Right now I'm using Facebook Connect to (and only to) check for real-personhood and ensure that each real person only takes the survey once. I'm really worried that since FB Connect allows me to hypothetically snarf user data and post to the Facebook wall, on top of the basic fact that you need to enter your Facebook credentials, I'll scare off lots of prospective participants.
Is there a better way to do this? Google accounts just shift the problem. I track IPs but those are neither sensitive nor specific. I'm running a general population data collection survey, so it can't have any domain-specific barrier.
1. When loading the survey page check for a cookie. If it's not present, set the cookie, record the ip-and-cookie mapping, and redirect back to this page. 2. Now that we're loading the page with the cookie, present the form. 3. Upon submission of the form, validate that this IP was previously assigned this cookie, record the ip-cookie-vote triplet. Throw out the vote if that IP hasn't been assigned that cookie.
If a scripter wants to automate requests, they'll have to figure out that they need to get the cookie from you, then use it to vote. You can detect abnormally large ip-vote (and timeframe) combinations and automatically, or later manually, discard anomalous results.
It's not perfect of course, but there is no such thing as a perfect internet survey (unless you're going to mail out SeucurID fobs or some such to the participants).