Prevent multiple registrations on a survey website

Question

Context

I am developing a survey website where anyone can vote once. Obviously I have to prevent multiple registrations for the survey to remain relevant. I force every user to login with their Google, Facebook or Twitter account. But they can authenticate 3 times if they have an account on each, or authenticate with multiple accounts on the same platform (I have 3 accounts on Google). So I thought to store their IP address, but they can still use a proxy. I could keep the HTTP User Agent with PHP's get_browser(), although they can still change browsers. I can extract the OS with a regex, to change OS is less easier than browsers. And there is also geolocation, for example with the Google Map API.

Questions

• How to prevent multiple registrations? What kind of test can be done?
• How to embed these tests? Execute in what order?
• Have you already deploy this kind of solution?

Anent

Similar: #8099888 – Ligament

Pitfalls: IP Address can limit a house hold to just one registration – Ligament

Although its nearly impossible to prevent a determined individual from spoiling your survey, you can still make it moderately difficult for them to do so. You'll filter out alot of the rif-raf by applying all of the techniques you've mentioned. Also consider using cookies to mark a computer as "already voted". PHP, Javascript, and Flash all afford this. Few people know how to remove flash cookies, so they may be particularly appropriate. Note however that sometimes an entire family will use the same computer, thereby turning away valid voters. – Overtrump

Answer 1

You can verify user by mobile phone, by sending text message with some code to it. This will limit votes count to count of mobile phone numbers owned by user.

Ringworm

I don't know one. But idea is simple: find SMS gateway (there are many of them in the net), ask user for phone number, send SMS with code to that number, ask user to enter the code. – Ringworm

The problem is that the process is a bit long. The user comes on the site just to vote, and is obliged to login with Facebook & co, then give her phone number, then wait for the sms, then enter the code, to finally be able to vote. I am curious to know the percentage loss of visitors with this method. – Anent

Answer 2

The only way to be absolutely sure is to use something that uniquely identifies a person such as a serial number (social security number) or a hardware identifier (RSA key). The next best thing is to require a credit card as that usually identifies the first and last name. All other attempts can be easily broken (ie 2 phase authentication with a phone number, geolocation, etc). Headers sent be the browser can be easily spoofed (geolocation, IP address, user agent are all headers), and as you mentioned it's very easy to create multiple Google/Twitter accounts.

Putnem

Buying multiple hardware identifiers is easy too, and validating SSNs is hard. – Kaja

Yes, unless you issue the hardware identifiers and track them to each user. I agree it's usually not the approach you want to take. – Putnem

Answer 3

Those tests you mention can help prevent some users from registering multiple times, but a determined user will be able to circumvent these measures if they really want.

They can create multiple accounts with Google, FB, or Twitter, spoof their user agent easily with browser plugins, as you said, hide behind large amounts of proxies which also defeat geolocation.

One other thing you could do is add proxy detection, and try to prevent registration/voting if you think they are behind a proxy.

Kif

Answer 4

How about requiring a valid email address from domains (or TLD's, such as .gov?) that only grant one email address per physical person?

Just making a suggestion here, it might not be feasible if you must literally allow anyone to vote.

Deadlock

Answer 5

Most likely you will have to make some compromise. Making 100% certain that your users are different people will be nearly impossible. One reasonable approach is to use a service like Twilio and require your users provide a unique phone number that your site can confirm with a simple phone call.

You will probably also want to make it inconvenient to use multiple accounts. In your case, you could use a captcha in your voting process so that the votes can't be entered by an automated system. This way, even if somebody has 10 or 50 phone numbers, they have to put forth significant effort to alter your results meaningfully.

Bradleybradly

Answer 6

First off you need to somehow uniquely identify the user. Some things you've mentioned are:

1. Email addresses
2. IP addresses
3. HTTP User Agent

All of the above are easy to spoof:

1. One can create several mail accounts
2. Proxies. Someone purposed to try to find out if a person is behind a proxy but you wont find the users with elite proxies that are available. Another problem is that there may be several users sharing a single IP.
3. User agents information can be altered

Something that uniquely identifies the user is the SSN. The problem is that it can somewhat easily be faked since there are several generators on the net.

The problem is that it's really really hard to verify that's a person really is the person he or she claims to be. The solution would be to make it as hard as possible for the user to make several votes (if it's not crucial to be a single vote).

This can be solved by using for example verification by SMS. It's kind of hard / inconvenient for the user to get by several phone numbers to use.

Graduation

Answer 7

I would start by allowing only one email to be registered on the website.

Then you should maybe look at allowing votes once from each IP. This may not be viable as its obviously going to block potential voters behind routers.

You could check the User-Agents of each voter to try and find discrepancies.

Anything unique to a user should essentially be checked, although you may not be able to fully validate a user server side.

As already suggested using phone numbers is also another way of reducing spam voters.

Bochum

Answer 8

Requiring users to telesignin to an account seems to be a pretty common way to prevent bulk registrations. There are a few companies that provide these services.

Ketchan