6 ms·

The biggest problem with online/computerised voting is that it is a single point of attack for malicious actors. Even the best software security gets broken fr

by adwf 10y ago

The biggest problem with online/computerised voting is that it is a single point of attack for malicious actors. Even the best software security gets broken from time to time, online voting would allow zero-day attacks on elections - an absolute disaster. Whilst standard paper voting may also be subject to fraud, it takes the manipulation of thousands of people in order to alter ballots across a whole country. Computers just need the one hack.

Strom 10y ago
You're choosing a suboptimal attack spot in your paper voting attack scenario. Instead of manipulating the thousands of people around the country who count & send out the results of those booths, it's easier to manipulate the far fewer people who do the aggregation for final results. Also a computer voting system that is exploitable via "one hack" is inexcusably badly designed. Yes hacks happen & adversaries have zero-days, but it's possible to build a computer voting system that is highly resistant to those scenarios. As a very simple example: have a standardized vote format that will be counted by three independently implemented systems, each on a different OS, running in parallel. A great system will go to far greater lengths for protection, but this should already show that a simple "one hack" wouldn't work.
- adwf 10y ago
  It's still a 3-point of failure versus a thousand in a paper vote. I've seen the British election many times, there are hundreds of people in the counting hall for every district. They count, then they shuffle the ballots around and have different people recount. It would take the bribery of thousands upon thousands of people. People who are under constant scrutiny, not just by those around them, but on TV also. A computer is almost trivially suborned in comparison. Even our most important pieces of security software, such as openssl and others, get hacked from time to time. If such hugely important - massively used, massively tested - open-source projects get hacked, why on earth would you want to risk computer voting? It's just standard programmer NIH hubris; we think we can do it better, therefore we should.
  - tgb 10y ago
    I've counted votes a couple times before and can tell you that where I come from in the US recounting is minimal (if done at all). We pair up with a person of our choosing and then count and recount. Collusion is trivial. Just make sure the total counts add up and that your results aren't so wildly disproportionate from the other people's that they'd get reexamined when all the pairs' numbers are summed. I don't know what you mean by scrutiny on the TV - are local polls counted live on television in the UK?
    - adwf 10y ago
      Yep - this is the kind of thing: https://www.youtube.com/watch?v=XydeHaqxBbg https://www.youtube.com/watch?v=XydeHaqxBbg It's almost impossible to imagine that someone could bribe that many people to influence an election in the UK. There are 650 seats with over 100k population per seat. I just can't imagine it being bribable on a large scale. Maybe some tiny constituency in a tiny district might get influenced, but the absolute smallest is about 20k votes. That's very difficult to rig.
      - sgnelson 10y ago
        But you don't have to bribe 100k people. You just have to bribe/influence 50,001 people (and I know that's not exactly true, this is based on a US two party system, not the variety of parties in the UK, but hang with me here.) And in reality, it's as the saying goes for Baseball. "Every team is going to win a third of it's games, and every team is going to lose a third of it's games, it's what you do with the last third that makes a difference." Every party is going to have a large number of supporters and a large number of detractors, it's what you do with the unaffiliated votes that matters. Now I'm really going to talk out of my ass, in a horrible, gross generalization with no support to back me up; I'd guess that for many elections, it's less than 20% of voters who actually decide the fate of their country/district. And since we're talking about voters (not citizens or residents/people), we're then talking about an even smaller group of people you must influence. That's why bribery, voter intimidation and pure old fashioned marketing matter; You don't need to get everyone on board, only a much smaller percentage of key voters. Isn't democracy great?
- pmontra 10y ago
