Implementing a voting system without requiring registration

Question

Hey everyone,

I'd like to implement a voting system on my site, without having to force them to create an account. They would ultimately be voting up/down a piece of content which has a unique ID.

• I know that I could store entries in a table with IP/ID, but what if there are more than one user coming from the same IP?
• Is there a way to uniquely identify visitors without it being tied to their external ip?
• If created a GUID, store it in a cookie on that machine, could it be retrieved later on that same computer with the same IP? A different IP?

Any thoughts on these questions, or any insight to a better approach would be greatly appreciated.

Thank you,

Answer 1

It is impossible in principle for you, using a cookie, to distinguish between a visitor who has never visited and a visitor who has visited but deleted the cookie. Consequently, any cookie-based solution will be vulnerable to trivial vote fraud.

Consider embracing this reality in the spirit of J Henry Lowengard, who, when he setup the top 100 site on WFMU back in the mid-1990s, provided a button on the "your vote has been counted" page labeled "Go Back and Vote Some More!"

In fact, go there now and vote for (or against) StackOverflow!

Answer 2

You could allow them to login using OpenId, this would allow them to use an existing account to vote and they wouldnt have to create a new account.

Google and Yahoo and others have services to allow you to authenticate users.

If you dont authenticate users in some way, the voting system would me open to abuse.

Answer 3

Yes, you could use a cookie and set the expiration very far into the future; however, there is nothing stopping anyone from clearing their cache and voting again.

Your best bet, is to use the cookie and don't allow votes from the same IP within 15 minutes of each other... without registration thats the best you can do.

Answer 4

You could identify users based on more than just their IP. For example you could include the IP + the entire request header information (such as Browser, Version Numbers, Capabilities) and hash that. That will more or less uniquely identify your user (not 100% though, unfortunately.)

Answer 5

The IP + user agent is a lot more unique than IP; not sure whether it's adequate for your purposes. If you send them a cookie, it will get returned by that computer (if they're using the same browser) as long as the cookie stays around, regardless of IP, but note that the user can get rid of the cookie whenever they want.

If you're concerned at all about using this system to prevent vote fraud, I do not believe you are not going to be able to get around making them have an account.