6 ms·

But how do you verify that each voter is authorized to vote, and that only one vote was cast? It seems if you involve a digital system you're kicking the trust

by smokeyj 10y ago

But how do you verify that each voter is authorized to vote, and that only one vote was cast? It seems if you involve a digital system you're kicking the trust bucket down the road. The security of a digital systems is "good enough" IMO, especially if there's a public cryptographically verifiable ledger. We bank online where the banks essentially only hold cash in the form of a database entry. The benefits of digital voting means we can have more granular input in our government's operations. I don't see paper ever scaling to meet that demand.

nabla9 10y ago
Yes, IMO. Remember that your IMO is not what the consensus among security experts is. There are many things that you and me missed. The worst problem with electronic internet voting is that depending on country, something like 5-40 percent of voters loses the secret ballot and the opportunity to vote independently without coercion. Husband, brother or other family member will be behind their back to watch how they vote. Here in Finland I have a friend who has been election official and he says that it's not uncommon common for family member trying to squeeze into ballot box or try get behind. Especially if the ballot has been cast in post office with small space.
- smw 10y ago
  This is a big deal.
erispoe 10y ago
We can tolerate errors in banking that we cannot in voting. Banking can be good enough, voting must be trusted to the most absolute degree.
- specialist 10y ago
  Further, our first past the post election voting system is especially brittle AND the window for detecting and correcting errors is very small.
  - lambertsimnel 10y ago
    If the United States were to adopt one practice from the Swiss government, proportional representation might do the most good.
- shortstuffsushi 10y ago
  In the US, at least, we tolerate a fair amount of error. See the WI recount this election, which exposed the totals to be off by over one hundred votes. I'd be willing to bet if you recount again, it'd be off from that total as well. It isn't absolute is my point.
  - aaron_m04 10y ago
    The electoral college introduces quite a lot of error, but people don't seem to care enough to change it.
specialist 10y ago
I disagree. I'll be surprised if any electronic voting system matches the integrity, performance, scalability, feature set of the Australian Ballot, of paper ballots cast at polls sites counted when the polls close. Your jurisdiction's voter registration database is (hopefully) up to date. YMMV. Note that verified reports of registration fraud are very, very few. Whereas caging, purging are fairly common. Briefly, On election day: voter shows up to correct poll site, shows some kind of ID (YMMV), name found in that location's poll book, voter signs in, ballot is issued, voter marks ballot, voter casts ballot. If there's any error (question) during this process, voter is issued a provisional ballot, to be adjudicated out of band. Ballots are counted before the polls open and again when the polls close. The bookkeeping is simple and easily verified. Everything is bundled in tamper evident seals, observed and signed by members of opposing parties, physically escorted by opposing members, etc.
- smokeyj 10y ago
  > Everything is bundled in tamper evident seals, observed and signed by members of opposing parties, physically escorted by opposing members, etc. I don't see why this level of security couldn't be used to randomly and deterministically assign crypto keys that are used for some kind of blockchain voting scheme. Put a thousand pre-known keys in a hat, one thousand people draw keys from a hat, the key is activated on the blockchain and points to a user-defined voting wallet. Now you have anonymous cryptographically verifiable voting with double spend protection. Am I missing something?
  - RangerScience 10y ago
    I don't know, but I'm commenting to bookmark your comment.
  - dispose13432 10y ago
    So you still have to come in to collect your ballot. Might as well just vote then and there
    - smokeyj 10y ago
geofft 10y ago
> public cryptographically verifiable ledger This is a thing you actively don't want. You don't want to be able to prove to anyone else how you voted. Otherwise it would be absolutely trivial for your boss to say, "So, you voted for that anti-union candidate, right?" (Or your boss to not say that, but just happen to give promotions to people who show proof of voting the way the boss wants.) The right to a secret ballot is demanded by the Universal Declaration of Human Rights. Yes, this renders the electronic voting problem - and honestly the voting problem in general - very close to impossible. That's why it's hard.
- smokeyj 10y ago
  >> Put a thousand pre-known keys in a hat, one thousand people draw keys from a hat, the key is activated on the blockchain and points to a user-defined voting wallet. Now you have anonymous cryptographically verifiable voting with double spend protection I just invented a scheme to anonymize votes in 5 minutes. I'm sure if smarter people tried we could definitively solve this. I'm not convinced this is hard as much as people are saying it's hard.
  - vertex-four 10y ago
    So how does this stand up to "show me the private key you used"?
  - tangent128 10y ago
    To prevent coercion, it's not sufficient to allow anonymity; you have to disallow means by which a person can prove how they voted.
    - smokeyj 10y ago
      How true is this? Somebody could just take a picture of their ballot (under the threat of violence presumably). Sure they're not supposed to, but at this point we're relying on legislation - where the legislation could say employers aren't allowed to ask for employees voting wallets. Maybe I'm missing something.
lazaroclapp 10y ago
Some of the places with the highest levels of distrust on electoral authorities and government bureaucracy solve this problem by marking your thumb with indelible ink, which can't be washed off but fades away over the course of a week or so. This guarantees people enter polling stations only once, even if they magically happen to have been registered at multiple places. We use this in Mexico, in addition to (non-digital) fingerprint-carrying voter ids. Historically, it has not prevented fraud in general (most of which happened due to insufficient audit procedures and rural polls not having observers from all parties, allowing for stuffed ballots and the like). It did however close that particular attack vector. My trust on the results of an individual polling station in an urban area with observers from all major and most minor parties is actually quite high, even as I know any or all of the observers involved are likely to be corrupt and have low regard for the law. The reason for this is that they are all incentivized to prevent each other from cheating and have the means to detect tampering in such setting (without needing uncommon expertise beyond observation and basic arithmetic). https://en.wikipedia.org/wiki/Election_ink https://en.wikipedia.org/wiki/Election_ink

by smokeyj 10y ago

nabla9 10y ago

Yes, IMO. Remember that your IMO is not what the consensus among security experts is. There are many things that you and me missed. The worst problem with electronic internet voting is that depending on country, something like 5-40 percent of voters loses the secret ballot and the opportunity to vote independently without coercion. Husband, brother or other family member will be behind their back to watch how they vote. Here in Finland I have a friend who has been election official and he says that it's not uncommon common for family member trying to squeeze into ballot box or try get behind. Especially if the ballot has been cast in post office with small space.

