12 ms·

"The system has been designed to ensure that voters' computers are not infected by any kind of malware that could change or block their vote." I'm sure this ca

by deogeo 8y ago

"The system has been designed to ensure that voters' computers are not infected by any kind of malware that could change or block their vote." I'm sure this cannot be subverted by an attacker with the resources of USA/China/India/.., or with access to the supply chain from the chip fab onward (don't forget about malware hidden in USB cables!), or or,... And you'd have to be dead sure, because, unlike with physical votes, there will be few-to-none signs of subversion. You can vote physically, but what do a few physical votes matter when the attacker can change the vote of 30, 50, 70% of the population. And how do you change the system, when all parties promising to do so can't get enough votes? Edit: Example of what a voting system must be resistant against: https://www.schneier.com/blog/archives/2018/03/adding_backdoor.html https://www.schneier.com/blog/archives/2018/03/adding_backdo...

tim333 8y ago
>few-to-none signs of subversion You could make it so you can view your vote and check it was registered the way intended. If you voted A and it came out B that would be a sign.
- pedrocr 8y ago
  Now you can demonstrate to anyone what you voted. That's how you get people selling votes. In any reasonable election system you need to be able to be sure your vote is being counted without at the same time being able to prove who you voted for. The demands of voting are incredibly unsuited to digital systems and definitely to any online voting. For every layer of extra complexity you add there's either a way to subvert it to break another of the essential guarantees of voting or to use it to DoS your election.
  - xorcist 8y ago
    > That's how you get people selling votes. It's also important to realize that the mere suspicion of other people selling their votes is enough to undermine confidence in the system. And confidence in the system is pretty much the only thing you have to optimize for.
  - oarabbus_ 8y ago
    Can't you hash a signature of some manner to your vote in a manner only the individual can know how they voted? After all this is exactly how login/passwords work.
    - bobthepanda 8y ago
      Then you can extract that information from the voter in the same way you can extract a password; with a blunt object and enough force.
      - deleted 8y ago
        [deleted]
  - riffraff 8y ago
    You can avoid that, by having your vote correspond to multiple potential entries. But that is still pointless cause the person you sold your vote can be physically next to you, or you can film yourself voting. Online voting is unsafe, and should only be used if any other option is unfeasible.
    - jakeogh 8y ago
      Unfeasible? Simple, just call it unfeasible. It's a undefined word, perfect for manipulation. There are no circumstances where online political voting should be used. Ever.
    - darawk 8y ago
      You can film yourself voting now. Vote buying is not a serious problem, and can be readily solved by stiff jail time for attempting it, and large monetary rewards for reporting on people doing it. If you get 10 years in prison for trying to buy votes, and the government offers a standing reward of say, $100,000 for evidence that leads to a conviction, all of the sudden you have to pay substantially more than $100k/vote, which means that it's completely impractical to engage in.
      - pmoriarty 8y ago
        Those kinds of penalties and worse don't stop organized crime, for instance. Politicians also tend to do all sorts of crazy, risky and/or illegal things to get elected or for personal profit. Nixon and Trump spring readily to mind. If the reward is large enough, someone will risk it. Sometimes the reward doesn't even have to be large at all -- witness rich celebrities shoplifting, for instance. People can also be compromised and blackmailed in to committing crimes, or otherwise feel desperate and at the end of their ropes, so they'll try anything. That's to say that such laws shouldn't be made, but I am skeptical that they'll be enough.
        darawk 8y ago
        None of that makes any kind of sense. You can't risk it when the equilibrium is that bad for you. Remember, to make any appreciable dent in an election outcome, you need to convince thousands of people to vote for you, and not turn you in, despite the 100k reward. There is zero chance of that ever succeeding.
  - tim333 8y ago
    You could select voters at random, say one in a hundred gets and email saying would you like to check your vote?
