6 ms·

For something as important as an election, it should be simple enough for people to understand the process and believe in the result. Another solution to addin

by Buetol 7y ago

For something as important as an election, it should be simple enough for people to understand the process and believe in the result. Another solution to adding more trust into the elections: People could be able to annotate their physical ballot with a token, each vote with each token is then published and people can see for themselves that their vote has been taken into account.

SiempreViernes 7y ago
Votes being indistinguishable after castion is a pretty importsnt feature for hindering large scale fraud, as a second party has no way of verifying your choice afterwards.
- mirekrusin 7y ago
  If you generate ie. random 32 bytes attached to vote, nobody will infer anything from it, except you, who know it.
  - SiempreViernes 7y ago
    Yes, and then your coercers will ask it from you so they can verify you did as demanded. Then need to provide 32 random and unique bytes attached to a vote that has the stipulated outcome. Good luck achieving that by randomly guessing a token.
    - jaimeyap 7y ago
      I might be mistaken. But either you have the ability to verify your specific vote was cast, for the person you expected to cast it for. Or you don't. It would seem impossible to offer election confidence to the majority of people without a simple system that has this property. If kidnapping and torture are on the table for your threat model. I think most people's voting record could be figured out with near 100% accuracy if they get access to your computer logins, emails, hacker news account, and all your social media accounts. Which according to your coercion model, they totally could. No need to go after your vote token specifically. So unless the voting system singles you out in particular (which a random token wouldn't. Every vote would have one). Ruling it out as a solution because of a super low probability scenario seems like a misattribution of probability in the face of clear value (ie. easy and private verifiability by all parties). Having secure elections is how we create a world where no one has to worry about coercers coming after them.
      - nabla9 7y ago
        You underestimate this treat model. We know from the history that if votes can be checked, the misuse will increase. * In traditional families women will effectively lose their vote. * Vote buying becomes possible. * fellow party or church members start to check the votes. The ability to use smartphones to take pictures in ballot box is already threatening secret ballot. Let's remove secret ballot so that we can have secret ballot is not valid solution.
        jaimeyap 7y ago
        It seems like the argument here reduces to "personally verifiable votes should never exist". > In traditional families women will effectively lose their vote. People can lie. That's the only recourse they have today right? Would producing a "plausible deniability token" to show to adversaries suffice here to provide usable cover? > Vote buying becomes possible. This is already possible. Though you are right that it is not strictly verifiable today. But I would argue that we lack data on how many people would take money to vote X in todays system, and then vote Y instead and lie about it. If this set is tiny, then this problem doesn't grow much does it? > fellow party or church members start to check the votes This should simply be illegal. Bright line. Your vote is private and no-one or organization shall be allowed to force you to disclose it. --- It seems again like the arguments here are sort of baby/bath water. There are outlier problems preventing this from being perfect. Yes. But the benefit of a truly verifiable election would inoculate us against mass election hacking. Which increasingly seems like a genuine threat we need to deal with. Are the outlier problems not worth the price of preserving democracy?
        nabla9 7y ago
        > There are outlier problems preventing this from being perfect These are not outlier problems. I have been election official in Finland and it's not rare to see husband trying to make his wife to show the ballot. Smartphones are already creating problems that are hard to quantify. The real solution comes from doing basic things right. Electoral observation can be improved. Paper ballots standard where ballots can be quickly counted using electronica counters from multiple suppliers (different parties can bring their own) can make voting both secure and safe.
    - mirekrusin 7y ago
      You can use zero knowlege proofs for that, you don't need to reveal which vote is yours, just the proof that you've voted.
  - deleted 7y ago
    [deleted]
sfifs 7y ago
> each vote with each token is then published and people can see for themselves that their vote has been taken into account. Generally this is precisely what you want to avoid because then the parties can verify who cast what vote by simple intimidation. The party in power or with physical control of an area can "check" who you voted for before providing you benefits/take revenge. This is not imagination - a lot of US democracy ran like this well into the 1920s and many non U/Canada/Western Europe democracies face these challenges. There is a reason Indian elections happens as it does in 6-7 phases with central paramilitary forces essentially flooding the areas that are voting to prevent (realistically reduce) intimidation and strong arm, ensuring voting officials come from a different part of the country to prevent influence and mixing up counts from polling booths to reduce chances of "area" wise retribution by political parties. It is very complex and expensive but the exercise seems to give roughly what majority wants and has seen many cases of powerful strongmen and women being voted out of power.
