Question

I’m working on a web-based contest which is supposed to allow anonymous users to vote, but we want to prevent them from voting more than once. IP based limits can be bypassed with anonymous proxies, users can clear cookies, etc. It’s possible to use a Silverlight application, which would have access to isolated storage, but users can still clear that.

I don’t think it’s possible to do this without some joker voting himself up with a bot or something. Got an idea?

Answer 1

The short answer is: no. The longer answer is: but you can make it arbitrarily difficult. What I would do:

• Voting requires solving a captcha (to avoid as much as possible automated voting). To be even more effective I would recommend to have prepared multiple types of simple captchas (like ‘pick the photo with the cat’, ‘what is 2+2’, ‘type in the word’, etc) and rotate them both by the time of the day and by IP, which should make automatic systems ineffective (ie if somebody using IP A creates a bot to solve the captcha, this will become useless the next day or if s/he distributes it onto other computers/uses proxies)
• When filtering by IP you should be careful to consider situations where multiple hosts are behind one public IP (AFAIK AOL proxies all of their customers through a few IPs – so such a limitation would effectively ban AOL users). Also, many proxies send along headers pointing to the original IP (like X-Forwarded-For), so you can take a look at that too.
• Finally, using something like FSO (Flash Shared Objects – ‘Flash cookies’) is obscure enough for 99.99% of the people not to know about. Silverlight is even more obscure. To be even sneakier, you could buy an other domain and set the FSO from that domain (so, if the user is looking for FSO’s set by your domain, they won’t see any)

None of these methods is 100%, but hopefully combined they give you the level of assurance you need. If you want to take this a level higher, you need to add some kind of user registration (which can be as simple as asking a valid e-mail address when the vote occurs and sending a confirmation link to the given address and not counting the votes for which the link wasn’t clicked – so it doesn’t need to be a full-fledged ‘create an account with username / password / firs name / last name / etc’).