    - Mirioron 8y ago
      They can already check their online vote, but some restrictions apply: https://www.valimised.ee/en/internet-voting/checking-i-vote https://www.valimised.ee/en/internet-voting/checking-i-vote Keep in mind that you need to check the vote on a different device than what you voted on.
  - antidesitter 8y ago
    > Now you can demonstrate to anyone what you voted. Not necessarily. It is possible to have verifiability and receipt freeness: https://en.wikipedia.org/wiki/End-to-end_auditable_voting_systems#Overview https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy... > The demands of voting are incredibly unsuited to digital systems and definitely to any online voting. Clearly you need to do more research before making such sweeping claims.
    - pedrocr 8y ago
      > Not necessarily. It is possible to have verifiability and receipt freeness I know these methods, but they were not used in OPs suggestion. They fix this issue and introduce others. > Clearly you need to do more research before making such sweeping claims. On the contrary, I'm willing to double down on my claim. I'm willing to provide either a breach or a denial of service for any digital or online voting system you care to describe. Electronic/Online voting is like catnip for programmers. We can consistently overcomplicate things and create these horribly complex constructs because we're sure there must be a solution. After all software is eating the world. Voting is however one of the few situations where the lack of sophistication of pen and paper works in your favor significantly.
      - antidesitter 8y ago
        > I know these methods, but they were not used in OPs suggestion. You knew it but didn’t mention it as an obvious neutralizer of your objection, in the context of a discussion about possibility (“you could”)? I doubt that. > I'm willing to provide either a breach or a denial of service for any digital or online voting system you care to describe. There are many systems in the literature. What are your credentials in this field? Are you a cryptanalyst? > Voting is however one of the few situations where the lack of sophistication of pen and paper works in your favor significantly. This is as myopic as saying “E-commerce and e-banking are some of the few situations where the lack of sophistication of pen and paper works in your favor significantly. The demands of e-commerce and e-banking are incredibly unsuited to digital systems and definitely to any online systems.”
  - runarberg 8y ago
    Say I sell my vote. The person picks a party I don’t agree with. I will simply vote for them anyway in the prelimenaries, screengrap my proof, and send to my customer. I can do this multiple times. Each time I void my previous ballot, betraying my previous customer. Then comes election day, then I show up in person and cast a physical ballot for the party that I favor. As a buyer, my customers have no way of knowing I didn’t void the preliminary ballot by showing up on election day. Note that frauding vote buyers this way is also possible in most election systems that have non-digital preliminaries.
    - Mirioron 8y ago
      This is exactly how the Estonian voting system works.
    - pedrocr 8y ago
      I can't see a way of that working without breaking down somehow: - If every time you vote you get a receipt for that vote that can be checked if it's still valid then you can send that receipt to the buyer and he can then check that your vote is still according to his purchase - If you can only check that the receipt was registered but not if it's still valid you can't check that your vote was correctly counted because you don't know if the vote has been changed after in multiple possible ways - If you can check that the vote actually is for candidate A at any time you can sell that access to the buyer for him to confirm - If the only way to avoid all this is to also cast an actually secret vote on election day the buyer now just needs to make sure you don't go to the polling place. Posting spotters at the door is not too hard. I don't see a way for you to actually be able to confirm your vote was counted and not having at the same time the ability to sell your vote in a verifiable way. Perfect verification isn't needed either. If you're selling your vote to the mob you'll have second thoughts about failing to deliver. If you make the process easier "honest" sellers will create the market. > Note that frauding vote buyers this way is also possible in most election systems that have non-digital preliminaries. Most I know are actually harder because you only get the single mail-in ballot so you can't do the double or triple voting. If you can show up on the day and invalidate your mail-in then part of same can be done. Depending on how the invalidation of the mail-in is done it can be even sketchier. But I don't consider mail-in and absentee paper votes to have enough security guarantees either way. Paper ballots, in a box, counted by adversaries is the gold standard. Everything else has a high burden of proof.