- lukas099 7y ago
  If someone is being coerced, couldn't they just lie and say they had a different token?
  - sfifs 7y ago
    Yes that works with one person-person engagement, not when an entire entire locality covered is threatened by a political party. All this and more has actually happened in the hundreds of elections in India since democracy was established leading to the multitude of checks and balances in the process
- admax88q 7y ago
  It seems to be a common theme of western people in HN trying to protect against a malicious vote counter, often overlooking the very real intimidation problems. I maintain that paper ballots are the best voting mechanism. They are cheap, prevent intimidation, scale and reasonably trustworthy. I say they scale because you can parallelize easily by getting more citizens counting ballots. This is a good thing. The more people involved in counting the more you have to coerce to reasonably affect the outcome. Electionic voting machines like in the US seem insane to me. All the power is in a select few who create the machines. If you can't source enough trustworthy volunteers to count paper ballots then your democracy might be screwed anyways.
the_snooze 7y ago
>For something as important as an election, it should be simple enough for people to understand the process and believe in the result. In my county in California, the first voter to arrive has the responsibility of verifying that the ballot scanner is empty and that its printout reads all 0's. That person then serves as a witness to the poll workers applying tamper-evident seals to the scanner door and data module. This takes no more than two or three minutes to accomplish, and anyone with reasonably working eyeballs can carry this out. You lose this scrutability when you introduce cryptographic proofs and multi-step algorithms into the process.
- hanniabu 7y ago
  How does anybody know it's not just a friend that was told to come early? This sounds like such a ridiculously easy rule to get around that it's almost unnecessary to even have it
  - the_snooze 7y ago
    I mean anything is easy if you have a perfect conspiracy between the precinct workers, county inspector, results auditors, and public witness.
  - hannasanarion 7y ago
    Yeah, but the conspiracy to carry it out would need to be absurdly large.
Nursie 7y ago
This seems to be a favourite topic for people here - make votes able to be checked by voters. I've seen many proposed implementations but they all fail because if I can prove my vote to myself in any way, someone else can make me prove it to them either to buy or coerce my ballot.
- hjk05 7y ago
  Not necessarily. You could provide people with a 4 digit code they can use alongside their id to verify that their vote was counted as they intended, but also give them access to a tool that allows them to receive a code that “proves” their vote was counted for any arbitrary party. That way you can verify you own code because you know the real reference code, but anyone else can’t rely on your vote truthfully being anything beyond them trusting you, which is already the case for the current system.
  - Nursie 7y ago
    Not sure I'm seeing the 'proof' there. By what mechanism do these two codes prove anything much? If the 'real' code shows one thing and the 'fake' codes another what assurance do you have that the counting was done with your 'real' code and the voting machine didn't put another one in there?
    - aeternus 7y ago
      Here's one way to do it that requires basically zero trust in the software: 1) When voters enter the booth, they throw a large number of multi-sided dice. 2) The resultant throw is scanned via computer-vision. Voter verifies it is correct, and it becomes the voter's ID. Voter votes normally and the vote is recorded alongside that generated "ID". 3) The voter receives a print-out that contains their (ID, vote), however it is randomly shuffled in among other real (ID, vote) pairs. The print-out is guaranteed to have at least one vote for each candidate. 4) The entire list of (ID, vote) pairs can be published nationally. Everyone can verify that the right number of votes were counted, and that their vote was accurately counted since they can find both their ID and vote in the national list. They can show their receipt to others but cannot prove which one of the many IDs on the receipt was actually theirs.
sametmax 7y ago
As a professional developer, I wouldn't trust myself to audit a voting system and swear on my life it's safe to use for my country. Now, let's step back and remember that MOST PEOPLE DON'T KNOW WHAT AN URL IS. They can't tell the difference between an app and a web site. Internet, the browser and Google. A good part of them still think the Sun goes around the Earth. Even with current simple paper based systems, elections are being influenced. There is no way in hell that anything electronic is going to be kept safe by the general population, unless we duplicate the votes on paper for review, which for me kinda defeat the purpose of going digital. Elections are not a technical problem. Actually the more technical you get, the smarter you try to make it, the farther away you are from helping society. Now an electronic system to make polls for the general population, or for small entities, make sense. So it's still a good subject for research. But if people that have a hard time to read out loud must inspect a hard drive to make sure it hasn't been tempered with, it's game over.
BvqxAZmrY4ZM3uH 7y ago
This doesn't solve the problem of "Stuffing", or "dead people voting". You could see your vote is still as you voted, but you don't know if only people who are allowed to vote did so.

