bbs.spamgourmet.com

Isn't it easy to check the username when spamgourmet is involved?

The email address is not a good thing to depend on to check for cheating, I'd be checking the IP (as others mentioned) and stats on how many entries share the winner's postal code or same street (and check the address is valid) and take the phone number too if posible.

One of my ISP's mail server (IMAIL) features allows you to include a mail folder name in the email address (normally using a dash)

eg

myaccount-mailbox@mailserver

Set the account to forward all messages and they even end up in the same folder, so much like spamgoumet you end up with almost unlimited, instantly creatable "unique" email address.

So he'd need to block email addresses with hyphens in it (or to be really effective any other punctuation characters too

One think I won't do is enter a competition which rejects an anti-spam address as I'd assume they were intent on spaming.

No single piece of information is sufficient, but the more information which is collected the more work there is involved in sifting out any cheaters.

IP addresses add minimal value, especially if many people share one access link. Additionally, one would expect most participants to have temporary addresses (either from a dial-up connection or a DSL connection). Few carriers hand out permanent addresses to their subscribers. So a duplicate IP address at the same address might mean little, duplicate IP addresses at different street addresses means nothing, and different IP addresses at the same street address means nothing. I wouldn't bother to collect IP addresses unless I wanted to pass information along to law enforcement under certain circumstances (in which case I'd also need a precise timestamp).

IP address is potentially useful, provided that that duplicates are examined by an intelligent person and not some automated system.

Relevant questions may be:
- What similarities are there between entries from the same IP address? In particular, not just the personal details but are they clustered in time?
- Does the IP address resolve to a DNS name which suggests that it is a multi-subscriber proxy?

It's not a magic wand, but the more information the easier it becomes. It's a little work, but as others have said, you only need to do it for the winning entry.

----

Of course the other thing is to add a deterrent by saying in the terms and conditions: "One entry per person. Multiple entries will be disqualified. Please note that dishonest circumvention of this rule (e.g. deliberately entering with multiple email addresses) may constitute fraud, and any evidence of this may be passed to law enforcement agencies." (The key of course is "dishonest" / "deliberate". Now of course, accidental multiple entries are possible. For example, I might repeatedly visit a website with competitions listings, and forget which ones I've already entered -- particularly as the competition questions are not normally demanding enough to be particularly memorable! I'd probably even use different spamgourmet addresses, because I have a little script which generates them based on the current time, to guarantee unique addresses. Would I be worried about being falsely accused of fraud? No, not really -- it would be relatively easy to spot the difference between that kind of thing and deliberate fraud: in this example it would be at the most a handful of entries, and the mailing addresses would not be tinkered with.)

Use the challenge-response and make very clear the response needs to be seen before the system accepts the entry. Send back a confirmation after the response has been received saying "you are officially entered".

In these days of universal email, everyone is familiar with the concept of forged addresses and challenges to confirm an address are well accepted.

You can check for multiple entries by looking at the spamgourmet account name: x.y.user@spamgourmet.com - I.e. the user field.

The fact that users can create multiple hotmail accounts or multiple accounts using their own domain isn't really a consideration though since most users either aren't going to want to go through such a bother or aren't technically savy enough to set themselves up that way.

As long as the seb site accepting the entry indicates that the email address could not be accepted and to use another, while it would be annoying and bothersome, it wouldn't be so bad.