Public votes and avoiding mutliple vote: using cookies or IP?

Question

How do you handle public vote (anyone can "like or dislike" an article) and to restrict him to vote only one time?

Have I to use cookies? (with the problem that he can remove the cookie and vote x999 times) or I store his IP in database?

score 2 · Accepted Answer · answered May 25 '11 at 01:29

The solution has three parts:

use a cookie to prevent double votes
store all vote events in the database (ip, user agent, poll/article id, vote)
implement an algorithm which will run every 24h to delete the double votes which escaped from #1. The algo will use data from #2

Using only the IP is not appropriate as it can leave tons of people out of the voting system.

score 1 · Answer 2 · answered May 25 '11 at 01:24

1

Use the IP.

While you may cause a bunch of people from only voting once from behind one IP, the alternative is trivial to bypass (don't store cookies).

answered May 25 '11 at 01:24

alex

479,566
201
878
984

score 0 · Answer 3 · answered May 25 '11 at 01:24

0

I'd say do both so that if there are people with dynamic IP they will have to change IP and delete cookies at the exact same time.

answered May 25 '11 at 01:24

Sword22

266
3
15

2

You can essentially remove a whole group of people who use proxies. They all come from the same ip. Or am I wrong? – John May 25 '11 at 01:25
1

Well that's the drawback of IP limitations. – Sword22 May 25 '11 at 01:27
@John, not if you use the combination of both IP/cookie to create a *user*. – Jason McCreary May 25 '11 at 01:28

score 0 · Answer 4 · answered May 25 '11 at 01:24

0

If the user authenticates, ie they vote as themselves, throw a record in the database saying the user has already voted. For anonymous voters you are limited to cookies, local storage, ect.

answered May 25 '11 at 01:24

John

1,530
1
10
19

score 0 · Answer 5 · answered May 25 '11 at 01:28

0

Instead of cookies could use evercookie, which is much harder (but still possible) to bypass.

evercookie is a javascript API available that produces extremely persistent cookies in a browser. Its goal is to identify a client even after they've removed standard cookies, Flash cookies (Local Shared Objects or LSOs), and others.

answered May 25 '11 at 01:28

Philip

4,128
5
31
49

2

I'd never use this in my website since I respect my visitors. – cherouvim May 25 '11 at 01:34
Me neither, but it is an option the OP could use. Also, as awareness about evercookie spreads hopefully there will be more options for easily deleting them. – Philip May 25 '11 at 01:36
but big site like facebook doesnt care about your privacy – Unitech May 26 '11 at 15:53

Public votes and avoiding mutliple vote: using cookies or IP?

5 Answers5

Linked