For instance, TIME's Person of the Year poll.

I can see that CAPTCHAs would prevent the worst abuses, but if the server just gets a bunch of POST requests, how does it decide that this one came from person A, this one came from person B?

Is it necessary to require that the user have an account on your site in order to accomplish this?


2 Answers 2


There's nothing you can do online to prevent one person to vote multiple times.

When you do a HTTP request, the website knows:

  • Your IP address. This can be spoofed easily, through the use of proxies or VPNs.
  • Some HTTP headers that are sent by your browser. They can also be spoofed.
  • All information that CSS / JavaScript / Flash / Java applets can collect are client-side, so they can be spoofed with a little bit of effort.

For example, Tor is a browser which helps people to protect their anonymity online, by providing protections enabled by default against most browser-fingerprint vectors.

A captcha won't prevent a user to vote twice. It may prevent a computer to automatically vote, but the user is very likely to be able to pass the captcha twice if it was ever able to do once.

Solutions exist if you ask the user to give some information about its physical identity, but they're not practical for online polls.


To really prevent double voting, you'd need a cryptographic approach, e.g. send every participant a key in advance or use a key they already have, like the German ID card with cryptographic functions.

However, if you'd set up such a hurdle for a regular Internet poll, nobody would participate. People don't even want that for election purposes...

As of today, you may read about Zombie Cookies (Wikipedia) which are HTTP cookies that restore their content from other sources if deleted. Evercookie is an implementation of it.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .