12 ms·

Typically, the way this is done is through a smartcard, secured and provided by state officials. A vote has to be signed by the key that never leaves this devic

by Iv 8y ago

Typically, the way this is done is through a smartcard, secured and provided by state officials. A vote has to be signed by the key that never leaves this device. So even if you computer is infected by malware down to its USB firmware, it won't be able to fake many things. Just prevent you from voting. My main criticism is that as it is it could still feed the card with the wrong vote to sign. The (state-provided) USB reader should have a small lcd screen to sum up the thing being signed "Vote for Ms.Ryjavik on election #123" "Vote for Yes on vote #432" and a confirmation button. With these modifications, and the ability to check a cast vote has been received, you can have secure elections on insecure devices. However it requires trust in the officials to do their jobs correctly and to not tamper the tally. I, personally, love a lot of e-Estonia initiatives, but consider electronic voting to be a bad idea, unless you are ready to get rid of the anonymity of the vote (you can have secure non-anonymous remote voting)

deogeo 8y ago
> a smartcard, secured and provided by state officials [..] The (state-provided) USB reader [..] are not immune to attack either. Unless you go to the extraordinary lengths of making your own hardware in a facility you secure and keep secured for the duration of your democracy, there is no such thing as a 'secure device'. Not when the prize is something so hugely lucrative and advantageous as control over an entire country. All assuming you trust your government. With opposition parties monitoring vote counts, that's easy. But what about when they have to look for dopant-level chip defects?
- Latteland 8y ago
  In Washington state, all voting is via paper ballots mailed or dropped off at a voting location. You sign them. People end up having different ballots because your ballot is customized for the district you live in (unique city, school district, county, state combinations is a reasonable size). They verify your signature. You can track if you ballot was received (it's inside an inner envelope) and if your signature was confirmed or not. This feels safe, and as they have the original paper, they can revote - but they have all the ones in the district in a box somehow.
  - ataturk 8y ago
    I lost any respect I had for WA after I-1639. The ballot initiative that never actually got enough signatures, but Michael Bloomberg's money ensured it got on the ballot anyways. You're making felons out of everyday people now. Who cares how great your voting is when you can't even follow the US Constitution? It's a joke, it's all just a sick joke now.
- belorn 8y ago
  Who create the security tokens that banks use? I could see few things more lucrative and advantageous than a perfect backdoor into that hardware, especially since here in Sweden you can create electronic government ID from said token which can be used for everything except voting. It is not without reason that most common fraud here in Sweden (around 80%) is someone calling under false pretense asking a victim to use the hardware token in order for the fraudsters to create a new electronic id which is then used to empty the bank account, create credit accounts, and so on. So far those security tokens has had a perfect track record from a hardware perspective, as much good that does. Maybe that is a bomb waiting to explode but it is hard to see a stronger incentives for criminals than what already exist. When people here discuss electronic voting, security of the hardware tokens is not usually brought up. It is rather all the other elements which makes it a bad choice. There would be no physical ballots that can be verified, questionable anonymity, and a loss of a controlled voting environment. All the common solutions to those problems usually results in the conclusion that it then easier to just keep the current system as is.
  - dbdjfjrjvebd 8y ago
    The thing is that bank security is at least theoretically possible. Banks and/or governments act as a central sources of trust in such systems and trust for can be derived from this source. I.e. a bank could build the hardware tokens from scratch themselves. With an election the trust model is inverted. I'm not sure there is any practical way to allow the trust sources (every voter) to audit the hardware tokens.
    - kosievdmerwe 8y ago
      Also importantly, banks don't have to be anonymous. Every transaction has the identities of the people involved.
  - hopler 8y ago
    Electronic votes can be secured cryptographically. Votes can be counted per precinct instead of centrally, and then summed. The security factors of paper voting can be replicated electronically. "The authority might just lie about the count or throw away or counterfeit votes, or coerce voters other vote a certain way" is not solved by paper voting either, as seen in Russia and many other places.
zAy0LfpBZLC8mAC 8y ago
> My main criticism is that as it is it could still feed the card with the wrong vote to sign. In other words: It doesn't help at all against malware on the computer. > The (state-provided) USB reader should have a small lcd screen to sum up the thing being signed "Vote for Ms.Ryjavik on election #123" "Vote for Yes on vote #432" and a confirmation button. In other words: If the USB firmware is infected, it's still not secure. > With these modifications, and the ability to check a cast vote has been received, you can have secure elections on insecure devices. So, if you are using secure devices ... then you can have secure elections on insecure devices? In this scenario you aren't actually using the insecure device, other than for establishing a connection to the internet. Or rather, as you described it, it also functions as the input device--but that is a security problem because it can be used to violate the secrecy of the vote, so it's not actually secure that way either. The only way to make it secure (sort-of) is to not use the insecure device. > However it requires trust in the officials to do their jobs correctly and to not tamper the tally. And that is the reason why electronic voting is not an option. Elections have to be able to remove a government from power against its will. An election process that depends on the integrity and honesty of the government that you want to remove from power is inherently broken. An election process that only works when there is no conflict is not a useful election process.
- Mirioron 8y ago
  Considering Estonia's history, paper voting isn't exactly amazing either. The Soviet era showed that election fraud happens anyway. The problem with paper voting is that mistakes in counting happen very often. During the election that just happened in Estonia officials wrote the candidate number into the box that said how many votes they got.[1] In the 2016 US presidential election officials basically typod the election results in the town of Hazelhurst in Wisconsin, where almost half the votes went missing until a citizen volunteer noticed the mistake. The party officials nor election officials caught the mistake.[2] If mistakes like that can happen then how often do they go unnoticed? How often are these mistakes deliberate? [1] https://news.err.ee/916525/vote-miscount-in-narva-may-cost-ekre-mandate https://news.err.ee/916525/vote-miscount-in-narva-may-cost-e... [2] https://www.votingjustice.us/tags/election_integrity https://www.votingjustice.us/tags/election_integrity
Mirioron 8y ago
>My main criticism is that as it is it could still feed the card with the wrong vote to sign. The (state-provided) USB reader should have a small lcd screen to sum up the thing being signed "Vote for Ms.Ryjavik on election #123" "Vote for Yes on vote #432" and a confirmation button. You can check who you cast your vote for through online voting. You can do it 3 times for half an hour after you voting. You cast your vote on a PC and at the end the voting software shows you a QR code. You can then use an app on your phone provided by the government to check who your vote was counted for. Read more here: https://www.valimised.ee/en/internet-voting/checking-i-vote https://www.valimised.ee/en/internet-voting/checking-i-vote
- isostatic 8y ago
  So much for a secret ballot
  - Mirioron 8y ago
    You can vote multiple times though and the previous votes are discarded. You can even show up on election day at the end and it well override your online vote.
- eftpotrm 8y ago
  You can check that the reporting app tells you that you voted for who you think you voted for. You have no way of asserting that that was the vote that was actually counted in the reported result.
  - hopler 8y ago
    I don't know what Estonia does, but there are ways to publish the votes in a secure way that prevents anyone from decrypting a single vote, but lets anyone verify their vote was correctly counted using their own secret key. httpp://news.mit.edu/2009/rivest-voting Of course you need monitors from all interested parties to prevent ballot stuffing, but that's true in every election. It's up to monitors to read the voter list and verify that (probabilistically) there are no/few fake voters on it.