- IanCal 8y ago
  This makes voter intimidation much easier though. Nobody without a court order can check how I've voted, and can't ask me to show how I've voted.
  - deogeo 8y ago
    It should be impossible even with a court order, and I think most voting systems are set up like that. How else do you guard against the party in power, that can get all the court orders it wants?
    - IanCal 8y ago
      It's entirely possible in the UK, while "court order" is probably the wrong terminology, the core meaning is still there. Ballots are numbered and the number recorded against your name. You would need access to both to work out who voted for whom. I don't know of any reason why it could be accessed, though since parliament is sovereign "if a judge agrees" is always a safe disclaimer to add since the underlying law can be set.
      - deogeo 8y ago
        > Ballots are numbered and the number recorded against your name. It's hard for me to express what a terrible idea this is. Pray you never get a government that would exploit this.
        anticensor 8y ago
        Yes, that downgrades the election from secret vote to concealed open vote.
  - antidesitter 8y ago
    See https://news.ycombinator.com/item?id=19355603 https://news.ycombinator.com/item?id=19355603.
  - runarberg 8y ago
    Then vote for the party your intimidator picked, show them you voted for them when asked. Then simply vote again for the party you want (during election day if you are afraid they will show up unexpectedly again before election day), voiding your intimidated vote. Your intimidator will never know who you voted for during election day (unless they spied on you, but you also have that problem for non-digital votes)
- PostOnce 8y ago
  It seems simple for theoretical malware to show you the vote you believe you cast, so you'd have to log in and check your vote on a second device?
  - Tankenstein 8y ago
    This is actually what is done, you can download a phone app for iOS or Android, where you can scan a QR code you see when you vote to verify your vote. A vote can be checked after i-voting for up to three times during half an hour. Further reading: https://www.valimised.ee/en/internet-voting/checking-i-vote https://www.valimised.ee/en/internet-voting/checking-i-vote
- pmoriarty 8y ago
  "You could make it so you can view your vote and check it was registered the way intended." Then you have to trust the system to tell you the truth. These systems can be hacked or just designed to give you false results in the first place.
- Tankenstein 8y ago
  They've done this, you can download a phone app for iOS or Android, where you can scan a QR code you see when you vote to verify your vote. A vote can be checked after i-voting for up to three times during half an hour. Further reading: https://www.valimised.ee/en/internet-voting/checking-i-vote https://www.valimised.ee/en/internet-voting/checking-i-vote
Iv 8y ago
Typically, the way this is done is through a smartcard, secured and provided by state officials. A vote has to be signed by the key that never leaves this device. So even if you computer is infected by malware down to its USB firmware, it won't be able to fake many things. Just prevent you from voting. My main criticism is that as it is it could still feed the card with the wrong vote to sign. The (state-provided) USB reader should have a small lcd screen to sum up the thing being signed "Vote for Ms.Ryjavik on election #123" "Vote for Yes on vote #432" and a confirmation button. With these modifications, and the ability to check a cast vote has been received, you can have secure elections on insecure devices. However it requires trust in the officials to do their jobs correctly and to not tamper the tally. I, personally, love a lot of e-Estonia initiatives, but consider electronic voting to be a bad idea, unless you are ready to get rid of the anonymity of the vote (you can have secure non-anonymous remote voting)
- deogeo 8y ago
