17 ms·

Why online voting is harder than online banking

138 points by furcyd 6y ago

RyJones 6y ago
I'll repost this[0] from 2012, talking about work from ~1998. [0]: https://news.ycombinator.com/item?id=4771264 https://news.ycombinator.com/item?id=4771264
- colejohnson66 6y ago
  You say “solved” in that post, but what exactly was solved? The lack of a paper trail? The ease of tampering?
- pwinnski 6y ago
  The article list two reasons why online voting is not like online banking. Your links address one, but not the other, and yet you label it a solved problem. I can't see how online voting can provide the secret ballot we have today. "Privacy" is not the same as "anonymity."
  - deleted 6y ago
    [deleted]
egypturnash 6y ago
Voatz, for example, gives each voter an anonymized identification number that allows them to look up their votes as they were recorded on the Voatz server. This is probably essential for ensuring that votes are recorded correctly. But it erodes the sanctity of the private ballot, since people in positions of power could coerce voters into revealing how they voted. I immediately think that this could be fixed by giving voters the opportunity to generate multiple ID numbers that lead to “proof” that the voter a different way. Maybe even different passwords that lead to only one voting record, in the event of someone forcing you to log in and show that you voted the way they told you. There are probably other attacks that can be performed upon this vague handwavy scheme of course. Can’t fix the incredibly stupid name of “Voatz” though, I cringe every time I see them mentioned.
- zeroonetwothree 6y ago
  There are schemes that allow proof a vote was counted without revealing the vote. It’s far better than the clusterfuck we have today where up to 5% of ballots get “lost”.
  - nemetroid 6y ago
    > There are schemes that allow proof a vote was counted without revealing the vote. What does "proof a vote was counted" mean here? If the proof doesn't verify that the correct candidate received the vote, what exactly does it verify?
- kapnobatairza 6y ago
  I've had the same thought. When you vote the system can generate "duress" key for other candidates on the ballot. So you can technically "prove" you voted for anyone, so only you can verify which key is real.
- sam_lowry_ 6y ago
  > this could be fixed by giving voters the opportunity to > generate multiple ID numbers that lead to “proof” 3 ballot system does it [1] [1] https://en.wikipedia.org/wiki/ThreeBallot https://en.wikipedia.org/wiki/ThreeBallot
chr1 6y ago
Online voting is hard because people are trying to solve a wrong problem. Now anonymity in voting is needed because a vote has too much value for the politician who is being elected (four years of power), and too little value for the voter (choice between two bundles of promises that almost certainly will not be kept). Because of this asymmetry there is a large risk that with non-anonymous vote people with power will force large number of people to vote for them. But if we could vote on individual laws and policies instead of people there would not be such difference, and people would be able to use their vote rationally. And if they make mistakes they will not be stuck with the mistake for four years. Openness of the vote would also allow more flexibility in the way people delegate their vote https://en.wikipedia.org/wiki/Liquid_democracy https://en.wikipedia.org/wiki/Liquid_democracy or trade support for issues to reach compromise https://voteflux.org/ https://voteflux.org/
- NiceWayToDoIT 6y ago
  I like that idea voting for ideas instead of people.
  - hombre_fatal 6y ago
    Not really sure I want to leave the country's future to the few people who can be bothered to pore over a bunch of a la carte laws and vote on each one. While it sounds good in theory, you're leaving the country to the same sort of crazy on NextDoor who has nothing better to do but peer out their blinds during the day to report the suspicious activity of someone walking their dog.
    - winstonewert 6y ago
      I believe a core part of the idea is that you can delegate someone to control your vote unless you override them. Most people would choose someone whom they trust to make appropriate judgements and delegate their vote to them. So I think there would be a number of who specialize in evaluating these laws and it wouldn't be just a few crazy people.
NiceWayToDoIT 6y ago
First problem is ensuring that person is correctly authenticated and has right to vote. It is same as entering trough door and giving your ID. From that point the vote needs to be secret, so it cannot be traced back to the voter. Solution may be simple as: Voting software must be opensource on Github so it means that must be verifiable. Open and publicly accessible monitoring of installation, appropriate build (version, hash...) And same goes for hardware. Must run on server that cannot be spoofed or additionally monitored or traced. If above is done, it is just simple case of decoupling recorded information. And in regards of checking public ledger can have some kind of random code "R3DfCee" which will be there to make sure equal number between those who voted and issued codes. Each voter can go to public web site and look for his code ... Maybe something along those lines?
- wwweston 6y ago
  > Voting software must be opensource on Github so it means that must be verifiable. This assumes the problem is merely making an accurate count, rather than making consensus. "Verfifiable" doesn't just mean "an expert in the field can determine the system registers the votes/totals cast by individual voters." Because that means you still have the political problem of how non-expert citizens know they can trust someone's verification or expertise. Verifiable in a democracy means that a layperson of average intelligence can observe and understand the process and participate in verification. Or to put it in Python terms, "explicit is better than implicit." We're not just making a count, we're making group confidence that a given vote count was correct.
  - NiceWayToDoIT 6y ago
