stop people voting for the same thing twice. So far my thoughts have been:

  • Drop a cookie once the vote is complete (susceptible to multi browser gaming)
  • Log IP address per vote (this will fail in proxy / corporate environments)
  • Force logins

My site is not account based as such, although it aggregates Twitter data, so there is scope for using Twitter OAuth as a means of identification.

What existing systems exist and how do they do this?

voting-system voting php ajax
7 Answers

What type of gaming do you want to protect yourself against? Someone creating a couple of bots and bombing you with thousands (millions) of requests? Or someone with no better things to do and try to make 10-20 votes?

Yes, I know: both - but which one is your main concern in here?

Using CAPTCHA together with email based voting (send a link to the email to validate the vote) might work well against bots. But a human can more or less easily exploit the email system (as I comment in one answer and post here again)

I own a custom domain and I can have any email I want within it.

Another example: if your email is myuser*@gmail.com*, you could use "myuser+1@gmail.com" myuser+2@gmail.com, etc (the plus sign and the text after it are ignored and it is delivered to your account). You can also include dots in your username (my.user@gmail.com). (This only works on gmail addresses!)

To protect against humans, I don't know ever-cookie but it might be a good choice. Using OAuth integrated with twitter, FB and other networks might also work well.

Also, remember: requiring emails for someone to vote will scare many people off! You will get many less votes!

Another option is to limit the number of votes your system accepts from each ip per minute (or hour or anything else). To protect against distributed attacks, limit the total number of votes your system accepts within a timeframe.

user_3720760

If you don't want force users to log, consider this evercookie, but force java script to enable logging!

This evercookie is trivial to block because it is java script based. The attacker would not likely use browser, with curl he could generate tousends of requests. Hovewer such tools have usually poor javascript support.

Mail is even easier to cheat. When you run your own server, you can accept all email addresses, so you will have practically unlimited pool of addresses to use.

user_5550530
Related