  > a smartcard, secured and provided by state officials [..] The (state-provided) USB reader [..] are not immune to attack either. Unless you go to the extraordinary lengths of making your own hardware in a facility you secure and keep secured for the duration of your democracy, there is no such thing as a 'secure device'. Not when the prize is something so hugely lucrative and advantageous as control over an entire country. All assuming you trust your government. With opposition parties monitoring vote counts, that's easy. But what about when they have to look for dopant-level chip defects?
  - Latteland 8y ago
    In Washington state, all voting is via paper ballots mailed or dropped off at a voting location. You sign them. People end up having different ballots because your ballot is customized for the district you live in (unique city, school district, county, state combinations is a reasonable size). They verify your signature. You can track if you ballot was received (it's inside an inner envelope) and if your signature was confirmed or not. This feels safe, and as they have the original paper, they can revote - but they have all the ones in the district in a box somehow.
EGreg 8y ago
Really, it strikes me how luddite people are when it comes to voting. In every other case, people welcome technology making stuff easier. But in this area, all I hear is complaints how far the voting booth is, how you need ID, how there is no national holiday and so on. What about absentee ballots? How do you make sure they were mailed by the right person? Listen, if an attacker can subvert 30% of the votes, don’t you think they would also be able to subvert 30% of bank accounts which would use the same security? Banks let use an app to withdraw $100,000. Why not for voting which is far less valuable? Think about it... anyone can just as easily bring a ton of paper ballots and stuff the box that way. If you are concerned about the vote being illegitimate then have everyone submit an encrypted video of themselves saying the vote along with the vote, and the app recognizes what is said, displays it on the screen and the person clicks OK. EDIT: To the automatic downvoters - why do you trust your bank’s app to manage a lot of money but not an app for voting?
- jedberg 8y ago
  Banks aren’t anonymous.
  - EGreg 8y ago
    What does that have to do with anything? Can you elaborate so we can see if your argument holds up?
    - jedberg 8y ago
      Voting requires anonymity, so you lose a lot of the security because of that. For a bank, you have a PIN that is tied to your identity. You may also have a second factor that is tied to your identity. The bank can use this to positively identify that you are the one making the transaction, and tie it back to you. You can also verify the transactions after the fact because it isn't anonymous. You can log into your account and check to make sure what the bank thinks happened actually happened. And if it didn't happen the way you say, you can contest it. Also, the risk is actually lower because the bank assumes liability. If a false transaction is made you can protest it and if you prove that it wasn't you who made the transaction, you get your money back. With voting, you can't get your vote back.
Tankenstein 8y ago
> there will be few-to-none signs of subversion One thing the Estonian system does is that you can verify your vote on a mobile device by scanning a qr code that you see when you cast the digital vote. A vote can be checked after i-voting for up to three times during half an hour. I imagine if any mismatch was detected the country would shut off i-voting immediately. Further reading: https://www.valimised.ee/en/internet-voting/checking-i-vote https://www.valimised.ee/en/internet-voting/checking-i-vote
- yason 8y ago
  You're not supposed to be able to verify votes after the fact because that would enable buying votes.
  - jakubp 8y ago
    As if democracies aren't buying votes already en masse?! Lobbying is just that, on a scale that actually matters more (directly at policy decision making point).
  - Mirioron 8y ago
    You can vote multiple times through online voting. This means that buying votes like this wouldn't be very effective. Online voting also ends a few days before election day at which point a person can go and vote in person. The vote in person counts over the online vote.
mcv 8y ago
This is one of the reasons why Netherland has banned voting machines completely. We're back to paper and pencil because it's easy to verify that all votes have been counted.
codedokode 8y ago
Why are you searching attackers outside? I don't know how it works in other countries, but in Russia the elections are always "hacked" by the government. You don't need any special resources or a backdoor, you just need a loyal sysadmin.

