6 ms·

But how does a voter verify that this is really the software running in the background?

by splike 10y ago

neikos 10y ago
But how do you verify that the compiler produces the code you wanted it to create? But how do you verify that the Computer actually does what is in the Bytecode?
- negus 10y ago
  "But how do you verify that the compiler produces the code you wanted it to create?" You open it in disassembler and look through. It's a white box. "But how do you verify that the Computer actually does what is in the Bytecode?" It is much closer to the original question. hardware backdoors is a difficult topic
PaulRobinson 10y ago
How do you know the ballot box you put your vote into is being taken to be counted and recorded, and not simply destroyed and another ballot box introduced? There is always going to be a weak point where you have to trust somebody - this is why party members should not be involved in every step from setting constituency borders, all the way to being in charge of any balloting and reporting results. It needs to be independent (e.g. in the UK it is fiercely independent of party members' involvement at any level). The interesting attack vector here is your ISP could trick you. That can be mitigated with certificates and some of the measures banks use to identify themselves to customers (strings that you added at registration being displayed at login that only you know, etc.) But yes, a hard problem to solve.
- Klathmon 10y ago
  >How do you know the ballot box you put your vote into is being taken to be counted and recorded, and not simply destroyed and another ballot box introduced? You can watch it. With a "ballot box" system, you could get there, put your vote in the box, then sit there and watch it all day until it's counted. Hell if you want you could get there and inspect the box before they start voting. And it's not just you that can do that, everyone can do that regardless of profession, age, race, background, education, etc...
  - tribaal 10y ago
    To clarify on top of Klathmon's point: this actually happens in Switzerland, it's not just a theoretical argument. Actually, the government is required to have some people watching the counting (specific rules vary on a per-canton basis). Some states select random citizens for that (similar to jury duty in the US - you get fined if you don't show up, but get paid for your time). Other states have a pool of people they choose from randomly (you volunteer for the pool). EDIT: Furthermore, Swiss people vote in their community. It's not like you need to go out of your way to watch the counting - it happens in your town hall or (sometimes) the school. It always happens on Sundays (which is a required day off in Switzerland except in some rare cases).
    - Klathmon 10y ago
      That's nice to know! If you don't mind me asking, how does Switzerland handle those which are required to work on election days? That's one of the ugliest parts of the US election system to me, is the fact that many people need to fit the election around their work schedule, and I know of at least 3 people that couldn't get time to vote this year, and my state makes it so you basically need to be actively deployed in the military, or be hospitalized to get an absentee ballot.
      - tribaal 10y ago
        Like I added in my edit, there is almost no such case: Sundays are a mandatory day off for most. That means you can't go shopping on a Sunday, except in very few shops (train station shops have exceptions). Doctors, pharmacies and most other emergency things operate on a reduced schedule. I'm not certain what would happen if say a nurse working a shift in an ICU was selected. I'm pretty sure it's either announced early enough that the hospital would have to switch shiftees or they would be given a pass for free. I suspect a person working in a train station shop on a Sunday would tell their boss, and would simply be shifted to another time (it's not like the boss or the employee can do anything about it - it's law). EDIT: to clarify once again - I'm pretty sure it does happen, but the case is probably rare enough for it not to matter too much. The rule works for a good 90% of cases, exceptions can certainly be done on a case-by-case basis at community level.
- VLM 10y ago
  Every state does things a little differently, but where I live paper ballots enter an optical scanner and every dozens/hundreds of ballots a subtotal is printed on a continuous stored piece of cash-register like tape. The presumably neutral election volunteers and the opposing party observers are fascinated by that tape every time it prints something. I don't know if there's a law or mere gentleman's agreement to not report results until after the polls close, but something is being periodically reported. The subtotal tape cries out to have a block chain added to make it impossible to rewrite history. Once the five neighboring precincts hash and sign my precincts results it would be very difficult to later fake historical results. There is of course the false assumption that everyone involved in elections wants a fair election, in which case systems will be constrained to make a fair election impossible, with technologies such as e-voting or obscure registration procedures or strange voting laws in general. But its very easy to run a fair election if the people running it want it that way. If. The sheer amount of problems indicate a very large number of people actively discourage democracy in practice.
- lostboys67 10y ago
  When I did poll watching (for knocking up supporters) for Labour a while back we where not allowed in the building and you could not have anything with the candidates name on within 50 or 100 yards - plain rosettes where ok.
  - huxley 10y ago
