Prevent multiple registrations on a survey website

Question

Context

I am developing a survey website where anyone can vote once. Obviously I have to prevent multiple registrations for the survey to remain relevant. I force every user to login with their Google, Facebook or Twitter account. But they can authenticate 3 times if they have an account on each, or authenticate with multiple accounts on the same platform (I have 3 accounts on Google). So I thought to store their IP address, but they can still use a proxy. I could keep the HTTP User Agent with PHP's get_browser(), although they can still change browsers. I can extract the OS with a regex, to change OS is less easier than browsers. And there is also geolocation, for example with the Google Map API.

Questions

• How to prevent multiple registrations? What kind of test can be done?
• How to embed these tests? Execute in what order?
• Have you already deploy this kind of solution?

Answer 1

The only way to be absolutely sure is to use something that uniquely identifies a person such as a serial number (social security number) or a hardware identifier (RSA key). The next best thing is to require a credit card as that usually identifies the first and last name. All other attempts can be easily broken (ie 2 phase authentication with a phone number, geolocation, etc). Headers sent be the browser can be easily spoofed (geolocation, IP address, user agent are all headers), and as you mentioned it's very easy to create multiple Google/Twitter accounts.

Answer 2

You can verify user by mobile phone, by sending text message with some code to it. This will limit votes count to count of mobile phone numbers owned by user.

Answer 3

Those tests you mention can help prevent some users from registering multiple times, but a determined user will be able to circumvent these measures if they really want.

They can create multiple accounts with Google, FB, or Twitter, spoof their user agent easily with browser plugins, as you said, hide behind large amounts of proxies which also defeat geolocation.

One other thing you could do is add proxy detection, and try to prevent registration/voting if you think they are behind a proxy.