In web communities where voting on an item is an essential feature, the vote result could be easily biased by one single user if she register many accounts and vote. What approaches can mitigate sockpuppeting?

I write the software from scratch and have total control on the feature set.

(This is a general question asking for system designs that prevents a single person casting multiple votes by faking multiple account).

You can do a few things to mitigate against users creating multiple logins to skew the voting. None will prevent it completely but will go a long way to reduce vote fraud.

  1. Disallow signups from throwaway e-mail domains like mailinator etc. People will have to use "real" e-mails to sign up with. You will need to keep the list of banned domains up-to-date as new services come online.
  2. Require that voting accounts are verified by sending out an e-mail. This will also discourage people from using throwaway e-mail addresses.
  3. Strip out modifiers from e-mail addresses when checking if they've already been used. For example GMail allows you to create addresses of the form:

    user+modifer@gmail.com

    Strip out the "+modifier" and they won't be able to use their GMail address more than once. Obviously you need to keep the full address the user entered as they're probably using the "+modifier" to filter their e-mails.

  4. Require that the user participate in some way, posting content etc. before they can vote. While this isn't foolproof it does require that the putative puppet master has to run several accounts as though they were real accounts. Few people are going to be that determined.

Even with these ideas in place you're still going to get people who want to game the system. As a fail-safe make sure you have a mechanism that can remove the fraudulent votes. Either make sure the votes are removed when accounts are deleted or have a manual "remove votes" option in your admin pages. Again it won't stop the most determined puppet master, but will help reduce the problems they cause.

The only real way to solve the problem is to filter the users who are allowed to vote. You need to be honest with your community and say that you are not interested in opinions of unestablished users. There are many reasons that might make you think this way, for example, but not limited to:

  1. People who just pass by are likely to leave soon and not be affected by the decision they are supporting.
  2. New users may not understand the scope of the problem being discussed, even if they have all good intentions (that was the reason of me not voting in the last moderator elections of RPG.SE).
  3. Allowing new users to vote promotes sockpuppeting.

So, you need to choose a method to filter the users. Some methods are usually just bad and ineffective, for example:

  1. Allowing only one vote per IP allows people with dynamic IP vote more than once, while people who share IP for whatever reason cannot share their possibly different opinions.
  2. Only allowing votes from accounts that are at least N days old. It does not protect you from prepared attacks (one could carefully register a lot of sockpuppet accounts that you won't notice until the D-day). It also does not really distinguish an active user who is just kinda new to the scene, but very active, and someone who has just registered sometime ago, forgot about their account and remembered about it yesterday. This method can be valid sometimes, but clearly not on its own.
  3. Amount of posts they have created. It encourages spam.

They might not be inherently bad, but from my experience in various communities they usually don't work and do way more harm than good.

Methods that work if implemented well:

  1. Accepting votes only from people who have shared their personal information like real name and a photo: it is hard to fake real-life identities. This also helps if they lose their password and e-mail: they would be able to show you a filled password restoration paper with a real ID attached to prove the ownership of the account. Note that you are not allowed to do it in some jurisdictions! Beware the law!
  2. Accepting votes only from people who have been manually selected as trustworthy. That might sound mean, but this really, really works.
  3. Only accepting votes if you write a comment explaining why do you think this way. Takes more effort than voting, and you will be able to find sockpuppets by similar writing style, similar mistakes etc.
  4. Only accepting votes from people who have measurably contributed to community in some way. For example, StackExchange network uses reputation for that, and it works -- I would increase the thresholds, though, it takes too low amount of rep to be able to vote. One popular Russian IT web-site makes you contribute at least one well-received article for your opinion to count.
  5. Only accepting votes from people that were invited by other established users.
  6. Disclosing names of every voter. This way it might be easier to find out the sockpuppeting.
  7. Make a bot that will automatically find and notify you of strange patterns in users' behaviour: same IP, similar activity hours, same machine (you can use cookies to find that out), using different IPs under the same machine, with a different IP for different account, etc. Manually recheck those cases, and apply measures that you need.

Those are some of the ways you can use.

Proactively: bind the registration to something that your users cannot easily replicate. Instead of using an e-mail, use a phone number to confirm registrations. Or if you are really serious verify registration using a digital signature (whose certificate signed by an authority trusted by you).

Reactively: monitor all activity your users do. Including all page views, posting and voting activity. And have a heuristics to determine if the activity is legit. A normal user would browse the site, make posts, vote on many posts. While a sockpuppet would go straight to the desired post and vote it. You should silently roll back the votes that trigger your heuristics.

The most effective way to mitigate sockpuppeting would be to make registering multiple accounts more difficult - require captcha, track IP addresses and sessions. In most cases trespassers would be quite easy to block.

  • 1
    How would you address people sharing an IP address (say, a corporate proxy)? – Monica Cellio Jan 17 at 22:40

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.