    Just FYI UK: Knocking up - visiting, in this case going door to door to canvass voters North America: Knocking up - making pregnant
- a_c_s 10y ago
  In the USA it is common for election work to be run or observed by pairs of majority-party workers: one Democrat and one Republican. So there are multiple pairs of eyes watching the boxes by people of different parties. This doesn't make funny business impossible but does make it both unlikely and difficult to tamper with on a large scale.
Klathmon 10y ago
Furthermore how does your average voter verify that the code itself is secure? How are your grandparents going to validate the crypto? How can your illiterate cousin ensure the hardware isn't backdoored? I just don't get the draw of an electronic voting system. Paper works, and it works well. Anyone that can count can validate a single precinct. You can have one person, or 100 people all standing there watching a ballot box all day for tampering. You can have a whole group of people count the results, or just a few. In a traditional paper system, swaying a single precinct with "blackhat" methods takes a lot of physical resources, a lot of time, and in most cases a lot of people. Then multiply that by every precinct in the country, and it quickly becomes pretty much impossible to do (and get away with). I've said it before, and i'll say it again. Electronic voting is dangerous and is a very bad idea. And it doesn't matter if it's FOSS, it doesn't matter if it's vetted, it doesn't matter what safeguards are put in place, all it takes is one mistake. One fuckup, and someone can now choose the leader of a nation. And replacing a system where literally everyone can validate a system on voting day if they want to with a system where only a fraction of a fraction of people can even read and understand the code, let alone validate the code (and can't actually validate the hardware, or make sure what is running on the hardware is actually that code), and it takes a magnitude more time to do so, just isn't a good idea.
- Quarrelsome 10y ago
  > I just don't get the draw of an electronic voting system. Make elections cheap. For those that wish to experiment with majority rules a reliable system would allow the people to technically be able to vote in their government on a daily, weekly, monthly basis. So further to this if elections are easy to run and are cheap what does it matter if someone breaks one election? You can just run the next one fine. It changes the variables somewhat and requires a sustained and persistent threat to be engaged to subvert the democracy. Combined with a team that investigate irregularities you can create a vaguely stable system, especially if you consider ideas such as binding authentication to geography instead of identity making it more difficult to stuff ballot boxes as teams can easily verify how many votes should be possible from a specific gps co-ordinate. I'm not saying its a great idea, its probably awful but it opens up an option to society that previously hasn't been available and that's interesting.
dola 10y ago
this is on a similar level of trust as the question about whether your paper vote is actually counted by some volunteer or just scraped. But I agree, that e-voting systems require a high level of trust by the users but I would argue that it is comparable to the trust you need in letter voting. The main difference in my view is the authority is typically split between fewer people with an e-voting system giving a single person more potential influence when they abuse their power. (e.g. a single server admin can deploy a malicious version of the system rather than a person only having access to maybe a few thousand ballots)
- VLM 10y ago
  Speaking of trust, your comments are interesting and over the decades I've been struck by the symmetry and asymmetry between evoting systems and our heavily automated financial system. There is enormous financial reward to corrupt an e-voting system and enormous financial reward to provide a trustworthy secure financial system. No great surprise which system works and which system will never work. The solution seems simple at first glance; scrap the entire voting system, scrap the entire fundraising system, and whichever candidate receives more individual $1 donations via check or money order wins. You can vote a dollar to as many candidates as you want but your federal tax return for that year is only getting a single $1 election credit. You could require the candidates to declare to the IRS each $1 contributor which makes election fraud also a form of income tax fraud. Certainly, our financial marketplaces and clearinghouses at their absolute worst are more trustworthy and reliable than our evoting systems at their absolute best. And the additional infrastructure to transfer a hundred million bucks every four years is utterly trivial (well, more often due to primaries and midterm elections, but its still a drop in the bucket ...) The anonymity emperor has no clothes, anyway. Thanks to the miracle of modern technology everyone who matters already knows exactly who you voted for and your complete financial life, you're just plausibly deniable on an individual basis against some non-state opfor some of the time. May as well face reality and make all votes part of the public financial record. Sure, it sucks. But better to face a reality you don't like, than to live in a fantasy world of completely broken anonymity. Living a lie means you'll slip up and the consequences of the slip up are likely worse than the lack of anonymity itself.
- tobltobs 10y ago

But how does a voter verify that this is really the software running in the background?

by splike 10y ago

But how does a voter verify that this is really the software running in the background?