smw 10y ago
This is a big deal.

erispoe 10y ago

We can tolerate errors in banking that we cannot in voting. Banking can be good enough, voting must be trusted to the most absolute degree.

specialist 10y ago
Further, our first past the post election voting system is especially brittle AND the window for detecting and correcting errors is very small.
- lambertsimnel 10y ago
  If the United States were to adopt one practice from the Swiss government, proportional representation might do the most good.
shortstuffsushi 10y ago
In the US, at least, we tolerate a fair amount of error. See the WI recount this election, which exposed the totals to be off by over one hundred votes. I'd be willing to bet if you recount again, it'd be off from that total as well. It isn't absolute is my point.
- aaron_m04 10y ago
  The electoral college introduces quite a lot of error, but people don't seem to care enough to change it.

specialist 10y ago

I disagree. I'll be surprised if any electronic voting system matches the integrity, performance, scalability, feature set of the Australian Ballot, of paper ballots cast at polls sites counted when the polls close. Your jurisdiction's voter registration database is (hopefully) up to date. YMMV. Note that verified reports of registration fraud are very, very few. Whereas caging, purging are fairly common. Briefly, On election day: voter shows up to correct poll site, shows some kind of ID (YMMV), name found in that location's poll book, voter signs in, ballot is issued, voter marks ballot, voter casts ballot. If there's any error (question) during this process, voter is issued a provisional ballot, to be adjudicated out of band. Ballots are counted before the polls open and again when the polls close. The bookkeeping is simple and easily verified. Everything is bundled in tamper evident seals, observed and signed by members of opposing parties, physically escorted by opposing members, etc.

smokeyj 10y ago
> Everything is bundled in tamper evident seals, observed and signed by members of opposing parties, physically escorted by opposing members, etc. I don't see why this level of security couldn't be used to randomly and deterministically assign crypto keys that are used for some kind of blockchain voting scheme. Put a thousand pre-known keys in a hat, one thousand people draw keys from a hat, the key is activated on the blockchain and points to a user-defined voting wallet. Now you have anonymous cryptographically verifiable voting with double spend protection. Am I missing something?
- RangerScience 10y ago
  I don't know, but I'm commenting to bookmark your comment.
- dispose13432 10y ago
  So you still have to come in to collect your ballot. Might as well just vote then and there
  - smokeyj 10y ago

geofft 10y ago

> public cryptographically verifiable ledger This is a thing you actively don't want. You don't want to be able to prove to anyone else how you voted. Otherwise it would be absolutely trivial for your boss to say, "So, you voted for that anti-union candidate, right?" (Or your boss to not say that, but just happen to give promotions to people who show proof of voting the way the boss wants.) The right to a secret ballot is demanded by the Universal Declaration of Human Rights. Yes, this renders the electronic voting problem - and honestly the voting problem in general - very close to impossible. That's why it's hard.

smokeyj 10y ago
>> Put a thousand pre-known keys in a hat, one thousand people draw keys from a hat, the key is activated on the blockchain and points to a user-defined voting wallet. Now you have anonymous cryptographically verifiable voting with double spend protection I just invented a scheme to anonymize votes in 5 minutes. I'm sure if smarter people tried we could definitively solve this. I'm not convinced this is hard as much as people are saying it's hard.
- vertex-four 10y ago
  So how does this stand up to "show me the private key you used"?
- tangent128 10y ago
  To prevent coercion, it's not sufficient to allow anonymity; you have to disallow means by which a person can prove how they voted.
  - smokeyj 10y ago
    How true is this? Somebody could just take a picture of their ballot (under the threat of violence presumably). Sure they're not supposed to, but at this point we're relying on legislation - where the legislation could say employers aren't allowed to ask for employees voting wallets. Maybe I'm missing something.

lazaroclapp 10y ago

Some of the places with the highest levels of distrust on electoral authorities and government bureaucracy solve this problem by marking your thumb with indelible ink, which can't be washed off but fades away over the course of a week or so. This guarantees people enter polling stations only once, even if they magically happen to have been registered at multiple places. We use this in Mexico, in addition to (non-digital) fingerprint-carrying voter ids. Historically, it has not prevented fraud in general (most of which happened due to insufficient audit procedures and rural polls not having observers from all parties, allowing for stuffed ballots and the like). It did however close that particular attack vector. My trust on the results of an individual polling station in an urban area with observers from all major and most minor parties is actually quite high, even as I know any or all of the observers involved are likely to be corrupt and have low regard for the law. The reason for this is that they are all incentivized to prevent each other from cheating and have the means to detect tampering in such setting (without needing uncommon expertise beyond observation and basic arithmetic). https://en.wikipedia.org/wiki/Election_ink https://en.wikipedia.org/wiki/Election_ink