Counting anonymous votes accurately

Question

I'm building a small application that highly depends on anonymous user voting on some sort of items. It's so small that requiring registration would be tedious and could not be justified.

Anyway, I did some research on this, including a search here on stackoverflow (http://stackoverflow.com/search?q=anonymous+votes), and doesn't seem that there's a satisfying answer.

My question is: are there any security measures that I can apply to prevent gaming anonymous votes?

One thing comes to mind is CAPTCHA, but I'd like to avoid that since users will vote on multiple items in a very short period of time, and CAPTCHAs will just annoy them.

Another thing I thought of is limiting the number of votes per minutes from a single IP (in addition to a cookie), but not sure how this is going to work.

Any thoughts?

Answer 1

You can use the CAPTCHA once to both confirm the vote and create a session with the IP and cookie.

Answer 2

There are a few ways I've seen work:

• Email registration : you get their email, they need to confirm their vote. The combination of their IP + email makes a unique record that they can't then use to vote again (for the same poll).
• Captcha : without having additional checks (IP, etc), it's easy enough for a team of monkeys to successfully enter a lot of captchas.
• Site Registration : without account creation level limits (e.g. a non-free email account required for signing up) people can just create multiple accounts.

Depending on how you weigh up the cost of getting users to vote vs making sure their votes are for them and them alone, you can use a different level of vote-spam-protection.

Answer 3

Any time you are dealing with anonymous voting you are going to have an imperfect solution but you can shoot for "pretty good". Consider dropping a cookie on the client computer to prevent multiple/frequent voting and back this up by performing server side IP tracking to do the same. Do not allow anyone to vote that has cookies blocked.

Of course, if you require complete accuracy or if the voting involves awarding of something of monetary value, registration is really the way to go.