    Not exactly what I meant. If installation number is open and visible, any person without any knowledge can confirm that during vote, latest installation number was such and such and hash of build was of such and such. Before election day number can be publicly broadcast so everyone knows what needs to be checked. Opensource and visible means same as for linux, code is visible to those that have knowledge and can quickly identify attempts of backdoor attempts like for instance this one: https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/ https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-... Code wise that will allow that people in power will not try to manipulate or rig elections. If you have XX thousands of IT professionals that can check code it is surely better than "trusted" dedicated private contractor.
qntmfred 6y ago
Estonia has been using electronic voting since the early 2000s, not without concerning security analysis https://www.youtube.com/watch?v=PT0e9yTD2M8 https://www.youtube.com/watch?v=PT0e9yTD2M8 https://www.youtube.com/watch?v=iit5WdLYwns https://www.youtube.com/watch?v=iit5WdLYwns As mentioned in the arstechnica articles, attempts have been made in the US as well. Voatz and OmniBallot in particular. https://www.youtube.com/watch?v=_FHHXJ1AVm4 https://www.youtube.com/watch?v=_FHHXJ1AVm4 Maybe someday we can have safe, reliable and transparent elections using smartphones and whatnot, but the attempts to computerize our elections over the the last 2 decades have imo been more problematic than beneficial. https://www.youtube.com/watch?v=6PvXRwXyNEs https://www.youtube.com/watch?v=6PvXRwXyNEs Sometimes paper is the right technology for the job. Hand-marked paper ballots and post-election risk limiting audits is the best option we have at the moment.
- m-p-3 6y ago
  I believe that Estonia also have a good electronic ID system (using a PKI infrastructure IIRC), which probably helps with the overall implementation.
  - sam_lowry_ 6y ago
    Which had its failures, e.g. Estonia had to reissue 750,000 IDs due to manufacturer's fault.
im3w1l 6y ago
So one problem I was thinking about: If someone stands behind your shoulder while you vote (because they want to violently coerce you, or because they are buying your vote), then it must be possible to make the system ignore that vote. Maybe by overriding it later, or by making it seem like you are voting even though your are not In either case with such a ignore-vote function in place, how can you be sure that the mailman, or the official who gave you your authentication codes, that they aren't pulling this trick on you? By it's nature it must be undetectable that it is performed?
- optimiz3 6y ago
  Is this a realistic threat? Mail-in and absentee ballots could also have theoretical coercion issues but in reality many states exclusively use mail-in voting without issue.
  - jarjoura 6y ago
    The early US election history is littered with stories of coercion. It’s a very real threat.
    - optimiz3 6y ago
      What does that happen to do with right now? Is your position that mail-in voting coercion is happening on a scale large enough to be a real threat or matter? What evidence to you have for this?
dividuum 6y ago
Online voting should never be the goal. Computers make things easier and more scalable, but that's not what you want for voting. You want a process that's as distributed as possible so the blast radius of any kind of interference with the voting process itself is as small as possible. It's way harder to change votes at large scale if they have been made on paper. Same with counting: I don't want a 32bit value somewhere counting votes. I want various people manually counting votes and have them observe process. Yes: All that is maybe more expensive than running some website or setting up magic machines, but that's a cost I'm more than willing to take.
- chrisseaton 6y ago
  Do you not also want something that is accessible?
  - dividuum 6y ago
    Not sure how that computer related. In Germany all voting places are wheelchair accessible. Additionally for the blind, there’s a Stimmzettelschablonen that allows you to vote in secret. These issues can be solved without computers.
    - chrisseaton 6y ago
      Accessible... to people not able to get to a voting location or postbox. > In Germany all voting places are wheelchair accessible. There are accessibility concerns beyond just wheelchairs you know...
      - PeterisP 6y ago
        My local elections have each voting location team do home visits on election day for people who physically can't get to a voting location due to disability, severe ilness, etc - in the last elections it was used by the people home-isolating due to Covid. There aren't that many people like that, it takes some funding and effort to make an exception for them, but it is manageable.
deleted 6y ago
[deleted]
pmoriarty 6y ago
The day voting becomes electronic is the day you can say goodbye to democracy.
jarjoura 6y ago
There are no do-overs in an election. If a system is compromised, either legitimately or through political gas lighting, there won’t be a paper trail to fall back on. There’s also some theories that voting at home on something like your phone is far more subjected to coercion. This is why some states refuse to go 100% mail-in this year, even at the expense of public health. Sure, someone can always threaten you to vote a certain way, but polling places are designed to prevent that as much as possible. Then there’s just us, the population. We live in an age that people doubt vaccines, or think the earth is flat, or that COVID 19 is a fake crisis manufactured by the Democrats to win the election. If 100% of votes are done digitally, some group will undoubtedly not believe the outcome of the election.
- dragonwriter 6y ago
  > There are no do-overs in an election Sure there are, quite literally Ordering a new election from scratch is a not-unheard-of remedy for election irregularities for which there is no other way to correct the irregularity.
  - jarjoura 6y ago
    Do you have an example of a presidential election that was redone? In 2000 Bush vs Gore, the Supreme Court canceled the recount. That’s the closest I’ve seen to the courts stepping in to fix a mess.
    - dragonwriter 6y ago
