Limiting Form Submissions by Time

Question

This is not language specific. What are the best methods to limit how many times a person may submit a web form, not knowing any info about that person. Example: Voting for the all star game online, only allowed 1 per 24 hour cycle. Something where you don't have to "log in". My thoughts were:

• Use Captcha to keep bots at bay
• Drop a cookie that expires in 24 hours
• Check IP address if no cookie present (How many people are going to get banned because of NAT using this technique)
• Anything I'm missing?

Answer 1

Very good technique is to use Flash cookie. Many people clears cookies or uses different browsers. Flash cookies are cross-browser: they have same value across all browsers in your system, and people often doesn't know they exist.

How it works you can check here:

http://www.nuff-respec.com/technology/cross-browser-cookies-with-flash

Cookie and IP are of course also worth checking, but cookies don't block cheating, and IP blocks NAT users.

Answer 2

There is another technique which identifies you upon browser and installed plugins. See Panopticlick.

IMHO this is quite a exotic option.