I'm hosting an online singing competition that's at the finale 2 contestants with a cash prize over $10,000 plus a duet with a well known artist in that genera. What we found was that 2 of the finale 4 contestants found a way at to multiply their votes dramatically on the semi finale round. They where between 15k-20k votes while the other 2 barely pushed passed 3K votes. Needless to say I warned them they continued and are no longer in the contest. This is the first year doing this contest and were looking to incorporate stronger security measures been that the prizes will be higher every year. More importantly than the money we are trying to run a new platform with a good reputation. We don't want to scare people away from voting but we want to minimize the fraud.

  • 3
    And your question is... – Kenneth K. Oct 30 '17 at 23:22
  • 2
    You've told us nothing about your existing voting system or the problems with it. It's impossible to offer any advice at all until you add detail to the question. – iainpb Oct 30 '17 at 23:44
  • Probably not an ideal solution, but you could require an account to vote, disallow multiple accounts per email address, and make it one vote per account. At least then someone would have to go through the trouble of setting up an email address for each vote. Ideally, each account would have a private key (stored externally to the system) which they use to sign their vote to make sure an attacker can't change existing votes. Edit: Maybe verify accounts by sms and disallow multiple accounts per phone number? – Maybe_Factor Oct 31 '17 at 3:21
  • you could use a blockchain to authenticate votes. or a slow derivation process, ~30s of client time to vote to limit hammering. Anyone can tampermonkey a page, fewer can rip hashes with a GPU to over-vote. – dandavis Oct 31 '17 at 23:47

I'd use, in addition to standard IP limiting, recaptcha or some other proven captcha system. What they most certainly did was/or found someone who could script your voting API and just churned out votes. With a captcha, and a strong one at that, each voter would need to prove that they are at least human. Google's recaptcha is great because it heuristically decides if the user is valid and so normal people (aka people who have Google accounts..) can just click the fancy checkbox and be good in three seconds. There have been some recaptcha attacks but really they're slow and experimental.

Vote fraud is so difficult that even all the governments of the world haven't been able to solve it. Since you can't jail people for fraud you need to make it as difficult as possible to automate votes. There's really no easy answer beyond "throw a captcha at it". Maybe you have some vulnerability where they were able to modify the vote table directly? Very open ended.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.