by deogeo 8y ago

tim333 8y ago

>few-to-none signs of subversion You could make it so you can view your vote and check it was registered the way intended. If you voted A and it came out B that would be a sign.

pedrocr 8y ago
Now you can demonstrate to anyone what you voted. That's how you get people selling votes. In any reasonable election system you need to be able to be sure your vote is being counted without at the same time being able to prove who you voted for. The demands of voting are incredibly unsuited to digital systems and definitely to any online voting. For every layer of extra complexity you add there's either a way to subvert it to break another of the essential guarantees of voting or to use it to DoS your election.
- xorcist 8y ago
  > That's how you get people selling votes. It's also important to realize that the mere suspicion of other people selling their votes is enough to undermine confidence in the system. And confidence in the system is pretty much the only thing you have to optimize for.
- oarabbus_ 8y ago
  Can't you hash a signature of some manner to your vote in a manner only the individual can know how they voted? After all this is exactly how login/passwords work.
  - bobthepanda 8y ago
    Then you can extract that information from the voter in the same way you can extract a password; with a blunt object and enough force.
    - deleted 8y ago
      [deleted]
- riffraff 8y ago
  You can avoid that, by having your vote correspond to multiple potential entries. But that is still pointless cause the person you sold your vote can be physically next to you, or you can film yourself voting. Online voting is unsafe, and should only be used if any other option is unfeasible.
  - jakeogh 8y ago
    Unfeasible? Simple, just call it unfeasible. It's a undefined word, perfect for manipulation. There are no circumstances where online political voting should be used. Ever.
  - darawk 8y ago
    You can film yourself voting now. Vote buying is not a serious problem, and can be readily solved by stiff jail time for attempting it, and large monetary rewards for reporting on people doing it. If you get 10 years in prison for trying to buy votes, and the government offers a standing reward of say, $100,000 for evidence that leads to a conviction, all of the sudden you have to pay substantially more than $100k/vote, which means that it's completely impractical to engage in.
    - pmoriarty 8y ago
      Those kinds of penalties and worse don't stop organized crime, for instance. Politicians also tend to do all sorts of crazy, risky and/or illegal things to get elected or for personal profit. Nixon and Trump spring readily to mind. If the reward is large enough, someone will risk it. Sometimes the reward doesn't even have to be large at all -- witness rich celebrities shoplifting, for instance. People can also be compromised and blackmailed in to committing crimes, or otherwise feel desperate and at the end of their ropes, so they'll try anything. That's to say that such laws shouldn't be made, but I am skeptical that they'll be enough.
      - darawk 8y ago
        None of that makes any kind of sense. You can't risk it when the equilibrium is that bad for you. Remember, to make any appreciable dent in an election outcome, you need to convince thousands of people to vote for you, and not turn you in, despite the 100k reward. There is zero chance of that ever succeeding.
- tim333 8y ago
  You could select voters at random, say one in a hundred gets and email saying would you like to check your vote?
  - Mirioron 8y ago
    They can already check their online vote, but some restrictions apply: https://www.valimised.ee/en/internet-voting/checking-i-vote https://www.valimised.ee/en/internet-voting/checking-i-vote Keep in mind that you need to check the vote on a different device than what you voted on.
- antidesitter 8y ago
  > Now you can demonstrate to anyone what you voted. Not necessarily. It is possible to have verifiability and receipt freeness: https://en.wikipedia.org/wiki/End-to-end_auditable_voting_systems#Overview https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy... > The demands of voting are incredibly unsuited to digital systems and definitely to any online voting. Clearly you need to do more research before making such sweeping claims.
  - pedrocr 8y ago
    > Not necessarily. It is possible to have verifiability and receipt freeness I know these methods, but they were not used in OPs suggestion. They fix this issue and introduce others. > Clearly you need to do more research before making such sweeping claims. On the contrary, I'm willing to double down on my claim. I'm willing to provide either a breach or a denial of service for any digital or online voting system you care to describe. Electronic/Online voting is like catnip for programmers. We can consistently overcomplicate things and create these horribly complex constructs because we're sure there must be a solution. After all software is eating the world. Voting is however one of the few situations where the lack of sophistication of pen and paper works in your favor significantly.
    - antidesitter 8y ago
      > I know these methods, but they were not used in OPs suggestion. You knew it but didn’t mention it as an obvious neutralizer of your objection, in the context of a discussion about possibility (“you could”)? I doubt that. > I'm willing to provide either a breach or a denial of service for any digital or online voting system you care to describe. There are many systems in the literature. What are your credentials in this field? Are you a cryptanalyst? > Voting is however one of the few situations where the lack of sophistication of pen and paper works in your favor significantly. This is as myopic as saying “E-commerce and e-banking are some of the few situations where the lack of sophistication of pen and paper works in your favor significantly. The demands of e-commerce and e-banking are incredibly unsuited to digital systems and definitely to any online systems.”
