When I say general case, I mean random person creates an account or two to upvote their own stuff. This is usually trivial to detect if you save a single cookie

When I say general case, I mean random person creates an account or two to upvote their own stuff. This is usually trivial to detect if you save a single cookie that's linked to each account, even easier if you are also using more tenacious tracking like flash cookies or localstorage or the dreaded evercookie. In the less general case, you can still determine that a particular group of accounts never take action in the same small time windows. The way I've approached this problem in the past relies heavily on meta data about the user. It's easy to determine if an IP is a proxy/VPN, which should immediately make a client more suspicious (when you're already suspicious about fraudulent voting). Initially, account ages are important but if someone is able to get away with it for a long time, they can get complacent and keep using the same accounts, and at that point you can look at things like upvote/downvote ratios (or generally the lack of diversity in voting activity) compared to some expected average activity. There's a lot of other tricks, but I don't know what your approach has been when working on this, and I know HN is a much different platform from what I worked with :P