  > it's easier to manipulate the far fewer people who do the aggregation for final results. It is but parties have their watchers spread around the country to report counts to their central. Any substantial difference will be noted and end up in a recount. What saves us is the mistrust between parties. With internet voting watching each other would be more difficult. Actually I believe that there will be no internet voting where parties really don't trust each other. There will be internet voting were parties are very naive (almost impossible for politicians) or they somewhat agree not to rig the elections (again, too naive to believe?) or to decide them in advance.
  - Natanael_L 10y ago
    Interestingly enough mutual distrust between the organizing parties can create trust trough cryptography, in secure multiparty computation schemes. Still no good idea to do remote voting (social reasons), but electronic voting can be made secure. I linked my own scheme before; https://roamingaroundatrandom.wordpress.com/2014/06/16/an-mpc-based-privacy-preserving-flexible-cryptographic-voting-scheme/ https://roamingaroundatrandom.wordpress.com/2014/06/16/an-mp...
- realityking 10y ago
  > [...] it's easier to manipulate the far fewer people who do the aggregation for final results. That problem can easily be solved with transparency. In Germany I can do my own tally of the election results as every state reports the votes down the individual polling station. For example, here are the results for Berlin from the last Bundestags election: https://www.wahlen-berlin.de/wahlen/BU2013/ErgebWahllokale/wahlbezirke.asp?sel1=2155&sel2=0800 https://www.wahlen-berlin.de/wahlen/BU2013/ErgebWahllokale/w... I can also observe the count at my local polling station. They are required to announce their results orally after they're done counting and I can confirm that this is the result reported online. I've been an election helper and I've always checked that the results online match those that we reported. I never did my own tally, but if the results are close I'm sure someone does them.
bigger_cheese 10y ago
My biggest worry isn't about software security. My worry about online remote voting is What is to stop physical coercion of the voter? When you have to gather at a centralised polling point to anonymously vote you can be damn sure no one is standing over the voter's shoulder twisting their arm while they vote. If you are voting remotely via a computer screen who is to know?
- deleted 10y ago
  [deleted]
- germanier 10y ago
  I've seen the following idea implemented: You can cast your vote as often as you want with only the last one counting. Sure, in practice there are a lot of things to consider to make it foolproof and it might be impossible to do securely - I don't know. But it's worth considering.
  - mantas 10y ago
    It would help against forced votes. But it's useless if some lazy person wants to sell his vote. With regular voting, there's a minor barrier in place. The incentivized voter has to go to the polling station and bring back some kind of proof. With online voting, someone could just take his ID (or e-signature device) and vote himself. The voter selling his vote may even don't know whom he "voted" for. Furthermore, someone might buy those signature devices off homeless/addicts/etc and build a massive voting farm.
- thaumasiotes 10y ago
  We already allow remote voting for anyone who wants it.
- Joof 10y ago
  Voting is done by entering a short key. No characters appear on the screen. Only last vote counts.
- pmontra 10y ago
  Physical coercion is possible also with paper ballots. A modern approach is to ask voters to shoot a picture to their voted ballot. No picture, big trouble. For that reason taking a picture of our own voted ballot is a crime in Italy. Obviously is a crime also to ask people to do that. Cameras are not allowed in polling places and smartphones should be left outside the polling booth. However nobody asked me to do that the last time I voted. I remember they did many years ago. There were many phones lined up on the desk of the president of the polling place.
tmat 10y ago
blockchain tech solves your problems.
alanwatts 10y ago
>Whilst standard paper voting may also be subject to fraud, it takes the manipulation of thousands of people in order to alter ballots across a whole country. Computers just need the one hack. And yet it remains far easier to hack a human administrator than to hack the system they administrate. So it's really 1000 easy hacks vs 1 really hard hack.
marcosdumay 10y ago
It's easy to create online voting systems that guarantee a correct result. You just didn't think about it hard enough.

