Is it a good idea to save user IP for a day to prevent multiple submissions?

Question

I am creating a rate/review website similar to ratemyprofessors.com which allows you to submit ratings without logging in. Does anyone know what kind of spam prevention techniques they use in order to prevent a user from submitting multiple ratings for the same professor? I think they associate your IP address with the professor id and store it in the database for a day or two. Thanks in advance!

Answer 1

Checking whether a user has already submitted a rating by checking her IP is bound to fail. First, you don't know when a user might have her IP changed by her ISP. If someone is using a 3G/4G enabled smartphone while walking around wifi hotsposts, they might get new IP's, from different ISP's, by the minute. Without ever knowing it.

Second, if someone really wants to cheat your system, there is always a plethora of ways, ranging from simly renewing DHCP when getting access via DSL to malicious things like IP spoofing.

You can't be sure even if you save information on their machines (like cookies) either, because it's easy enough to delete that.

As long as the users are not authenticated, you can't ever make sure someone is not rating a professor more than once a day. Either accept that or force people to authenticate.

Alternatively, if your main concern is not identifying people (so the professors can't get back at those who rate them poorly), you could email/SMS codes to the students. Each code would allow someone to make one ranting, I mean, rating with it. But it's cumbersome and annoying to the end user if they have to get a new link everyday. Maybe if they could get the link in an intranet/authenticated area of a site, while the link takes them to an anonymous area, then you could have anonymous rant... er, rating. This is a conciliatory solution - they have to log in somewhere, but their anonymousity is preserved while rating.