Cookies wouldn't work well, as they could be deleted by a knowledgable user, who could then gain infinite votes. The way that many sites do it (perlmonks and slashdot, for instance), is by tracking IP. This has some margin of error because of things like proxies, and people voting from more than one IP, but is basically the best all-around way to do it.