- runarberg 8y ago
  Say I sell my vote. The person picks a party I don’t agree with. I will simply vote for them anyway in the prelimenaries, screengrap my proof, and send to my customer. I can do this multiple times. Each time I void my previous ballot, betraying my previous customer. Then comes election day, then I show up in person and cast a physical ballot for the party that I favor. As a buyer, my customers have no way of knowing I didn’t void the preliminary ballot by showing up on election day. Note that frauding vote buyers this way is also possible in most election systems that have non-digital preliminaries.
  - Mirioron 8y ago
    This is exactly how the Estonian voting system works.
  - pedrocr 8y ago
    I can't see a way of that working without breaking down somehow: - If every time you vote you get a receipt for that vote that can be checked if it's still valid then you can send that receipt to the buyer and he can then check that your vote is still according to his purchase - If you can only check that the receipt was registered but not if it's still valid you can't check that your vote was correctly counted because you don't know if the vote has been changed after in multiple possible ways - If you can check that the vote actually is for candidate A at any time you can sell that access to the buyer for him to confirm - If the only way to avoid all this is to also cast an actually secret vote on election day the buyer now just needs to make sure you don't go to the polling place. Posting spotters at the door is not too hard. I don't see a way for you to actually be able to confirm your vote was counted and not having at the same time the ability to sell your vote in a verifiable way. Perfect verification isn't needed either. If you're selling your vote to the mob you'll have second thoughts about failing to deliver. If you make the process easier "honest" sellers will create the market. > Note that frauding vote buyers this way is also possible in most election systems that have non-digital preliminaries. Most I know are actually harder because you only get the single mail-in ballot so you can't do the double or triple voting. If you can show up on the day and invalidate your mail-in then part of same can be done. Depending on how the invalidation of the mail-in is done it can be even sketchier. But I don't consider mail-in and absentee paper votes to have enough security guarantees either way. Paper ballots, in a box, counted by adversaries is the gold standard. Everything else has a high burden of proof.
IanCal 8y ago
This makes voter intimidation much easier though. Nobody without a court order can check how I've voted, and can't ask me to show how I've voted.
- deogeo 8y ago
  It should be impossible even with a court order, and I think most voting systems are set up like that. How else do you guard against the party in power, that can get all the court orders it wants?
  - IanCal 8y ago
    It's entirely possible in the UK, while "court order" is probably the wrong terminology, the core meaning is still there. Ballots are numbered and the number recorded against your name. You would need access to both to work out who voted for whom. I don't know of any reason why it could be accessed, though since parliament is sovereign "if a judge agrees" is always a safe disclaimer to add since the underlying law can be set.
    - deogeo 8y ago
      > Ballots are numbered and the number recorded against your name. It's hard for me to express what a terrible idea this is. Pray you never get a government that would exploit this.
      - anticensor 8y ago
        Yes, that downgrades the election from secret vote to concealed open vote.
- antidesitter 8y ago
  See https://news.ycombinator.com/item?id=19355603 https://news.ycombinator.com/item?id=19355603.
- runarberg 8y ago
  Then vote for the party your intimidator picked, show them you voted for them when asked. Then simply vote again for the party you want (during election day if you are afraid they will show up unexpectedly again before election day), voiding your intimidated vote. Your intimidator will never know who you voted for during election day (unless they spied on you, but you also have that problem for non-digital votes)
PostOnce 8y ago
It seems simple for theoretical malware to show you the vote you believe you cast, so you'd have to log in and check your vote on a second device?
- Tankenstein 8y ago
  This is actually what is done, you can download a phone app for iOS or Android, where you can scan a QR code you see when you vote to verify your vote. A vote can be checked after i-voting for up to three times during half an hour. Further reading: https://www.valimised.ee/en/internet-voting/checking-i-vote https://www.valimised.ee/en/internet-voting/checking-i-vote
pmoriarty 8y ago
"You could make it so you can view your vote and check it was registered the way intended." Then you have to trust the system to tell you the truth. These systems can be hacked or just designed to give you false results in the first place.
Tankenstein 8y ago
They've done this, you can download a phone app for iOS or Android, where you can scan a QR code you see when you vote to verify your vote. A vote can be checked after i-voting for up to three times during half an hour. Further reading: https://www.valimised.ee/en/internet-voting/checking-i-vote https://www.valimised.ee/en/internet-voting/checking-i-vote

