In a system where I have reviews of products, to avoid fake reviews I have thought about doing the following:
- Limit one review for each account -> To bypass this measure, the user could create multiple accounts.
- Limit a browser fingerprint for each product. To bypass this measure, creating a new account will not work for the malicious user. But, then he could change the browser to get a new fingerprint.
- Limit an IP for each product's review. My question is about this step. If I limit an IP by each product, I know that companies or schools have the same static IP for a large audience, but the problem is not that. My problem is about the dynamic IPs. If a legitimate user receives a previously registered IP of the another user, then he can't create a new review. So, should I use only the first two steps? What are the real probabilities of two persons, members of this app, wanting to write a review about the same product, receiving the same IP? Is this just paranoid, or could it be a real scenario? Well, the malicious user could get a new IP easily, so this step is just really easy to bypass.
- I'm not interested in things like evercookie.
- Is there another way of tracking?