by Buetol 7y ago

SiempreViernes 7y ago

Votes being indistinguishable after castion is a pretty importsnt feature for hindering large scale fraud, as a second party has no way of verifying your choice afterwards.

mirekrusin 7y ago
If you generate ie. random 32 bytes attached to vote, nobody will infer anything from it, except you, who know it.
- SiempreViernes 7y ago
  Yes, and then your coercers will ask it from you so they can verify you did as demanded. Then need to provide 32 random and unique bytes attached to a vote that has the stipulated outcome. Good luck achieving that by randomly guessing a token.
  - jaimeyap 7y ago
    I might be mistaken. But either you have the ability to verify your specific vote was cast, for the person you expected to cast it for. Or you don't. It would seem impossible to offer election confidence to the majority of people without a simple system that has this property. If kidnapping and torture are on the table for your threat model. I think most people's voting record could be figured out with near 100% accuracy if they get access to your computer logins, emails, hacker news account, and all your social media accounts. Which according to your coercion model, they totally could. No need to go after your vote token specifically. So unless the voting system singles you out in particular (which a random token wouldn't. Every vote would have one). Ruling it out as a solution because of a super low probability scenario seems like a misattribution of probability in the face of clear value (ie. easy and private verifiability by all parties). Having secure elections is how we create a world where no one has to worry about coercers coming after them.
    - nabla9 7y ago
      You underestimate this treat model. We know from the history that if votes can be checked, the misuse will increase. * In traditional families women will effectively lose their vote. * Vote buying becomes possible. * fellow party or church members start to check the votes. The ability to use smartphones to take pictures in ballot box is already threatening secret ballot. Let's remove secret ballot so that we can have secret ballot is not valid solution.
      - jaimeyap 7y ago
        It seems like the argument here reduces to "personally verifiable votes should never exist". > In traditional families women will effectively lose their vote. People can lie. That's the only recourse they have today right? Would producing a "plausible deniability token" to show to adversaries suffice here to provide usable cover? > Vote buying becomes possible. This is already possible. Though you are right that it is not strictly verifiable today. But I would argue that we lack data on how many people would take money to vote X in todays system, and then vote Y instead and lie about it. If this set is tiny, then this problem doesn't grow much does it? > fellow party or church members start to check the votes This should simply be illegal. Bright line. Your vote is private and no-one or organization shall be allowed to force you to disclose it. --- It seems again like the arguments here are sort of baby/bath water. There are outlier problems preventing this from being perfect. Yes. But the benefit of a truly verifiable election would inoculate us against mass election hacking. Which increasingly seems like a genuine threat we need to deal with. Are the outlier problems not worth the price of preserving democracy?
        nabla9 7y ago
        > There are outlier problems preventing this from being perfect These are not outlier problems. I have been election official in Finland and it's not rare to see husband trying to make his wife to show the ballot. Smartphones are already creating problems that are hard to quantify. The real solution comes from doing basic things right. Electoral observation can be improved. Paper ballots standard where ballots can be quickly counted using electronica counters from multiple suppliers (different parties can bring their own) can make voting both secure and safe.
  - mirekrusin 7y ago
    You can use zero knowlege proofs for that, you don't need to reveal which vote is yours, just the proof that you've voted.
- deleted 7y ago
  [deleted]

sfifs 7y ago

> each vote with each token is then published and people can see for themselves that their vote has been taken into account. Generally this is precisely what you want to avoid because then the parties can verify who cast what vote by simple intimidation. The party in power or with physical control of an area can "check" who you voted for before providing you benefits/take revenge. This is not imagination - a lot of US democracy ran like this well into the 1920s and many non U/Canada/Western Europe democracies face these challenges. There is a reason Indian elections happens as it does in 6-7 phases with central paramilitary forces essentially flooding the areas that are voting to prevent (realistically reduce) intimidation and strong arm, ensuring voting officials come from a different part of the country to prevent influence and mixing up counts from polling booths to reduce chances of "area" wise retribution by political parties. It is very complex and expensive but the exercise seems to give roughly what majority wants and has seen many cases of powerful strongmen and women being voted out of power.