But how do you verify that the compiler produces the code you wanted it to create? But how do you verify that the Computer actually does what is in the Bytecode?

negus 10y ago
"But how do you verify that the compiler produces the code you wanted it to create?" You open it in disassembler and look through. It's a white box. "But how do you verify that the Computer actually does what is in the Bytecode?" It is much closer to the original question. hardware backdoors is a difficult topic

PaulRobinson 10y ago

How do you know the ballot box you put your vote into is being taken to be counted and recorded, and not simply destroyed and another ballot box introduced? There is always going to be a weak point where you have to trust somebody - this is why party members should not be involved in every step from setting constituency borders, all the way to being in charge of any balloting and reporting results. It needs to be independent (e.g. in the UK it is fiercely independent of party members' involvement at any level). The interesting attack vector here is your ISP could trick you. That can be mitigated with certificates and some of the measures banks use to identify themselves to customers (strings that you added at registration being displayed at login that only you know, etc.) But yes, a hard problem to solve.

Klathmon 10y ago
>How do you know the ballot box you put your vote into is being taken to be counted and recorded, and not simply destroyed and another ballot box introduced? You can watch it. With a "ballot box" system, you could get there, put your vote in the box, then sit there and watch it all day until it's counted. Hell if you want you could get there and inspect the box before they start voting. And it's not just you that can do that, everyone can do that regardless of profession, age, race, background, education, etc...
- tribaal 10y ago
  To clarify on top of Klathmon's point: this actually happens in Switzerland, it's not just a theoretical argument. Actually, the government is required to have some people watching the counting (specific rules vary on a per-canton basis). Some states select random citizens for that (similar to jury duty in the US - you get fined if you don't show up, but get paid for your time). Other states have a pool of people they choose from randomly (you volunteer for the pool). EDIT: Furthermore, Swiss people vote in their community. It's not like you need to go out of your way to watch the counting - it happens in your town hall or (sometimes) the school. It always happens on Sundays (which is a required day off in Switzerland except in some rare cases).
  - Klathmon 10y ago
    That's nice to know! If you don't mind me asking, how does Switzerland handle those which are required to work on election days? That's one of the ugliest parts of the US election system to me, is the fact that many people need to fit the election around their work schedule, and I know of at least 3 people that couldn't get time to vote this year, and my state makes it so you basically need to be actively deployed in the military, or be hospitalized to get an absentee ballot.
    - tribaal 10y ago
      Like I added in my edit, there is almost no such case: Sundays are a mandatory day off for most. That means you can't go shopping on a Sunday, except in very few shops (train station shops have exceptions). Doctors, pharmacies and most other emergency things operate on a reduced schedule. I'm not certain what would happen if say a nurse working a shift in an ICU was selected. I'm pretty sure it's either announced early enough that the hospital would have to switch shiftees or they would be given a pass for free. I suspect a person working in a train station shop on a Sunday would tell their boss, and would simply be shifted to another time (it's not like the boss or the employee can do anything about it - it's law). EDIT: to clarify once again - I'm pretty sure it does happen, but the case is probably rare enough for it not to matter too much. The rule works for a good 90% of cases, exceptions can certainly be done on a case-by-case basis at community level.
VLM 10y ago
Every state does things a little differently, but where I live paper ballots enter an optical scanner and every dozens/hundreds of ballots a subtotal is printed on a continuous stored piece of cash-register like tape. The presumably neutral election volunteers and the opposing party observers are fascinated by that tape every time it prints something. I don't know if there's a law or mere gentleman's agreement to not report results until after the polls close, but something is being periodically reported. The subtotal tape cries out to have a block chain added to make it impossible to rewrite history. Once the five neighboring precincts hash and sign my precincts results it would be very difficult to later fake historical results. There is of course the false assumption that everyone involved in elections wants a fair election, in which case systems will be constrained to make a fair election impossible, with technologies such as e-voting or obscure registration procedures or strange voting laws in general. But its very easy to run a fair election if the people running it want it that way. If. The sheer amount of problems indicate a very large number of people actively discourage democracy in practice.
lostboys67 10y ago
When I did poll watching (for knocking up supporters) for Labour a while back we where not allowed in the building and you could not have anything with the candidates name on within 50 or 100 yards - plain rosettes where ok.
- huxley 10y ago
  Just FYI UK: Knocking up - visiting, in this case going door to door to canvass voters North America: Knocking up - making pregnant
a_c_s 10y ago
In the USA it is common for election work to be run or observed by pairs of majority-party workers: one Democrat and one Republican. So there are multiple pairs of eyes watching the boxes by people of different parties. This doesn't make funny business impossible but does make it both unlikely and difficult to tamper with on a large scale.

