Re: Off-topic concerning a web vote debacle

It wouldn't, but at least it wouldn't be as easy as clearing out the 
cookies and voting again.

It's an interesting problem. The only obviously working alternative I know 
of atm is a pure IP-based lock. This will, however, accidentally lock out 
people who shared that IP (ie big organizations with NAT, long term 
surveys answered by people on dialup with dynamic IP allocation...). To 
break that, an attacker would have to go as far as IP spoofing, which is 
beyond what a script kiddie could manage.

Which means that the only alternative for unknown population voting 
currently are to either have voting with some kind of authentication (ie 
register with valid mail adress), accept being flooded by duplicates, or 
accept losing out on people accidentally being locked out.

Suggestions for better protection schemes are welcome. :-)

   // Joel


On Mon, 17 Mar 2008, Florian Hars wrote:

> Joel Palmius schrieb:
>> However to avoid scripted attacks, a server-side key would be
>> stored (a hash based on the combination of browser string and and the IP
>> number)
>
> How does that help against
>
> for i in $(seq 1000 2000); do
>  for j in $(seq 4000 5000); do
>    wget --user-agent="Mozilla/4.0 (compatible; MSIE 7.0; TOB 6.05; Windows NT 5.1; .NET CLR 2.0.4$i; .NET CLR 3.0.0$j.30; .NET CLR 1.1.4322)" \
>         --post-data=whatever http://example.com/survey/whatever
>  done
> done
>
> - Florian
> Skickat av Florian Hars <[email protected]>
> till survey-discussion
>
Skickat av Joel Palmius <[email protected]>
till survey-discussion