lukas099 7y ago
If someone is being coerced, couldn't they just lie and say they had a different token?
- sfifs 7y ago
  Yes that works with one person-person engagement, not when an entire entire locality covered is threatened by a political party. All this and more has actually happened in the hundreds of elections in India since democracy was established leading to the multitude of checks and balances in the process
admax88q 7y ago
It seems to be a common theme of western people in HN trying to protect against a malicious vote counter, often overlooking the very real intimidation problems. I maintain that paper ballots are the best voting mechanism. They are cheap, prevent intimidation, scale and reasonably trustworthy. I say they scale because you can parallelize easily by getting more citizens counting ballots. This is a good thing. The more people involved in counting the more you have to coerce to reasonably affect the outcome. Electionic voting machines like in the US seem insane to me. All the power is in a select few who create the machines. If you can't source enough trustworthy volunteers to count paper ballots then your democracy might be screwed anyways.

the_snooze 7y ago

>For something as important as an election, it should be simple enough for people to understand the process and believe in the result. In my county in California, the first voter to arrive has the responsibility of verifying that the ballot scanner is empty and that its printout reads all 0's. That person then serves as a witness to the poll workers applying tamper-evident seals to the scanner door and data module. This takes no more than two or three minutes to accomplish, and anyone with reasonably working eyeballs can carry this out. You lose this scrutability when you introduce cryptographic proofs and multi-step algorithms into the process.

hanniabu 7y ago
How does anybody know it's not just a friend that was told to come early? This sounds like such a ridiculously easy rule to get around that it's almost unnecessary to even have it
- the_snooze 7y ago
  I mean anything is easy if you have a perfect conspiracy between the precinct workers, county inspector, results auditors, and public witness.
- hannasanarion 7y ago
  Yeah, but the conspiracy to carry it out would need to be absurdly large.

Nursie 7y ago

This seems to be a favourite topic for people here - make votes able to be checked by voters. I've seen many proposed implementations but they all fail because if I can prove my vote to myself in any way, someone else can make me prove it to them either to buy or coerce my ballot.

hjk05 7y ago
Not necessarily. You could provide people with a 4 digit code they can use alongside their id to verify that their vote was counted as they intended, but also give them access to a tool that allows them to receive a code that “proves” their vote was counted for any arbitrary party. That way you can verify you own code because you know the real reference code, but anyone else can’t rely on your vote truthfully being anything beyond them trusting you, which is already the case for the current system.
- Nursie 7y ago
  Not sure I'm seeing the 'proof' there. By what mechanism do these two codes prove anything much? If the 'real' code shows one thing and the 'fake' codes another what assurance do you have that the counting was done with your 'real' code and the voting machine didn't put another one in there?
  - aeternus 7y ago
    Here's one way to do it that requires basically zero trust in the software: 1) When voters enter the booth, they throw a large number of multi-sided dice. 2) The resultant throw is scanned via computer-vision. Voter verifies it is correct, and it becomes the voter's ID. Voter votes normally and the vote is recorded alongside that generated "ID". 3) The voter receives a print-out that contains their (ID, vote), however it is randomly shuffled in among other real (ID, vote) pairs. The print-out is guaranteed to have at least one vote for each candidate. 4) The entire list of (ID, vote) pairs can be published nationally. Everyone can verify that the right number of votes were counted, and that their vote was accurately counted since they can find both their ID and vote in the national list. They can show their receipt to others but cannot prove which one of the many IDs on the receipt was actually theirs.

sametmax 7y ago

As a professional developer, I wouldn't trust myself to audit a voting system and swear on my life it's safe to use for my country. Now, let's step back and remember that MOST PEOPLE DON'T KNOW WHAT AN URL IS. They can't tell the difference between an app and a web site. Internet, the browser and Google. A good part of them still think the Sun goes around the Earth. Even with current simple paper based systems, elections are being influenced. There is no way in hell that anything electronic is going to be kept safe by the general population, unless we duplicate the votes on paper for review, which for me kinda defeat the purpose of going digital. Elections are not a technical problem. Actually the more technical you get, the smarter you try to make it, the farther away you are from helping society. Now an electronic system to make polls for the general population, or for small entities, make sense. So it's still a good subject for research. But if people that have a hard time to read out loud must inspect a hard drive to make sure it hasn't been tempered with, it's game over.

BvqxAZmrY4ZM3uH 7y ago

This doesn't solve the problem of "Stuffing", or "dead people voting". You could see your vote is still as you voted, but you don't know if only people who are allowed to vote did so.