      > Do you have an example of a presidential election that was redone? The (completely optional) popular elections for US Presidential electors don't generally have laws that would support a judicially-ordered revote as a remedy because they have a built-in after the fact legislative remedy, since the legislature ultimately decides the mechanism by which electors are assigned (and can simply do so itself), and can revise it's decision even after a public balloting has occurred (in principle, such an retrospective change removes the states electoral votes from the safe harbor provision that applies to procedures fully adopted in advance, but then the safe harbor rule itself is unenforceable and effectively a symbolic statement of intent.) But that's a fairly special case, and a result of the peculiar design of US Presidential elections, not something general to elections. This doesn't prevent a do-over, it just means that it wouldn't come from judiciary. It also means that the decision would be highly partisan. While not about do overs (but potentially about legislative intervention in other ways), that's why the anti-mail-ballot propaganda (and Trump's double voting advocacy) is heavily targeting Republican-legislative-majority states that are polling close or leaning Biden.
abeppu 6y ago
This article highlights the trade-off between the secrecy of ballots, and the ability of the individual voter to confirm their vote was correctly recorded. But the other discrepancy relative to banking is that for elections, we want to also verify that no extra votes were snuck in. By comparison, while I require my bank to get my balance and transaction correct, I have no expectation that I'll be able to verify that balances for all other accounts were summed correctly.
- blfr 6y ago
  While we don't do it individually, we have regulators who (are supposed to) control the money creation by banks. Just like we have semi-independent election boards that (again, are supposed to) verify the balances.
  - anoncake 6y ago
    Which isn't possible in case of an election. If you knew the proper result, you wouldn't need the election.
henrikschroder 6y ago
Finally an article pointing out that online banking is always "fixable", there's always a human that can look at a bunch of electronic transactions and decide if they're correct or not. For voting, there's no such thing. Nobody knows what the result is, whatever comes out of the black box that is electronic voting is the result, for better or worse. You can't independently verify it, because that breaks the voter secrecy, and you can't allow anyone to override the results and "fix" it to whatever it "should" be, because that's outright voter fraud. Papers and envelopes is the only way to go.
- codeguro 6y ago
  You’ve clearly never heard of homomorphic encryption. There exists a way to cryptographically secure a vote while also preserving privacy. It’s even individually verifiable. And as a bonus, you can’t sell it even though you can verify it. Do some research, there even exists a youtube video putting it in simple terms. The answer is homomorphoc encryption.
  - pessimizer 6y ago
    > And as a bonus, you can’t sell it even though you can verify it. How does homomorphic encryption keep me from selling my id and password to someone who will vote for me, or keep someone from standing over my shoulder and watching me vote?
  - henrikschroder 6y ago
    > There exists a way to cryptographically secure Fantastic, can you explain that to my 95 year old grandmother? > there even exists a youtube video She doesn't know what YouTube is. You're showing the third weakness of online voting, and that is that because we have to trust whatever result the system produces, everyone in society also has to be able to understand the system. I'm sure I could understand your solution, but I'm a nerd, and you shouldn't have to be a nerd to understand it. It's hard enough to convince people that experts are right about trivial bullshit, why should anyone trust the experts about online voting? The simplicity of voting through papers and envelopes and urns is its greatest strength. Everyone can look at the process, everyone is even invited to observe the process, and you can easily detect cheating or other irregularities. Everyone can be a poll worker, and that's a fundamental pillar of democracy, that we all build the voting machine together, so that we together can trust the result, even though we may have completely opposite political opinions.
1f60c 6y ago
Relevant XKCD: https://xkcd.com/2030/ https://xkcd.com/2030/
- NiceWayToDoIT 6y ago
  I love it. I came to this thread here expecting I will find many different ideas, instead I found: no, impossible, are you crazy, never, it will not fly, heads will explode :D ... I would really like if I found even attempt of ideas, or even break down of problem to many points ... something along those lines ...
solinent 6y ago
At Waterloo in Canada we're taught in our computer security class that paper can be more secure than a computer, especially in a voting system, and in fact that's the reason we don't switch like our southern neighbours. I'd say that every medium we use throughout time typically can never be replaced. We'll keep paper forever--just use it only when it benefits us over computers.
rektide 6y ago
As if we have online banks. A couple counties have some national systems for APIs to bank with. But it's a wild west story everywhere else & this "online banking" we have is all a masquerade on an old barely working distinctly un-on-line batch processing shite system we've endured & been stuck with.
- rektide 6y ago
  We should totally be open to online voting in some countries where politicians give a shit, run the programs with transparency & open source, & operate at smaller levels of scale than this sizable dis-federating mess (To the Union forever).
deleted 6y ago
[deleted]
tomp 6y ago
I mean the answer is pretty obvious. We don't care about problems with online banking; we force banks to care - if something (anything) goes wrong, the bank is on the line for any losses, worst case scenario is, a bank collapses. With voting, whoever is the online voting provider (even if it's "the government" i.e. the bureaucrats and the party/parties currently in power), isn't really responsible... if some things go wrong, nothing happens... if too many things go wrong, the whole system collapses.
MrXOR 6y ago
Online Voting is a very hard problem. In "political" online voting, you (voters) are adversary, everyone is adversary, everything is adversary. Your enemies are all APT groups around the world. You can't trust others, you can't trust yourself, you are alone.
pixelmonkey 6y ago
Schneier on Security covering voting machines in 2004, a few years after the Year 2000 "hanging chad" debacle in Florida that kicked off the current "modernization" wave. The tl;dr is that online and electronic voting optimizes the wrong metrics during an election. https://www.schneier.com/blog/archives/2004/11/the_problem_wit.html https://www.schneier.com/blog/archives/2004/11/the_problem_w...
