Topic starter
21/08/2026 4:53 pm
TL;DR: Online voting systems can be manipulated through cookie resets, IP changes, email and phone aliasing, vote-weight tampering, type-casting tricks, and race conditions, according to INTIGRITI. The pattern shows that fairness depends as much on state handling and normalization as on authentication, which means integrity controls must be tested like security controls.
Editorial analysis by NHI Mgmt Group, based on content published by INTIGRITI: “A hackers’ guide to online voting systems”.
Key questions
Q: What breaks when online voting systems rely on cookies or IP addresses to prevent repeat votes?
A: Those checks are easy to reset or route around, so they stop casual repeat voting but not determined abuse.
Q: Why do vote-weight and input-format tricks change results in authenticated polls?
A: They work when the application trusts client-supplied vote structure before applying canonical server-side rules.
Q: How do security teams know if duplicate-vote controls are actually effective?
A: They should test whether the system enforces one outcome atomically under concurrent requests, not just whether a single replay is rejected.
Practitioner guidance
- Enforce server-side vote state Keep vote eligibility, vote weight, and duplicate checks on the server so the client cannot define the outcome of the request.
- Make duplicate checks atomic Combine validation and write operations so parallel requests cannot pass the same one-vote rule more than once.
- Normalize inputs before policy decisions Parse numeric and string vote fields into a single canonical form before duplication or weighting logic runs.
Bottom line: Online voting can be manipulated without breaking authentication if the application trusts weak uniqueness signals, inconsistent input formats, or non-atomic write paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
21/08/2026 5:11 pm
Integrity controls for voting are a governance problem, not just an application problem. Online voting systems fail when they treat identity checks as the whole control surface and leave result integrity to weak business logic. The article shows that fairness depends on enforcing state, uniqueness, and normalization at the point of decision. Practitioners should treat vote integrity as a control objective in its own right, not as a by-product of login.
A question worth separating out:
Q: What is the difference between authentication and integrity controls in online voting?
A: Authentication tries to confirm who or what is submitting a vote, while integrity controls ensure the vote is counted once, in the right form, and with the right weight. A system can authenticate successfully and still be manipulated if normalization, duplication, or commit logic is weak. In voting workflows, integrity is the control that protects the outcome.
👉 Read our full editorial: Online voting manipulation shows where integrity controls fail