I have been following your discussion with Jane Onorati on Single Use Invitations and think I follow it. We have a similar but not identical situation and I would like to validate it and the correct approach.
We are running a photo contest. We do not care whether voters or submitters are members of our Association, anyone can enter (so we don't need passwords). We do want to limit the number of entries and have done so by setting up a Landing Page with multiple PolllUnits (one per Category) with limits.
We intend on sending out a mass email to our membership (that they are free to forward on) with a link to our PollUnit Landing Page. Is there a difference between using an invitation link and a participant link? I have seen reference to both.
We would like to prevent multiple voting for an image by each participant but can't see how to implement this if participants share a device. We would prefer not to have to force participants to register a PollUnit account.
Can a participant simply use a different device (or just clearing their cookies) to vote twice for an image?
Can a participant avoid the number of images limit by using multiple devices?
Please advise on the best solution for us.
Thanks
Doug
Hi Doug,
thank you for the detailed description. We also have an article »How to prevent multiple participation?« which you should read! But I am also happy to clarify how PollUnit works in your scenario.
What’s the Difference between a Invitation Link and a Participant Link?
- Invitation Link
- Sent to specific people.
- Can be paired with Single Use Invitations (each invitation can be used only once).
- Used when you want to control exactly who may participate.
- Participant Link
- A public link that anyone can use.
- Ideal for newsletters, websites, or social sharing.
- Perfect for public contests where everyone should be able to participate.
For your contest, you only need the public Participant Link or the Landing Page link. No invitations are required.
Preventing Multiple Votes
PollUnit offers several mechanisms in public polls. By default we use a cookie based mechanism to authenticate users. Technically savvy users can bypass cookie-based protection in anonymous polls. Using a different device also bypasses the cookie check.
On the other side the most secure mechanism is the invitation required method or using your own SSO Provider (companies often do this).
PollUnit account
I always recommend a PollUnit account. This are some of the benefits:
- Central overview of all your polls, submissions, and activities
- Edit your submissions and votes (when allowed)
- Consistent identification across all devices (no issues after deleting cookies)
- Receive notifications about comments, updates, or contest progress
Email Verification
Because you do not want to require a PollUnit account and want to allow public participation and enforce fair voting limits I would recommend two solutions the Email Verification. I think this is a reasonable compromise.
How it works:
- Participants enter their email.
- They receive a one-time code.
- PollUnit identifies them as a unique person independent of device or browser.
Benefits:
- No PollUnit registration required
- No password needed
- One person = one vote
»One person = one vote« is not entirely accurate. If someone has multiple email addresses, they can technically vote more than once. This also applies to a PollUnit account. However, we do detect and block disposable email addresses.
The SSO option looks like a good one for us. I have implemented it on one of our categories, but can't see that it makes any difference other than requiring a sign in. I don't know how to test it properly. Please advise.
SSO (Single Sign-On) is an authentication method that allows users to log in once and then access multiple applications or services without having to enter their credentials again. It streamlines the user experience and enhances security by centralizing the login process.
I mentioned the option of using your own SSO provider. If you have an existing user base, for example, a company that maintains a directory of all employees, you can connect this directory with our SSO feature. This ensures that the contest is as secure as your internal user directory.
This approach differs from using third-party providers like Google or Facebook. While these companies attempt to prevent users from creating multiple accounts, the overall security level is not as high as when you control the identity system yourself. Requiring a Google or Facebook account mainly ensures that each account can vote only once, but it does not guarantee strong identity verification.
Beyond security, SSO also offers convenience. It provides users with a very simple way to create and access their accounts. With just one click, we can automatically create a PollUnit account for them, and they can authenticate themselves from any device. When you require a PollUnit account, users can register with their email address, Google account, or Facebook account. In contrast, using SSO limits authentication to the selected identity provider (e.g., only Google or only Facebook).