jspaetzel 6y ago
These issues exist for mail in voting as well. The main difference is how well the average Joe understands computers vs mail. There could be a secure opt-in system for online voting. Heck they could mail out the ballot and let you submit it online.
deleted 6y ago
[deleted]
lordnacho 6y ago
I tend to think the arguments in favour of the old paper system are flawed. They basically say that the paper system is easier to understand for everyone and easier to prove, and maybe cost more to corrupt. But that is an illusion that could very well be shattered in a few weeks, for those who stick to American politics. The advantage of the paper system is that people are familiar with it, and they think they know how it works. Much like you might think you know how accessing a website works, you actually don't know every detail in that stack. Do you really know how the light in the fibres get read? How virtual memory and TLB works? What about rendering the page in react? I can say I studied all these things and I still don't entirely know how the whole thing works, I am simply confident that certain abstractions are going to hold, so I don't worry about the nitty gritty of how semiconductors and lasers work. In paper voting land, it is the same. Everyone who has voted has seen the interface: you get a piece of paper, you put it into a box, and in the evening someone is chosen to disappoint the nation for the next few years. You imagine that in between there are competent and honest people counting the votes, reporting their subtally, and totalling the numbers they get, up a tree to someone who ends up with the whole picture, which he then dutifully reports to the nation. But what is holding this together? Essentially, just faith. There may be checks designed at various points to make sure nobody does a bad job of counting, but with enough contention this will break. The system might do just fine if one or two people forget a pile of votes, sure. But what if you have people complaining that they can't vote in the first place? What if everyone decides they need to contest the vote if their guy doesn't win? What if there are complaints about the aggregation? There could easily be a situation where everyone thinks the system is just broken and will never work again with the current system. What moving to electronic voting could give us is sacrificibility. You have a shit election, you blame the system, you make a new one. Paper voting isn't branded ("Accenture Voter System") and will remain stained by problems.
- abdullahkhalids 6y ago
  You are misrepresenting the checks in the paper system. There are representatives of all major parties and the state at the voting station. The representatives have competing interests, so you can trust that they won't collude. Plus the state rep has a legal responsibility to ensure there is no cheating. You put the piece of paper in a locked box - a lock that was checked by all these reps. So, no wrong votes in the box. At the end of the day, all party reps watch as the state rep counts the votes. So the counting is also right. Then the counts are written on a final document, which is then signed by the state reps and party reps. At the main station, more party reps can check that all papers were collected and correctly added for the final tally. Anyone who wants to mess with the voting has to corrupt all of these reps for a voting station, in order to probably move the votes by like <1%. Then repeat for many different voting stations to actually change the winner. As long as you trust the local party rep (hopefully you have interacted them) who is standing at the voting booth, you can believe at the emotional level that your voting booth got the right result.
anigbrowl 6y ago
What if voting were not so high-stakes (giving all your political capital in a given sphere to a single individual for 2-6 years)? We have the technology to edit our legal corpus directly, a sort of Wikilegia if you like. If governance were less of a black box many elected offices would not be necessary, and many popular disputes would be be obviated. Of course, this would bring challenges of its own and be subject to other sorts of abuse, as we can see from influence campaigns on social media and indeed things like edit wars on Wikipedia. Nonetheless, a great deal of our political decision-making could be distributed and would have far greater legitimacy as a result.
- adolph 6y ago
  I wonder if the low temporal resolution of current democracy contributes to polarization since the relation of vote to government decision is by proxy instead of being direct. Maybe letting some person or legislature make decisions between elections is as outmoded as the electoral college. Also, I’m not certain if it makes sense to vote in terms of making a decision for one thing or another, but vote in terms of how you think the majority of others will vote. That way people don’t vote for what they think is in their own interest but in what they think the community thinks is in the interest of the whole.
jellicle 6y ago
All the things that anyone thinks can go wrong with online voting are already features of the voting system today. Your votes are tabulated by online computers, who send votes electronically to other computers, all of them with bottom-of-the-barrel security, and the totals are reported as gospel (or manipulated, who knows). Bad actors can force people to vote as they wish. Everything is closed source and secret. That's how elections are conducted today. A proper online voting system could have maximal verification. Bruce Schneier could be handcuffed to the mainframe to verify it. Offer a $1 million bounty for every bug found. Make a system that has multiple independent watchdogs watching each other, and if the code on any is changed they all freak out. Every line of code could be scrutinized.
motohagiography 6y ago
Electronic voting is a recipe for civil unrest because there is no way to demonstrate its legitimacy to the people who participate in it and are subject to the results. !remindme 2020-11-04
74ls00 6y ago
The main thing I’ve never understood is why online voting is even desirable. Even if it were as secure what’s wrong with going to a polling station? If it’s inaccessible to many busy people then let’s make it a public holiday. What problem are we trying to solve?

