In addition to the things people have already mentioned, I'd suggest combining all of them, and more, into a credibility score. If your application doesn't invo

In addition to the things people have already mentioned, I'd suggest combining all of them, and more, into a credibility score. If your application doesn't involve a strict tallying/reporting of votes, they you can use the score to do weighting, otherwise, you'd use it to discard votes below a certain threshold. For the JavaScript fingerprinting, I wonder if there are ways to probe for bugs that characterize different browser versions both for a richer fingerprint and to detect spoofing of the useragent. Other things that can fit into a credibility score: B computational JavaScript payload to impose more costs on automated abusers. Elapsed time between when the voting form was returned, and when the vote was submitted. On the IP front, keep in mind the ability to correlate not just IP, but also netblock.