Comment by jawiggins

You don’t even need to gain control over a large number of devices in the region.

You just need _one_ device in the region, which can connect to the VPN or proxy service you were already using (the assumption seems to be that the attacker has a large number of IPs they can access through such a service). That device will get some added latency from going through the VPN/proxy, but because it’s physically close, the added latency will be small, probably not enough to reliably detect.

> Gaining control over a large number of devices in the target geographic region for submitting votes through those devices

Does AWS Lambda count as a machine for these purposes? If so, you can get a nearly infinite number of them just by cycling a config param and casting another vote.

Couldn't the "test" add some variety of math challenge, thus making a simple proxy insufficient. Obviously, this method would add more noise to the final calculation, but if the proxy would need to forward its data to the end-user machine to perform the math, then a simple proxy in this case wouldn't be sufficient.

This is similar to the argument the failed experiment 4Chan showed the internet. Being fully anonymous, the best arguments don't rise to the top, bad actors lie and lie and when confronted with their lies, they just pretend to be someone else and lie some more. All completely anonymous online polls are effectively useless. It's nice to have some research in helping them be a little less useless.

well yeah, that's against the point of "anonymity" ... you are feeding the app all the data it needs to fence you in.

By this logic every government gives a uniquely IDable device to its citizenry for engaging polls.

Besides ... if it was "important enough" to break, getting around geofencing etc. is a trivial/already solved part of this.

You are describing an ideal use case for a botnet of compromised home computers. Should command a much higher premium than sending spam.

For a motivated attacker its not that hard to add a few thousand raspberry pis to a residential internet network in most countries. Its really a quite practical attack when the stakes are governmental control.

No need for lots compromised devices. Just a single device (probably doesn't need to be compromised) in IPv4 behind carrier grade NAT is typically enough to vary your IP, or plausibly reuse an IP.