Hacker News Reader

Comment by genieyclo | Hacker News Reader

Actually, this is very easily gamed:

1. Fire up Chromium in incognito, and once you've voted once, just close it again and open it again to vote once more. Rinse and repeat.

2. The ip choice is smart, but there are ways to get a dynamic ip every [insert time interval].

One could perfect this to an art really. Get your ip to start changing, have Chromium open on a hotkey, use ctrl+shift+n to go incognito (or just have it auto-load in incognito), have the poll set as your homepage. You can clock alot of votes this way.

Logins are best.

View on HN

This reminds me of a story.

A couple years ago, some university friends and I went to an engineering competition in Ontario. It was an event spread over four or five days, and on the last night a dance was held. This information was given to the participants a couple of weeks in advance.

The DJ for the dance had set up a website to allow people to request songs from off of a giant list. Each person got five or six "votes", and the system stopped them from voting any more after that. It was a cookie-based system. (It didn't bother with IP stuff).

One of my friends ended up using the macro system on his Macbook to vote for the song he wanted until he ran out of votes, delete his cookies, refresh the page, and repeat. He ran this macro overnight for a couple of days.

By the time we got to the competition, "Never Going to Give You Up" had three or four thousand votes. There were about two hundred people attending.

If someone's willing to go to that far of an extreme to game a vote, I don't think a login system would do much to stop them either. You can just as easily create new accounts with the new IP and a fake email address.

Not really.

The difference is that with a login method, it takes significantly more effort and time. This is pretty straightforward once you have it setup.

Your're correct that it could be gamed with multiple email addresses as well. It would just take a little longer. Going to click a confirmation link, a captcha, etc.

Exactly.

How does one consistently get a new IP in [time interval smaller than creating a login takes]?

In some countries it is normal to get a new IP each time your router re-connects or even every 24 hours.

to me, the point at which someone is willing to invest the effort to do this is the point at which you're popular enough to be able to shut down voting without logging in, but you're absolutely right, this is a vulnerability.

Reply on news.ycombinator.com