138 points by furcyd 6y ago

I'll repost this[0] from 2012, talking about work from ~1998. [0]: https://news.ycombinator.com/item?id=4771264 https://news.ycombinator.com/item?id=4771264

colejohnson66 6y ago
You say “solved” in that post, but what exactly was solved? The lack of a paper trail? The ease of tampering?
pwinnski 6y ago
The article list two reasons why online voting is not like online banking. Your links address one, but not the other, and yet you label it a solved problem. I can't see how online voting can provide the secret ballot we have today. "Privacy" is not the same as "anonymity."
- deleted 6y ago
  [deleted]

egypturnash 6y ago

Voatz, for example, gives each voter an anonymized identification number that allows them to look up their votes as they were recorded on the Voatz server. This is probably essential for ensuring that votes are recorded correctly. But it erodes the sanctity of the private ballot, since people in positions of power could coerce voters into revealing how they voted. I immediately think that this could be fixed by giving voters the opportunity to generate multiple ID numbers that lead to “proof” that the voter a different way. Maybe even different passwords that lead to only one voting record, in the event of someone forcing you to log in and show that you voted the way they told you. There are probably other attacks that can be performed upon this vague handwavy scheme of course. Can’t fix the incredibly stupid name of “Voatz” though, I cringe every time I see them mentioned.

