bad-mouthing, but cannot work for ballot stuffing as sellers can give hidden indications of their identities to colluders.

On the other hand, the best known individual attack on reputation systems uses Sybils to obtain a disproportionately large influence [@Douceur2002]. Friedman and Resnick [@Friedman2001] point to the general problem of ‘cheapness’ of pseudonyms in marketplaces and reputation systems, since with name changes dishonest players easily shed negative reputation, as corroborated theoretically in [@Dellarocas2004]. The paper [@Bhatta2005] gives an explicit threshold for the transaction costs for reputations needed to avoid ballot stuffing. However, an indiscriminate pricing of identities for the submission of ratings poses an undesired entry deterrent. It seems therefore plausible that reputation systems should be based on pseudonyms which allow for a flexible forward pricing.

While related work addresses particular vulnerabilities [@Friedman05], or proposes general frameworks to ensure accountability in reputation systems while maintaining anonymity [@Buttyan1999; @Zieglera2006], we here propose a simple mechanism to introduce arbitrary costs for pseudonyms. The separation of duties between PCA and RS in our ticket system implements here precisely the controlled anonymity desired for reputation systems through the properties 1.–3. mentioned in Section \[sec:GenArc\].

Again, the generic ticket system can be embedded in various ways 