Iv 8y ago

Typically, the way this is done is through a smartcard, secured and provided by state officials. A vote has to be signed by the key that never leaves this device. So even if you computer is infected by malware down to its USB firmware, it won't be able to fake many things. Just prevent you from voting. My main criticism is that as it is it could still feed the card with the wrong vote to sign. The (state-provided) USB reader should have a small lcd screen to sum up the thing being signed "Vote for Ms.Ryjavik on election #123" "Vote for Yes on vote #432" and a confirmation button. With these modifications, and the ability to check a cast vote has been received, you can have secure elections on insecure devices. However it requires trust in the officials to do their jobs correctly and to not tamper the tally. I, personally, love a lot of e-Estonia initiatives, but consider electronic voting to be a bad idea, unless you are ready to get rid of the anonymity of the vote (you can have secure non-anonymous remote voting)

deogeo 8y ago
> a smartcard, secured and provided by state officials [..] The (state-provided) USB reader [..] are not immune to attack either. Unless you go to the extraordinary lengths of making your own hardware in a facility you secure and keep secured for the duration of your democracy, there is no such thing as a 'secure device'. Not when the prize is something so hugely lucrative and advantageous as control over an entire country. All assuming you trust your government. With opposition parties monitoring vote counts, that's easy. But what about when they have to look for dopant-level chip defects?
- Latteland 8y ago
  In Washington state, all voting is via paper ballots mailed or dropped off at a voting location. You sign them. People end up having different ballots because your ballot is customized for the district you live in (unique city, school district, county, state combinations is a reasonable size). They verify your signature. You can track if you ballot was received (it's inside an inner envelope) and if your signature was confirmed or not. This feels safe, and as they have the original paper, they can revote - but they have all the ones in the district in a box somehow.

EGreg 8y ago

Really, it strikes me how luddite people are when it comes to voting. In every other case, people welcome technology making stuff easier. But in this area, all I hear is complaints how far the voting booth is, how you need ID, how there is no national holiday and so on. What about absentee ballots? How do you make sure they were mailed by the right person? Listen, if an attacker can subvert 30% of the votes, don’t you think they would also be able to subvert 30% of bank accounts which would use the same security? Banks let use an app to withdraw $100,000. Why not for voting which is far less valuable? Think about it... anyone can just as easily bring a ton of paper ballots and stuff the box that way. If you are concerned about the vote being illegitimate then have everyone submit an encrypted video of themselves saying the vote along with the vote, and the app recognizes what is said, displays it on the screen and the person clicks OK. EDIT: To the automatic downvoters - why do you trust your bank’s app to manage a lot of money but not an app for voting?

jedberg 8y ago
Banks aren’t anonymous.
- EGreg 8y ago
  What does that have to do with anything? Can you elaborate so we can see if your argument holds up?
  - jedberg 8y ago
    Voting requires anonymity, so you lose a lot of the security because of that. For a bank, you have a PIN that is tied to your identity. You may also have a second factor that is tied to your identity. The bank can use this to positively identify that you are the one making the transaction, and tie it back to you. You can also verify the transactions after the fact because it isn't anonymous. You can log into your account and check to make sure what the bank thinks happened actually happened. And if it didn't happen the way you say, you can contest it. Also, the risk is actually lower because the bank assumes liability. If a false transaction is made you can protest it and if you prove that it wasn't you who made the transaction, you get your money back. With voting, you can't get your vote back.

Tankenstein 8y ago

> there will be few-to-none signs of subversion One thing the Estonian system does is that you can verify your vote on a mobile device by scanning a qr code that you see when you cast the digital vote. A vote can be checked after i-voting for up to three times during half an hour. I imagine if any mismatch was detected the country would shut off i-voting immediately. Further reading: https://www.valimised.ee/en/internet-voting/checking-i-vote https://www.valimised.ee/en/internet-voting/checking-i-vote

yason 8y ago
You're not supposed to be able to verify votes after the fact because that would enable buying votes.
- jakubp 8y ago
  As if democracies aren't buying votes already en masse?! Lobbying is just that, on a scale that actually matters more (directly at policy decision making point).
- Mirioron 8y ago
  You can vote multiple times through online voting. This means that buying votes like this wouldn't be very effective. Online voting also ends a few days before election day at which point a person can go and vote in person. The vote in person counts over the online vote.

mcv 8y ago

This is one of the reasons why Netherland has banned voting machines completely. We're back to paper and pencil because it's easy to verify that all votes have been counted.

codedokode 8y ago

Why are you searching attackers outside? I don't know how it works in other countries, but in Russia the elections are always "hacked" by the government. You don't need any special resources or a backdoor, you just need a loyal sysadmin.