zeroonetwothree 6y ago
There are schemes that allow proof a vote was counted without revealing the vote. It’s far better than the clusterfuck we have today where up to 5% of ballots get “lost”.
- nemetroid 6y ago
  > There are schemes that allow proof a vote was counted without revealing the vote. What does "proof a vote was counted" mean here? If the proof doesn't verify that the correct candidate received the vote, what exactly does it verify?
kapnobatairza 6y ago
I've had the same thought. When you vote the system can generate "duress" key for other candidates on the ballot. So you can technically "prove" you voted for anyone, so only you can verify which key is real.
sam_lowry_ 6y ago
> this could be fixed by giving voters the opportunity to > generate multiple ID numbers that lead to “proof” 3 ballot system does it [1] [1] https://en.wikipedia.org/wiki/ThreeBallot https://en.wikipedia.org/wiki/ThreeBallot

chr1 6y ago

Online voting is hard because people are trying to solve a wrong problem. Now anonymity in voting is needed because a vote has too much value for the politician who is being elected (four years of power), and too little value for the voter (choice between two bundles of promises that almost certainly will not be kept). Because of this asymmetry there is a large risk that with non-anonymous vote people with power will force large number of people to vote for them. But if we could vote on individual laws and policies instead of people there would not be such difference, and people would be able to use their vote rationally. And if they make mistakes they will not be stuck with the mistake for four years. Openness of the vote would also allow more flexibility in the way people delegate their vote https://en.wikipedia.org/wiki/Liquid_democracy https://en.wikipedia.org/wiki/Liquid_democracy or trade support for issues to reach compromise https://voteflux.org/ https://voteflux.org/

NiceWayToDoIT 6y ago
I like that idea voting for ideas instead of people.
- hombre_fatal 6y ago
  Not really sure I want to leave the country's future to the few people who can be bothered to pore over a bunch of a la carte laws and vote on each one. While it sounds good in theory, you're leaving the country to the same sort of crazy on NextDoor who has nothing better to do but peer out their blinds during the day to report the suspicious activity of someone walking their dog.
  - winstonewert 6y ago
    I believe a core part of the idea is that you can delegate someone to control your vote unless you override them. Most people would choose someone whom they trust to make appropriate judgements and delegate their vote to them. So I think there would be a number of who specialize in evaluating these laws and it wouldn't be just a few crazy people.

NiceWayToDoIT 6y ago

First problem is ensuring that person is correctly authenticated and has right to vote. It is same as entering trough door and giving your ID. From that point the vote needs to be secret, so it cannot be traced back to the voter. Solution may be simple as: Voting software must be opensource on Github so it means that must be verifiable. Open and publicly accessible monitoring of installation, appropriate build (version, hash...) And same goes for hardware. Must run on server that cannot be spoofed or additionally monitored or traced. If above is done, it is just simple case of decoupling recorded information. And in regards of checking public ledger can have some kind of random code "R3DfCee" which will be there to make sure equal number between those who voted and issued codes. Each voter can go to public web site and look for his code ... Maybe something along those lines?

wwweston 6y ago
> Voting software must be opensource on Github so it means that must be verifiable. This assumes the problem is merely making an accurate count, rather than making consensus. "Verfifiable" doesn't just mean "an expert in the field can determine the system registers the votes/totals cast by individual voters." Because that means you still have the political problem of how non-expert citizens know they can trust someone's verification or expertise. Verifiable in a democracy means that a layperson of average intelligence can observe and understand the process and participate in verification. Or to put it in Python terms, "explicit is better than implicit." We're not just making a count, we're making group confidence that a given vote count was correct.
- NiceWayToDoIT 6y ago
  Not exactly what I meant. If installation number is open and visible, any person without any knowledge can confirm that during vote, latest installation number was such and such and hash of build was of such and such. Before election day number can be publicly broadcast so everyone knows what needs to be checked. Opensource and visible means same as for linux, code is visible to those that have knowledge and can quickly identify attempts of backdoor attempts like for instance this one: https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-attempt-of-2003/ https://freedom-to-tinker.com/2013/10/09/the-linux-backdoor-... Code wise that will allow that people in power will not try to manipulate or rig elections. If you have XX thousands of IT professionals that can check code it is surely better than "trusted" dedicated private contractor.