Klathmon 10y ago

Furthermore how does your average voter verify that the code itself is secure? How are your grandparents going to validate the crypto? How can your illiterate cousin ensure the hardware isn't backdoored? I just don't get the draw of an electronic voting system. Paper works, and it works well. Anyone that can count can validate a single precinct. You can have one person, or 100 people all standing there watching a ballot box all day for tampering. You can have a whole group of people count the results, or just a few. In a traditional paper system, swaying a single precinct with "blackhat" methods takes a lot of physical resources, a lot of time, and in most cases a lot of people. Then multiply that by every precinct in the country, and it quickly becomes pretty much impossible to do (and get away with). I've said it before, and i'll say it again. Electronic voting is dangerous and is a very bad idea. And it doesn't matter if it's FOSS, it doesn't matter if it's vetted, it doesn't matter what safeguards are put in place, all it takes is one mistake. One fuckup, and someone can now choose the leader of a nation. And replacing a system where literally everyone can validate a system on voting day if they want to with a system where only a fraction of a fraction of people can even read and understand the code, let alone validate the code (and can't actually validate the hardware, or make sure what is running on the hardware is actually that code), and it takes a magnitude more time to do so, just isn't a good idea.

Quarrelsome 10y ago
> I just don't get the draw of an electronic voting system. Make elections cheap. For those that wish to experiment with majority rules a reliable system would allow the people to technically be able to vote in their government on a daily, weekly, monthly basis. So further to this if elections are easy to run and are cheap what does it matter if someone breaks one election? You can just run the next one fine. It changes the variables somewhat and requires a sustained and persistent threat to be engaged to subvert the democracy. Combined with a team that investigate irregularities you can create a vaguely stable system, especially if you consider ideas such as binding authentication to geography instead of identity making it more difficult to stuff ballot boxes as teams can easily verify how many votes should be possible from a specific gps co-ordinate. I'm not saying its a great idea, its probably awful but it opens up an option to society that previously hasn't been available and that's interesting.

dola 10y ago

this is on a similar level of trust as the question about whether your paper vote is actually counted by some volunteer or just scraped. But I agree, that e-voting systems require a high level of trust by the users but I would argue that it is comparable to the trust you need in letter voting. The main difference in my view is the authority is typically split between fewer people with an e-voting system giving a single person more potential influence when they abuse their power. (e.g. a single server admin can deploy a malicious version of the system rather than a person only having access to maybe a few thousand ballots)

VLM 10y ago
Speaking of trust, your comments are interesting and over the decades I've been struck by the symmetry and asymmetry between evoting systems and our heavily automated financial system. There is enormous financial reward to corrupt an e-voting system and enormous financial reward to provide a trustworthy secure financial system. No great surprise which system works and which system will never work. The solution seems simple at first glance; scrap the entire voting system, scrap the entire fundraising system, and whichever candidate receives more individual $1 donations via check or money order wins. You can vote a dollar to as many candidates as you want but your federal tax return for that year is only getting a single $1 election credit. You could require the candidates to declare to the IRS each $1 contributor which makes election fraud also a form of income tax fraud. Certainly, our financial marketplaces and clearinghouses at their absolute worst are more trustworthy and reliable than our evoting systems at their absolute best. And the additional infrastructure to transfer a hundred million bucks every four years is utterly trivial (well, more often due to primaries and midterm elections, but its still a drop in the bucket ...) The anonymity emperor has no clothes, anyway. Thanks to the miracle of modern technology everyone who matters already knows exactly who you voted for and your complete financial life, you're just plausibly deniable on an individual basis against some non-state opfor some of the time. May as well face reality and make all votes part of the public financial record. Sure, it sucks. But better to face a reality you don't like, than to live in a fantasy world of completely broken anonymity. Living a lie means you'll slip up and the consequences of the slip up are likely worse than the lack of anonymity itself.
tobltobs 10y ago