5 ms·

"Receipts" are a problem - a key security goal of voting systems is that it should be impossible for the voter to be able to prove who they voted for (to preven

by azernik 10y ago

"Receipts" are a problem - a key security goal of voting systems is that it should be impossible for the voter to be able to prove who they voted for (to prevent both voter coercion and vote-selling). Paper trails that stay in the hands of the registrar of voters are a good idea, in that they can be used to cross-check the results of the counting. Sure, you now have to trust the people with custody of the physical ballots, but it expands the size of the required conspiracy to more than just a few people with access to the voting machine software.

deleted 10y ago
[deleted]
mrfusion 10y ago
What if machines randomly gave 50% of voters receipts? You could still use those for auditing with simple statistics. But any particular voter could simply say they didn't get one.
- maxerickson 10y ago
  The current system allows people to inspect the equipment and observe the vote. The parties typically make an effort to train people that do this in districts with close votes. There's no need to make it 50% likely that you can get a reward for voting a certain way.
- VLM 10y ago
  Issue any voter as many ballots linking candidate to random serial number as they want for either candidate. Publish the complete mapping of ballot-serial before the election. Make up like ten times as many as you want. Maybe a million times. Give up to ten ballots to each voter. They get to deposit exactly one. They legally have to shred at least one receipt no exceptions (could be the one they voted, could be one they didn't) Publish the full list of votes complete with receipt and name mapping. If I'm coerced I eat my receipt for the vote I actually submitted. If I kept my vote, it should show up in the list of Trump serial numbered voters or maybe I printed a fake receipt, they'll be handing out fake receipts because the mapping was published before the election. In fact I can falsely claim I voted for any one or take the identity of any voter. The receipts are not going to be elaborate, by intention, the secret is the number on it not the paper. I can prove I shredded 9 hillary votes so if they show up in the list of YES then shennanigans I can tell a corrupt mass media employer I voted for Hillary merely by turning in any published "Hillary-serial number" combination. All valid ballots were published after the election. You can make it more elaborate and maybe better or worse by assigning two serial numbers to each ballot, a public serial and a private serial and playing public key crypto style games with which is published.
grzm 10y ago
"Receipts" are a problem - a key security goal of voting systems is that it should be impossible for the voter to be able to prove who they voted for (to prevent both voter coercion and vote-selling). Coercion and vote-selling are legitimate issues. There are methods of doing this. For example, take an election with two choices: Coke, and Pepsi. Half of the ballots are printed with multiple choice A: Coke, B: Pepsi. The other half are marked A: Pepsi, B: Coke. In the booth, a voter gets a ballot at random and marks it. Their receipt shows that they choose A or B, but what A or B correspond to. They can prove they voted, but not who they voted for. [0]: https://en.wikipedia.org/wiki/Punchscan https://en.wikipedia.org/wiki/Punchscan There are other methods as well. Really interesting stuff, I think.
- azernik 10y ago
  Oh yeah. It's an interesting problem for sure. But there are two requirements here: * That the voter not be able to prove to anyone else who they voted for (your proposal addresses that). * That the voter be able to prove to their own satisfaction that their ballot was counted correctly (your proposal doesn't really address that - how do they know that their ballot was counted using the right label-to-choice mapping?). The secret sauce of punchscan is in the second requirement - with the choice of whether to keep the position-to-choice mapping or the actual position voted as a receipt, and making it so that the voter can verify their ballot was received and auditors can check for the correctness of the total count. I'd need more time to understand exactly how that part works, but it's a non-trivial algorithm, and super cool. [Side note - you can already prove that you voted - this is public information. When you vote your name is crossed off a list, and that list becomes part of the public record and is fed into e.g. political parties' voter files. The challenge is proving to your own satisfaction that your vote was counted as you intended.]

by azernik 10y ago

"Receipts" are a problem - a key security goal of voting systems is that it should be impossible for the voter to be able to prove who they voted for (to prevent both voter coercion and vote-selling). Paper trails that stay in the hands of the registrar of voters are a good idea, in that they can be used to cross-check the results of the counting. Sure, you now have to trust the people with custody of the physical ballots, but it expands the size of the required conspiracy to more than just a few people with access to the voting machine software.

deleted 10y ago

[deleted]

mrfusion 10y ago

What if machines randomly gave 50% of voters receipts? You could still use those for auditing with simple statistics. But any particular voter could simply say they didn't get one.

maxerickson 10y ago
The current system allows people to inspect the equipment and observe the vote. The parties typically make an effort to train people that do this in districts with close votes. There's no need to make it 50% likely that you can get a reward for voting a certain way.
VLM 10y ago
Issue any voter as many ballots linking candidate to random serial number as they want for either candidate. Publish the complete mapping of ballot-serial before the election. Make up like ten times as many as you want. Maybe a million times. Give up to ten ballots to each voter. They get to deposit exactly one. They legally have to shred at least one receipt no exceptions (could be the one they voted, could be one they didn't) Publish the full list of votes complete with receipt and name mapping. If I'm coerced I eat my receipt for the vote I actually submitted. If I kept my vote, it should show up in the list of Trump serial numbered voters or maybe I printed a fake receipt, they'll be handing out fake receipts because the mapping was published before the election. In fact I can falsely claim I voted for any one or take the identity of any voter. The receipts are not going to be elaborate, by intention, the secret is the number on it not the paper. I can prove I shredded 9 hillary votes so if they show up in the list of YES then shennanigans I can tell a corrupt mass media employer I voted for Hillary merely by turning in any published "Hillary-serial number" combination. All valid ballots were published after the election. You can make it more elaborate and maybe better or worse by assigning two serial numbers to each ballot, a public serial and a private serial and playing public key crypto style games with which is published.

grzm 10y ago

"Receipts" are a problem - a key security goal of voting systems is that it should be impossible for the voter to be able to prove who they voted for (to prevent both voter coercion and vote-selling). Coercion and vote-selling are legitimate issues. There are methods of doing this. For example, take an election with two choices: Coke, and Pepsi. Half of the ballots are printed with multiple choice A: Coke, B: Pepsi. The other half are marked A: Pepsi, B: Coke. In the booth, a voter gets a ballot at random and marks it. Their receipt shows that they choose A or B, but what A or B correspond to. They can prove they voted, but not who they voted for. [0]: https://en.wikipedia.org/wiki/Punchscan https://en.wikipedia.org/wiki/Punchscan There are other methods as well. Really interesting stuff, I think.

azernik 10y ago
Oh yeah. It's an interesting problem for sure. But there are two requirements here: * That the voter not be able to prove to anyone else who they voted for (your proposal addresses that). * That the voter be able to prove to their own satisfaction that their ballot was counted correctly (your proposal doesn't really address that - how do they know that their ballot was counted using the right label-to-choice mapping?). The secret sauce of punchscan is in the second requirement - with the choice of whether to keep the position-to-choice mapping or the actual position voted as a receipt, and making it so that the voter can verify their ballot was received and auditors can check for the correctness of the total count. I'd need more time to understand exactly how that part works, but it's a non-trivial algorithm, and super cool. [Side note - you can already prove that you voted - this is public information. When you vote your name is crossed off a list, and that list becomes part of the public record and is fed into e.g. political parties' voter files. The challenge is proving to your own satisfaction that your vote was counted as you intended.]