0

There is a site that allows a voter to vote for their favorite nominee once a day for a certain amount of days. While entering a vote, the only info given is the ballot choice you choose and nothing else.

If you are to go back and vote again, there is a message saying "please wait until next day to vote again". However if you just simply use a different internet browser you can enter another ballot.

I'm wondering what they are using to identify the voter through the browser and if they can tell when a single voter is entering multiple votes through different browsers. Also is there an even more simple/easier way that a voter could be doing this without having to use multiple browsers?

5
  • 2
    Probably cookies. Try an incognito window or clear the cookie for the site to confirm.
    – schroeder
    May 11 at 10:51
  • "if they can tell when a single voter is entering multiple votes through different browsers" the IP address helps detect this, even if (CG)NAT means that there will be some false positives. May 11 at 11:44
  • @CodesInChaos If the voters are mostly expected to be from the same locality, I'd expect CGNAT to create lots of false positives.
    – nobody
    May 11 at 11:52
  • Regarding use of the same browser (but not only), you might be interested in EFF's Panopticlick project: coveryourtracks.eff.org/static/browser-uniqueness.pdf
    – LSerni
    May 11 at 16:02
  • This project github.com/jonasstrehle/supercookie allow you to identifie a browser. It is working even if you restart your OS or use a VPN. Using favicons, to recognise you by the get request your browser will do to multiple domains loading new favicons.
    – molik
    May 12 at 10:03
1

Yes after clearing the browser data (history, site data, cookies, cache...etc.) it is possible to enter another vote.

2
  • Without a serious authentication scheme, it is not possible to securely identify somebody. A cookie is a simple way to identify a browser, as long as the cookie is not cleared. And you should be aware that it is possible (for example using Python code) to fake a browser, send some GET and PUT request to enter a vote and forget any cookie. That way you can start again the program every nth minute to enter a new vote. It can be detected through heuristics on the delays between action, and the counter measure is to precisely add randomized delays... May 11 at 12:02
  • ... Long story made short: a cookie is a simple but not a reliable way. May 11 at 12:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.