I'm building a web platform that uses upvotes and downvotes on each piece of content to bring good content to the top. It's important that it's non-trivial for this voting to be rigged, and previously I've done this by only allowing one vote per content per IPv4. Obviously this is far from perfect, people can use VPNs, and multiple legitimate voters behind a LAN will only get one vote per content between them. But it's worked well enough.

My question is how do I treat IPv6 addresses to achieve the same goal, or better? My ISP doesn't give me one so it's hard to test, but it looks like a single user's IPv6 address changes very often, and it's the last 4 segments that change, and the first 4 that generally stay the same. Is it correct that the first 4 segments correspond to the modem entering the home/office, and then the last 4 segments are used to differentiate between devices below that?

If I allow one vote per unique first 4 segments, will that function about the same as my implementation before? If I allow one vote per unique 8 segments, is that one vote per unique hardware device, or is it easy to spoof/change the last 4 segments, in which case this rule could be heavily abused?

Big thanks!

  • "only allowing one vote per content per IPv4." Why are you only allowing a single vote for IPv4? If you want to achieve the same thing for IPv6, then only allow one IPv6 vote. That would give you a total of two votes, assuming someone with IPv4 votes (no other IPv4 votes are allowed) and someone with IPv6 also votes (then no other IPv6 votes are allowed). I'm not sure how this is on-topic for this site because it doesn't seem to have anything to do with "Network Engineering Stack Exchange is for asking questions about professionally managed networks in a business environment." – Ron Maupin Jun 26 at 13:25
  • Even if this worked "good enough" for IPv4, with IPv6 it is probably not going to be. If you must, I'd recommend limiting per /64 (first four segments). – Sander Steffann Jun 26 at 14:33

Not to perpetuate a bad practice, but in general, the "network" is the first 64 bits, and the "host" the last 64. However, this is only true where SLAAC is involved; it is not a fixed part of the protocol. (networks can be of any size)

No matter what you do, any "IP Counting" system can be gamed. If you count each 128-bit address, then you already know you've failed -- privacy addresses, /64 LANs, ... If you count each ::/64 prefix, then you're back to the same everybody-behind-NAT problem -- only worse, because there could be hundreds or thousands of individuals behind a single prefix. The best compromise I can think of: "one vote per device" by looking at the EUI-64 part of the address, which is built from the ethernet MAC. (but only the lazy and foolish use EUI-64 addresses on the internet -- because of the universal trackability.)

Not the answer you're looking for? Browse other questions tagged or ask your own question.