by Iv 8y ago

deogeo 8y ago

> a smartcard, secured and provided by state officials [..] The (state-provided) USB reader [..] are not immune to attack either. Unless you go to the extraordinary lengths of making your own hardware in a facility you secure and keep secured for the duration of your democracy, there is no such thing as a 'secure device'. Not when the prize is something so hugely lucrative and advantageous as control over an entire country. All assuming you trust your government. With opposition parties monitoring vote counts, that's easy. But what about when they have to look for dopant-level chip defects?

Latteland 8y ago
In Washington state, all voting is via paper ballots mailed or dropped off at a voting location. You sign them. People end up having different ballots because your ballot is customized for the district you live in (unique city, school district, county, state combinations is a reasonable size). They verify your signature. You can track if you ballot was received (it's inside an inner envelope) and if your signature was confirmed or not. This feels safe, and as they have the original paper, they can revote - but they have all the ones in the district in a box somehow.
- ataturk 8y ago
  I lost any respect I had for WA after I-1639. The ballot initiative that never actually got enough signatures, but Michael Bloomberg's money ensured it got on the ballot anyways. You're making felons out of everyday people now. Who cares how great your voting is when you can't even follow the US Constitution? It's a joke, it's all just a sick joke now.
belorn 8y ago
Who create the security tokens that banks use? I could see few things more lucrative and advantageous than a perfect backdoor into that hardware, especially since here in Sweden you can create electronic government ID from said token which can be used for everything except voting. It is not without reason that most common fraud here in Sweden (around 80%) is someone calling under false pretense asking a victim to use the hardware token in order for the fraudsters to create a new electronic id which is then used to empty the bank account, create credit accounts, and so on. So far those security tokens has had a perfect track record from a hardware perspective, as much good that does. Maybe that is a bomb waiting to explode but it is hard to see a stronger incentives for criminals than what already exist. When people here discuss electronic voting, security of the hardware tokens is not usually brought up. It is rather all the other elements which makes it a bad choice. There would be no physical ballots that can be verified, questionable anonymity, and a loss of a controlled voting environment. All the common solutions to those problems usually results in the conclusion that it then easier to just keep the current system as is.
- dbdjfjrjvebd 8y ago
  The thing is that bank security is at least theoretically possible. Banks and/or governments act as a central sources of trust in such systems and trust for can be derived from this source. I.e. a bank could build the hardware tokens from scratch themselves. With an election the trust model is inverted. I'm not sure there is any practical way to allow the trust sources (every voter) to audit the hardware tokens.
  - kosievdmerwe 8y ago
    Also importantly, banks don't have to be anonymous. Every transaction has the identities of the people involved.
- hopler 8y ago
  Electronic votes can be secured cryptographically. Votes can be counted per precinct instead of centrally, and then summed. The security factors of paper voting can be replicated electronically. "The authority might just lie about the count or throw away or counterfeit votes, or coerce voters other vote a certain way" is not solved by paper voting either, as seen in Russia and many other places.