by adwf 10y ago

Strom 10y ago

You're choosing a suboptimal attack spot in your paper voting attack scenario. Instead of manipulating the thousands of people around the country who count & send out the results of those booths, it's easier to manipulate the far fewer people who do the aggregation for final results. Also a computer voting system that is exploitable via "one hack" is inexcusably badly designed. Yes hacks happen & adversaries have zero-days, but it's possible to build a computer voting system that is highly resistant to those scenarios. As a very simple example: have a standardized vote format that will be counted by three independently implemented systems, each on a different OS, running in parallel. A great system will go to far greater lengths for protection, but this should already show that a simple "one hack" wouldn't work.

adwf 10y ago
It's still a 3-point of failure versus a thousand in a paper vote. I've seen the British election many times, there are hundreds of people in the counting hall for every district. They count, then they shuffle the ballots around and have different people recount. It would take the bribery of thousands upon thousands of people. People who are under constant scrutiny, not just by those around them, but on TV also. A computer is almost trivially suborned in comparison. Even our most important pieces of security software, such as openssl and others, get hacked from time to time. If such hugely important - massively used, massively tested - open-source projects get hacked, why on earth would you want to risk computer voting? It's just standard programmer NIH hubris; we think we can do it better, therefore we should.
- tgb 10y ago
  I've counted votes a couple times before and can tell you that where I come from in the US recounting is minimal (if done at all). We pair up with a person of our choosing and then count and recount. Collusion is trivial. Just make sure the total counts add up and that your results aren't so wildly disproportionate from the other people's that they'd get reexamined when all the pairs' numbers are summed. I don't know what you mean by scrutiny on the TV - are local polls counted live on television in the UK?
  - adwf 10y ago
    Yep - this is the kind of thing: https://www.youtube.com/watch?v=XydeHaqxBbg https://www.youtube.com/watch?v=XydeHaqxBbg It's almost impossible to imagine that someone could bribe that many people to influence an election in the UK. There are 650 seats with over 100k population per seat. I just can't imagine it being bribable on a large scale. Maybe some tiny constituency in a tiny district might get influenced, but the absolute smallest is about 20k votes. That's very difficult to rig.
    - sgnelson 10y ago
      But you don't have to bribe 100k people. You just have to bribe/influence 50,001 people (and I know that's not exactly true, this is based on a US two party system, not the variety of parties in the UK, but hang with me here.) And in reality, it's as the saying goes for Baseball. "Every team is going to win a third of it's games, and every team is going to lose a third of it's games, it's what you do with the last third that makes a difference." Every party is going to have a large number of supporters and a large number of detractors, it's what you do with the unaffiliated votes that matters. Now I'm really going to talk out of my ass, in a horrible, gross generalization with no support to back me up; I'd guess that for many elections, it's less than 20% of voters who actually decide the fate of their country/district. And since we're talking about voters (not citizens or residents/people), we're then talking about an even smaller group of people you must influence. That's why bribery, voter intimidation and pure old fashioned marketing matter; You don't need to get everyone on board, only a much smaller percentage of key voters. Isn't democracy great?
pmontra 10y ago
> it's easier to manipulate the far fewer people who do the aggregation for final results. It is but parties have their watchers spread around the country to report counts to their central. Any substantial difference will be noted and end up in a recount. What saves us is the mistrust between parties. With internet voting watching each other would be more difficult. Actually I believe that there will be no internet voting where parties really don't trust each other. There will be internet voting were parties are very naive (almost impossible for politicians) or they somewhat agree not to rig the elections (again, too naive to believe?) or to decide them in advance.
- Natanael_L 10y ago
  Interestingly enough mutual distrust between the organizing parties can create trust trough cryptography, in secure multiparty computation schemes. Still no good idea to do remote voting (social reasons), but electronic voting can be made secure. I linked my own scheme before; https://roamingaroundatrandom.wordpress.com/2014/06/16/an-mpc-based-privacy-preserving-flexible-cryptographic-voting-scheme/ https://roamingaroundatrandom.wordpress.com/2014/06/16/an-mp...
realityking 10y ago
> [...] it's easier to manipulate the far fewer people who do the aggregation for final results. That problem can easily be solved with transparency. In Germany I can do my own tally of the election results as every state reports the votes down the individual polling station. For example, here are the results for Berlin from the last Bundestags election: https://www.wahlen-berlin.de/wahlen/BU2013/ErgebWahllokale/wahlbezirke.asp?sel1=2155&sel2=0800 https://www.wahlen-berlin.de/wahlen/BU2013/ErgebWahllokale/w... I can also observe the count at my local polling station. They are required to announce their results orally after they're done counting and I can confirm that this is the result reported online. I've been an election helper and I've always checked that the results online match those that we reported. I never did my own tally, but if the results are close I'm sure someone does them.

bigger_cheese 10y ago

My biggest worry isn't about software security. My worry about online remote voting is What is to stop physical coercion of the voter? When you have to gather at a centralised polling point to anonymously vote you can be damn sure no one is standing over the voter's shoulder twisting their arm while they vote. If you are voting remotely via a computer screen who is to know?

deleted 10y ago
[deleted]
germanier 10y ago
I've seen the following idea implemented: You can cast your vote as often as you want with only the last one counting. Sure, in practice there are a lot of things to consider to make it foolproof and it might be impossible to do securely - I don't know. But it's worth considering.
- mantas 10y ago
  It would help against forced votes. But it's useless if some lazy person wants to sell his vote. With regular voting, there's a minor barrier in place. The incentivized voter has to go to the polling station and bring back some kind of proof. With online voting, someone could just take his ID (or e-signature device) and vote himself. The voter selling his vote may even don't know whom he "voted" for. Furthermore, someone might buy those signature devices off homeless/addicts/etc and build a massive voting farm.
thaumasiotes 10y ago
We already allow remote voting for anyone who wants it.
Joof 10y ago
Voting is done by entering a short key. No characters appear on the screen. Only last vote counts.
pmontra 10y ago
Physical coercion is possible also with paper ballots. A modern approach is to ask voters to shoot a picture to their voted ballot. No picture, big trouble. For that reason taking a picture of our own voted ballot is a crime in Italy. Obviously is a crime also to ask people to do that. Cameras are not allowed in polling places and smartphones should be left outside the polling booth. However nobody asked me to do that the last time I voted. I remember they did many years ago. There were many phones lined up on the desk of the president of the polling place.

tmat 10y ago

blockchain tech solves your problems.

alanwatts 10y ago

>Whilst standard paper voting may also be subject to fraud, it takes the manipulation of thousands of people in order to alter ballots across a whole country. Computers just need the one hack. And yet it remains far easier to hack a human administrator than to hack the system they administrate. So it's really 1000 easy hacks vs 1 really hard hack.

marcosdumay 10y ago

It's easy to create online voting systems that guarantee a correct result. You just didn't think about it hard enough.