Context
I am developing a survey website where anyone can vote once. Obviously I have to prevent multiple registrations for the survey to remain relevant. I force every user to login with their Google, Facebook or Twitter account. But they can authenticate 3 times if they have an account on each, or authenticate with multiple accounts on the same platform (I have 3 accounts on Google). So I thought to store their IP address, but they can still use a proxy. I could keep the HTTP User Agent with PHP’s get_browser(), although they can still change browsers. I can extract the OS with a regex, to change OS is less easier than browsers. And there is also geolocation, for example with the Google Map API.
Questions
- How to prevent multiple registrations? What kind of test can be done?
- How to embed these tests? Execute in what order?
- Have you already deploy this kind of solution?
You can verify user by mobile phone, by sending text message with some code to it. This will limit votes count to count of mobile phone numbers owned by user.