How can an internet contest verify unique votes with only an email as an input parameter?

Question

For my computer security course we are brainstorming different ways to use attributes for a unique user (that are readily available over a network) to prevent various mischievous activities. We've already investigated clustering email attributes to help reduce spam and possibly locate botnets, along with some other things. We were asked about validating unique votes for internet contests today, and I'm really stumped. Here are the conditions:

A website is running a week-long contest where users are allowed to vote once per day. There are no accounts or logins necessary to vote, all you need to supply is a valid email address. No verification emails are sent. What can you do to maintain the integrity of the contest?

-I was thinking about tracking IPs, but many computers can be a part of a single network. Is there anything more specific than an IP that is unique to each computer, that is also accessible over a network?

-Also, how can you stop people from entering multiple valid personal email addresses (for example, I have a spam email address that I give out at stores, a university email address, and then an old one I don't use, but they are all valid!).

-Could the contest be illegitimately won by someone who is IP spoofing?

I've seen some similar questions asked on here, but they all contain very complex procedures to minimize cheating. This one is very simple, and there are obviously many holes present.

Answer 1

I was thinking about tracking IPs, but many computers can be a part of a single network. Is there anything more specific than an IP that is unique to each computer, that is also accessible over a network?

The first thought that comes to mind will be making use of cookies to track the users. Of course, that can be easily removed. Perhaps something like the evercookie? Hmm.

Also, how can you stop people from entering multiple valid personal email addresses (for example, I have a spam email address that I give out at stores, a university email address, and then an old one I don't use, but they are all valid!).

Without tying the email address to something else, this is quite impossible. A possible thought that comes to mind would be invalidating any email address submitted through a computer with a previously used IP address or cookie. This isn't impossible to evade but it might deter the less tech-savvy or determined cheats.

Could the contest be illegitimately won by someone who is IP spoofing?

It depends on the scale of the contest, but most likely yes. Another possible scenario would be using botnets to game your contest.

What are some of the other possible measures you can take?

Does your contest involve a physical prize? If so, physical addresses might be quite a good way to weed out cheats. It's far easier to come up with 15 different valid email addresses than physical addresses eh?

How valuable is your prize? How far would the cheat be willing to go to game your contest? Obviously the measure you will want to implement depends on the value of the prize in question.

In your scenario,

A website is running a week-long contest where users are allowed to vote once per day. There are no accounts or logins necessary to vote, all you need to supply is a valid email address.

It doesn't appear that there is much you can do to stop a determined cheat.

Answer 2

• Like you mentioned in your question people tend to have multiple valid web identities. It becomes very difficult for a website to identify if multiple identities belong to the same person.

• you can't really do much to stop people from registering more than once with the conditions that you have.

There are no accounts or logins necessary to vote, all you need to supply is a valid email address. No verification emails are sent.

• For avoiding multiple entries the registration needs to take more than one parameter from the user e.g. mobile number or may be make them fill a registration form. these parameters must be validated by sending an SMS or e-mail.
• I do not recommend adding this level of complexity to an online contest as this will result in low number of registrations.
• One commonly used approach that I have seen is you make people register by sending a text message and they are supposed to bring the cellphone while claiming the prize. Even this can result in multiple registrations by a user but things will be much more under control compared to the online registrations

Answer 3

This approach doesn't stop botnets.

If I own a botnet of 100k machines I can forge 100k votes by having each machine search look for a Reply-To address in the configuration files for Outlook and other mail programs. I then have each machine submit one vote with the email address that it finds.

This is cheating but it looks legit to you because each vote is really coming from a different machine and the email address really is associated with the user of that machine.

Answer 4

You could connect human effort to each e-mail address - I'm thinking of a variation on an "account", but not one that the voting person is aware of. Like connecting a reading-comprehension question to being able to submit a vote.

Have users submit a question with 4 possible answers, of which only 1 is correct. Your vote is registered only if you correctly answer someone else's question. Something like a peer review. (Of course you'd need a system to prevent people from posting questions that no one can get the right answer, so perhaps some guide-lines and a progressive development of the use of submitted questions? Say, over 1 week your votes get divided by 7*number correct answers, but you discard question/answer sets, that statistically very little people answered correctly...)

As far as I know semantic analysis by an AI doesn't yield good results en-masse.

Like the Stack-Exchange Network with it's reputation. A bot will not likely gain reputation. But that's assuming an Account, which your scenario doesn't allow.