Is it feasible to authenticate users such that they should be prevented from creating multiple accounts, and that their privacy is not impaired (i.e., no personal information should be revealed to the application).

I'm thinking client-side biometric authentication with hashing? I think biometric authentication might scare away users, though, even if it's all done at their end. The application involves voting, so I need to prevent ballot stuffing through fake accounts. If my objective is not feasible, how close can I get, and what do I need to sacrifice?

  • If all the biometric stuff is done client-side, then how do you prevent the clients from forging a different set of biometrics?
    – Iszi
    Commented Jan 6, 2014 at 20:03
  • That is a good question, @Iszi. I do not know how, but I would be comfortable with relaxing the constraints if we could make the attack merely unlikely rather than impossible. Would it be possible to do some of the authentication on the client side and some on the server; a half-way measure? I'm open to suggestions.
    – Emre
    Commented Jan 6, 2014 at 20:09
  • No, it's not feasible. You may get some suggestions that are theoretically feasible, but on a practical level, you just cannot do this.
    – paj28
    Commented Feb 5, 2014 at 22:03

3 Answers 3


It sounds like what you really want to do IS authenticate people, then provide a method of submitting a vote which is not linked to their identity.

The whole anonymous voting crypto problem has been around for a while, and there's a lot of potential algorithms to solve it. If you get ahold of an applied crypto textbook, there's likely an example of a similar problem in it.

There is a cryptographic technique which would allow you to authenticate a user, then could provide them a token which allows them to vote anonymously. I think it involved 'blind signatures'.

EDIT: You may want to post in the crypto StackExchange site.

  • Please can you give more information for me to go on; a key paper, or algorithm name? Thanks for the suggestion to use the other site; I found this, and that. I put this project aside for the time being, but I'll keep the question open for more answers.
    – Emre
    Commented Feb 6, 2014 at 4:20

Ensuring that there's a one to one correspondence between a real human being and a user account such that said real human being cannot create another account would in fact require that you use authentication that uses information that is private to that user, and more importantly, unique to that user. You can't do it with email accounts or anything similar, because the best you can do is verify that there is somebody behind the account, you can't have any guaranteed mechanism to map email addresses to real people. You probably want to use some common authentication mechanism such as OAuth, and you want to design your system in such a way as to recognize that ballot stuffing is possible - you can make it more difficult (Google will allow people to have multiple email accounts, but people tend towards authenticating through a primary account) but you can't make it impossible AND not impair your users privacy.


If you enforce client-side biometrics and can somehow make sure that an actual fingerprint reader has to be used on the client side, and that I (as an evil user) cannot alter the behaviour of that fingerprint reader at will (despite the reader being physically in my evil clutches the whole time), then I'll just have my cat put his paw on the reader at the right time, granting me an extra vote.

So no, you cannot prevent multiple accounts with client-side biometrics.

You can block some attempts at multiple accounts through various mechanisms, which can all be worked around (and may backfire at times), but only with efforts. E.g. you can prevent multiple account registrations from the same IP address. Or you can ask for a token payment of 0.01$ from a credit card, and allow only one registration per credit card (but then, there goes anonymity).

At one point you have to ask yourself the extent of the anonymity that you want to preserve for the users. If users are completely "anonymous" then, mathematically speaking, the notion of "multiple accounts for the same user" becomes ill-defined. Anonymous users cannot be distinguished from each other, and that's kind of the whole point.

  • It would be easy to reject a cat's fingerprint.
    – Emre
    Commented Feb 6, 2014 at 4:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .