Stopping users voting multiple times on a website

by

Sorry I don’t have a useful answer, I just want to share my experience.

About 8 years ago I worked for a site that ran online polls. We once got hacked by some bots voting on some of our questions several hundred votes a minute.

I had to implement some emergency checks: IP address, cookies, and I really don’t remember what else.

At the end of the day we decided to take the polls down. Those damn robots just didn’t care. IP adresses were spoofed, cookies were being deleted, etc.

If you really really need the polls to be unhackeable I don’t see any other way that requiring registration and using captchas to avoid bots signing up for new accounts.

And the sad thing is that this was just an entertainment site with polls on what’s your favorite color and things like that.

The only thing we didn’t tried was using captchas because they didn’t exist at the time. That might have reduced non-human cheating a good deal.

Don’t take this as any kind of expert advice on the matter, because that was the only time I had anything to do with online polls, but I remembered my story and wanted to share.

More Related Contents:

  1. Fundamental difference between Hashing and Encryption algorithms
  2. What is the best way to implement “remember me” for a website? [closed]
  3. Disable browser ‘Save Password’ functionality
  4. How to redirect all HTTP requests to HTTPS
  5. If you can decode JWT, how are they secure?
  6. JWT (JSON Web Token) automatic prolongation of expiration
  7. Will web browsers cache content over https
  8. Best way to handle security and avoid XSS with user entered URLs
  9. Disable firefox same origin policy
  10. SSL and man-in-the-middle misunderstanding
  11. Is it possible to reverse a SHA-1?
  12. With HTTPS, are the URL and the request headers protected as the request body is?
  13. How do you protect your software from illegal distribution? [closed]
  14. How can I throttle user login attempts in PHP
  15. Why is using a Non-Random IV with CBC Mode a vulnerability?
  16. What should every programmer know about security? [closed]
  17. Is it safe to put a jwt into the url as a query parameter of a GET request?
  18. What is happening when I have two CSP (Content Security Policies) policies – header & meta?
  19. Symfony2 extending DefaultAuthenticationSuccessHandler
  20. Username and password in https url
  21. What is the difference between a cer, pvk, and pfx file?
  22. Why do salts make dictionary attacks ‘impossible’?
  23. If you use HTTPS will your URL params will be safe from sniffing? [duplicate]
  24. md5 decoding. How they do it?
  25. What is a retpoline and how does it work?
  26. When the bots attack! [closed]
  27. Why not use MD5 for password hashing?
  28. Should I impose a maximum length on passwords?
  29. Use App Scripts to open form and make a selection
  30. How to protect against direct access to images? [closed]

Leave a Comment