News for hackers. Stuff that matters.
Re:Ask HN: Can you make a voting/rating system without logins? by genieyclo on Saturday October 31, 2009 @03:55PM (#913966)
Actually, this is very easily gamed:

1. Fire up Chromium in incognito, and once you've voted once, just close it again and open it again to vote once more. Rinse and repeat.

2. The ip choice is smart, but there are ways to get a dynamic ip every [insert time interval].

One could perfect this to an art really. Get your ip to start changing, have Chromium open on a hotkey, use ctrl+shift+n to go incognito (or just have it auto-load in incognito), have the poll set as your homepage. You can clock alot of votes this way.

Logins are best.

Re:Ask HN: Can you make a voting/rating system without logins? by gloob on Saturday October 31, 2009 @04:23PM (#914018)
This reminds me of a story.

A couple years ago, some university friends and I went to an engineering competition in Ontario. It was an event spread over four or five days, and on the last night a dance was held. This information was given to the participants a couple of weeks in advance.

The DJ for the dance had set up a website to allow people to request songs from off of a giant list. Each person got five or six "votes", and the system stopped them from voting any more after that. It was a cookie-based system. (It didn't bother with IP stuff).

One of my friends ended up using the macro system on his Macbook to vote for the song he wanted until he ran out of votes, delete his cookies, refresh the page, and repeat. He ran this macro overnight for a couple of days.

By the time we got to the competition, "Never Going to Give You Up" had three or four thousand votes. There were about two hundred people attending.

Re:Ask HN: Can you make a voting/rating system without logins? by Zev on Saturday October 31, 2009 @04:01PM (#913973)
One could perfect this to an art really. Get your ip to start changing, have Chromium open on a hotkey, use ctrl+shift+n to go incognito (or just have it auto-load in incognito), have the poll set as your homepage. You can clock alot of votes this way.

If someone's willing to go to that far of an extreme to game a vote, I don't think a login system would do much to stop them either. You can just as easily create new accounts with the new IP and a fake email address.

Re:Ask HN: Can you make a voting/rating system without logins? by barmstrong on Saturday October 31, 2009 @06:18PM (#914240)
Your're correct that it could be gamed with multiple email addresses as well. It would just take a little longer. Going to click a confirmation link, a captcha, etc.
Re:Ask HN: Can you make a voting/rating system without logins? by genieyclo on Saturday October 31, 2009 @06:24PM (#914256)
Exactly.
Re:Ask HN: Can you make a voting/rating system without logins? by genieyclo on Saturday October 31, 2009 @04:03PM (#913978)
Not really.

The difference is that with a login method, it takes significantly more effort and time. This is pretty straightforward once you have it setup.

Re:Ask HN: Can you make a voting/rating system without logins? by tedunangst on Saturday October 31, 2009 @04:27PM (#914025)
How does one consistently get a new IP in [time interval smaller than creating a login takes]?
Re:Ask HN: Can you make a voting/rating system without logins? by aw3c2 on Saturday October 31, 2009 @04:34PM (#914040)
In some countries it is normal to get a new IP each time your router re-connects or even every 24 hours.
Re:Ask HN: Can you make a voting/rating system without logins? by kapauldo on Saturday October 31, 2009 @08:32PM (#914435)
to me, the point at which someone is willing to invest the effort to do this is the point at which you're popular enough to be able to shut down voting without logging in, but you're absolutely right, this is a vulnerability.