5 ms·

Well, you can pick: full verifiability, full authentication, and anonymity-as-long-as-you-dont-share-your-vote-receipt, which might work in some settings where

Well, you can pick: full verifiability, full authentication, and anonymity-as-long-as-you-dont-share-your-vote-receipt, which might work in some settings where the social norm against something like vote buying is strong enough that the party that tried this would end up with more of its own voters deflecting than opposing voters selling their vote to them. But there is one more problem: most verifiable voting protocols are fiendishly complex for the average voter to validate, specially if they need to keep in mind how to verify things in a way that is robust to their devices being compromised. If you were holding an election where only people with a crypto or security systems Ph.D. voted and where they would rather punch you in the face than sell you a vote for 1 million USD, then you could have very secure online voting. The real world is a little bit more complex than that... one of the main advantages of paper ballots is that the technology involved is quite widely understood.

nixos 10y ago
>most verifiable voting protocols are fiendishly complex for the average voter to validate It's easy. You get a large screen "Thanks for voting, hope you trust us!" When you use a SaaS, you have to trust the provider.
marcosdumay 10y ago
You jumped from "hard to verify" into "hard to vote" with no explanation there. There's little problem in an election where only people with knowledge of cryptography can verify the official results.
- lazaroclapp 10y ago
  Not quite. Ok, I might be exaggerating with the CS Ph.D. requirement for the average voter, but there are two steps: 1) Verify that my vote was correctly encoded and cast as intended. Every voter must verify this. It can be as "easy" as: printing a hash produced by a voting terminal/device you trust (which doesn't need to be government provided), submitting the resulting encoded vote into a (untrusted) government website where you authenticate with a smartcard, and then later comparing your original hash against a hash published in a newspaper... This exceeds the level of sophistication/care of most voters in any large country. 2) Some organization must check a large trail of signatures, zero-knowledge proofs of correctness, re-encryption mixnets, etc, etc. This can be done well enough as long as every political party and election watchdog has one or two crypto professionals in their employ. I am not really worried about #2, even though it is harder, I am worried about #1. The important part is that all the checking of the world regarding #2 is useless without at least a representative subset of voters performing #1 (~1% would be enough, but only if distributed uniformly at random, otherwise you can flip votes from the population(s) least likely to check).
  - marcosdumay 10y ago
    Yes, #1 is a bit too hard for everybody to do it. Yet, you can help some random set of your friends, while I help some random set of my friends, we add some neighbors at random, and much quicker than you thought, there will be a representative set of verified votes.
    - lazaroclapp 10y ago
      No, you won't. You will get a representative set of "votes for voters who have at least one friend who went to college or had the resources to be a computer geek growing up". Then if I want to manipulate the election, I will just flip votes from elderly lower income voters in rural communities and likely not get caught at all. For an analogy: I grew up in Mexico during the 70 years PRI rule, and I can tell you in my city, in my polling station, with watchers from all major parties and a few ONGs, it is actually very unlikely that anyone stuffed the ballot. But in a rural area, where Spanish is not the primary language and the poll watchers were all from one party or few enough to be for sale... well... My point being that a similar scheme is quite possible when the barrier is "computer literacy" instead of "rights literacy" or plain old literacy (in the country's majority language, I mean). Either way, the smaller the group of people who understand how the election works, the easier it is to disenfranchise people.

nixos 10y ago

>most verifiable voting protocols are fiendishly complex for the average voter to validate It's easy. You get a large screen "Thanks for voting, hope you trust us!" When you use a SaaS, you have to trust the provider.

marcosdumay 10y ago

You jumped from "hard to verify" into "hard to vote" with no explanation there. There's little problem in an election where only people with knowledge of cryptography can verify the official results.

lazaroclapp 10y ago
Not quite. Ok, I might be exaggerating with the CS Ph.D. requirement for the average voter, but there are two steps: 1) Verify that my vote was correctly encoded and cast as intended. Every voter must verify this. It can be as "easy" as: printing a hash produced by a voting terminal/device you trust (which doesn't need to be government provided), submitting the resulting encoded vote into a (untrusted) government website where you authenticate with a smartcard, and then later comparing your original hash against a hash published in a newspaper... This exceeds the level of sophistication/care of most voters in any large country. 2) Some organization must check a large trail of signatures, zero-knowledge proofs of correctness, re-encryption mixnets, etc, etc. This can be done well enough as long as every political party and election watchdog has one or two crypto professionals in their employ. I am not really worried about #2, even though it is harder, I am worried about #1. The important part is that all the checking of the world regarding #2 is useless without at least a representative subset of voters performing #1 (~1% would be enough, but only if distributed uniformly at random, otherwise you can flip votes from the population(s) least likely to check).
- marcosdumay 10y ago
  Yes, #1 is a bit too hard for everybody to do it. Yet, you can help some random set of your friends, while I help some random set of my friends, we add some neighbors at random, and much quicker than you thought, there will be a representative set of verified votes.
  - lazaroclapp 10y ago
    No, you won't. You will get a representative set of "votes for voters who have at least one friend who went to college or had the resources to be a computer geek growing up". Then if I want to manipulate the election, I will just flip votes from elderly lower income voters in rural communities and likely not get caught at all. For an analogy: I grew up in Mexico during the 70 years PRI rule, and I can tell you in my city, in my polling station, with watchers from all major parties and a few ONGs, it is actually very unlikely that anyone stuffed the ballot. But in a rural area, where Spanish is not the primary language and the poll watchers were all from one party or few enough to be for sale... well... My point being that a similar scheme is quite possible when the barrier is "computer literacy" instead of "rights literacy" or plain old literacy (in the country's majority language, I mean). Either way, the smaller the group of people who understand how the election works, the easier it is to disenfranchise people.