7

We have youtube kind of website where we calculate rating for every video. Based on rating we award cash. Our problem is no same user can rate a video more than once. We thought if we keep track of static IP, we will be able to achieve this but we found there are third party tools that can be used to manipulate the IP and break this.

Note: We thought about only signed in customers can rate the video but client asks that even guest should be able to rate the video.

Do we have any other method to track this so that they a user cannot rate more than once?

Improve this question

4 Answers 4

Reset to default
12

Simply: No.

As you found out already, IP can be faked. And in many cases the IP is not even static to begin with. Many service providers give you a new IP out of a pool each time you login.

There is the MAC address, which is unique to the network interface card. It's more difficult to fake, but not impossible. So not much help.

Setting a cookie. People will find out and simply delete them. No help.

And the moment you award money, it's nearly 100% sure that somebody will try to cheat. Even a login is not much help, as long as you can't prevent people from creating multiple accounts (And write bots to use those accounts to rate the videos)

Keep in mind, that in the worst case scenario, where enough money is involved to make a few days of work worth the effort, any programmer can take some open source libraries and write a browser like application that can send you mostly any kind of data he likes and fake being IE, Firefox, Safari or Chrome on any OS he likes your server to believe it comes from.

The only thing I could think of that would maybe work is to bring in some credit card validity check, like some sites do to make sure users are of full age. This would give you a unique ID of some kind which is more difficult to get around. Though it would be quite some effort and I don't know exactly how high are any additional costs for payment providers offering this kind of service. And of course it would keep most people from voting, since not many people like the idea to provide their credit card information, especially if your site isn't very well known.

Improve this answer
1
  • 1
    You don't even need to write any code for cheating - usually, a bit of shell script around curl is all it takes.
    – tdammers
    Commented Jul 19, 2011 at 9:33
7

A reasonable strategy is probably to store a "fingerprint" of data that you have about the user, and allow anyone to rate videos but:

  • Weigh the votes of anonymous users less heavily than the votes of members when aggregating the mean score.
  • Exclude votes that look "gamed", like large numbers of anonymous votes from the same subnet, anonymous votes that went direct to the voting page, etc.
  • Don't update statistics in realtime to let the users see the impact of their votes.

The "fingerprint" can include a cookie, IP address, browser user-agent string, time of vote, number of page views on the site with the same cookie before the vote (and after, if you're more ambitious). Users who come only to vote and aren't really involved in the rest of the site may have a higher probability of being there to game the vote. An anonymous cookie might be deleted by an user trying to game the site, but the IP address and user agent and a time span may be enough to get a feel for how "real" the user is. When an anonymous user signs in, you can convert the anonymous vote to a "real" vote. All of these mechanisms can be foiled, but if you weigh the votes from relatively uninvolved members of your community lower, this won't hurt so much.

All of your efforts will have to be probabilistic; there's no reliable way to perfectly eliminate gaming. You won't get the results perfectly accurate, but this is fine as long as the client understands the risks of gaming and potential inaccuracies. Fortunately, online polling is almost never scientific, and most customers will intuitively understand this once you explain this. In some cases, the gaming is useful anyway, because it'll generate traffic and interest; some customers may have very little concern about the quality of the poll.

What you're after here is mitigation, not perfection. Every online poll has the problem you are describing, especially if they allow anonymous votes.

There's a sort of polling equivalent to the "hellban", which is that you can appear to accept the vote from the user's perspective, but silently throw it away.

Improve this answer
2

The best method is making users have accounts in order to vote. Your other options are tracking IP's, cookies, mac address and adding captcha. All of these methods can be faked but the more of them you implement the more accurate your voting results are likely to be. You are never going to eliminate duplicate voting altogether but you can make it really expensive.

Personally I would filter based on IP, regular and flash cookies. It would be relatively cheap and easy to implement. The next option is to begin filtering votes based on user patterns things such as other pages visited, votes cast, user agents and anything else you can find out or track from the user. This can get really complex and expensive in a hurry.

I would also inform the client of the limitations of filters without making user accounts.

Improve this answer
0

You can try to access the History of the Browser and store a hashcode from this. Difficult to fake and the probability that its unique is very high. Couple that with captchas that you have to fill in before you vote and it gets difficult to bot this...

ah and use autocaptcha, not some homebrewn captcha solution, that is impossible to read.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.