zAy0LfpBZLC8mAC 8y ago

> My main criticism is that as it is it could still feed the card with the wrong vote to sign. In other words: It doesn't help at all against malware on the computer. > The (state-provided) USB reader should have a small lcd screen to sum up the thing being signed "Vote for Ms.Ryjavik on election #123" "Vote for Yes on vote #432" and a confirmation button. In other words: If the USB firmware is infected, it's still not secure. > With these modifications, and the ability to check a cast vote has been received, you can have secure elections on insecure devices. So, if you are using secure devices ... then you can have secure elections on insecure devices? In this scenario you aren't actually using the insecure device, other than for establishing a connection to the internet. Or rather, as you described it, it also functions as the input device--but that is a security problem because it can be used to violate the secrecy of the vote, so it's not actually secure that way either. The only way to make it secure (sort-of) is to not use the insecure device. > However it requires trust in the officials to do their jobs correctly and to not tamper the tally. And that is the reason why electronic voting is not an option. Elections have to be able to remove a government from power against its will. An election process that depends on the integrity and honesty of the government that you want to remove from power is inherently broken. An election process that only works when there is no conflict is not a useful election process.

Mirioron 8y ago
Considering Estonia's history, paper voting isn't exactly amazing either. The Soviet era showed that election fraud happens anyway. The problem with paper voting is that mistakes in counting happen very often. During the election that just happened in Estonia officials wrote the candidate number into the box that said how many votes they got.[1] In the 2016 US presidential election officials basically typod the election results in the town of Hazelhurst in Wisconsin, where almost half the votes went missing until a citizen volunteer noticed the mistake. The party officials nor election officials caught the mistake.[2] If mistakes like that can happen then how often do they go unnoticed? How often are these mistakes deliberate? [1] https://news.err.ee/916525/vote-miscount-in-narva-may-cost-ekre-mandate https://news.err.ee/916525/vote-miscount-in-narva-may-cost-e... [2] https://www.votingjustice.us/tags/election_integrity https://www.votingjustice.us/tags/election_integrity

Mirioron 8y ago

>My main criticism is that as it is it could still feed the card with the wrong vote to sign. The (state-provided) USB reader should have a small lcd screen to sum up the thing being signed "Vote for Ms.Ryjavik on election #123" "Vote for Yes on vote #432" and a confirmation button. You can check who you cast your vote for through online voting. You can do it 3 times for half an hour after you voting. You cast your vote on a PC and at the end the voting software shows you a QR code. You can then use an app on your phone provided by the government to check who your vote was counted for. Read more here: https://www.valimised.ee/en/internet-voting/checking-i-vote https://www.valimised.ee/en/internet-voting/checking-i-vote

isostatic 8y ago
So much for a secret ballot
- Mirioron 8y ago
  You can vote multiple times though and the previous votes are discarded. You can even show up on election day at the end and it well override your online vote.
eftpotrm 8y ago
You can check that the reporting app tells you that you voted for who you think you voted for. You have no way of asserting that that was the vote that was actually counted in the reported result.
- hopler 8y ago
  I don't know what Estonia does, but there are ways to publish the votes in a secure way that prevents anyone from decrypting a single vote, but lets anyone verify their vote was correctly counted using their own secret key. httpp://news.mit.edu/2009/rivest-voting Of course you need monitors from all interested parties to prevent ballot stuffing, but that's true in every election. It's up to monitors to read the voter list and verify that (probabilistically) there are no/few fake voters on it.