qntmfred 6y ago

Estonia has been using electronic voting since the early 2000s, not without concerning security analysis https://www.youtube.com/watch?v=PT0e9yTD2M8 https://www.youtube.com/watch?v=PT0e9yTD2M8 https://www.youtube.com/watch?v=iit5WdLYwns https://www.youtube.com/watch?v=iit5WdLYwns As mentioned in the arstechnica articles, attempts have been made in the US as well. Voatz and OmniBallot in particular. https://www.youtube.com/watch?v=_FHHXJ1AVm4 https://www.youtube.com/watch?v=_FHHXJ1AVm4 Maybe someday we can have safe, reliable and transparent elections using smartphones and whatnot, but the attempts to computerize our elections over the the last 2 decades have imo been more problematic than beneficial. https://www.youtube.com/watch?v=6PvXRwXyNEs https://www.youtube.com/watch?v=6PvXRwXyNEs Sometimes paper is the right technology for the job. Hand-marked paper ballots and post-election risk limiting audits is the best option we have at the moment.

m-p-3 6y ago
I believe that Estonia also have a good electronic ID system (using a PKI infrastructure IIRC), which probably helps with the overall implementation.
- sam_lowry_ 6y ago
  Which had its failures, e.g. Estonia had to reissue 750,000 IDs due to manufacturer's fault.

im3w1l 6y ago

So one problem I was thinking about: If someone stands behind your shoulder while you vote (because they want to violently coerce you, or because they are buying your vote), then it must be possible to make the system ignore that vote. Maybe by overriding it later, or by making it seem like you are voting even though your are not In either case with such a ignore-vote function in place, how can you be sure that the mailman, or the official who gave you your authentication codes, that they aren't pulling this trick on you? By it's nature it must be undetectable that it is performed?

optimiz3 6y ago
Is this a realistic threat? Mail-in and absentee ballots could also have theoretical coercion issues but in reality many states exclusively use mail-in voting without issue.
- jarjoura 6y ago
  The early US election history is littered with stories of coercion. It’s a very real threat.
  - optimiz3 6y ago
    What does that happen to do with right now? Is your position that mail-in voting coercion is happening on a scale large enough to be a real threat or matter? What evidence to you have for this?

dividuum 6y ago

Online voting should never be the goal. Computers make things easier and more scalable, but that's not what you want for voting. You want a process that's as distributed as possible so the blast radius of any kind of interference with the voting process itself is as small as possible. It's way harder to change votes at large scale if they have been made on paper. Same with counting: I don't want a 32bit value somewhere counting votes. I want various people manually counting votes and have them observe process. Yes: All that is maybe more expensive than running some website or setting up magic machines, but that's a cost I'm more than willing to take.

chrisseaton 6y ago
Do you not also want something that is accessible?
- dividuum 6y ago
  Not sure how that computer related. In Germany all voting places are wheelchair accessible. Additionally for the blind, there’s a Stimmzettelschablonen that allows you to vote in secret. These issues can be solved without computers.
  - chrisseaton 6y ago
    Accessible... to people not able to get to a voting location or postbox. > In Germany all voting places are wheelchair accessible. There are accessibility concerns beyond just wheelchairs you know...
    - PeterisP 6y ago
      My local elections have each voting location team do home visits on election day for people who physically can't get to a voting location due to disability, severe ilness, etc - in the last elections it was used by the people home-isolating due to Covid. There aren't that many people like that, it takes some funding and effort to make an exception for them, but it is manageable.

deleted 6y ago

[deleted]

pmoriarty 6y ago

The day voting becomes electronic is the day you can say goodbye to democracy.

jarjoura 6y ago

There are no do-overs in an election. If a system is compromised, either legitimately or through political gas lighting, there won’t be a paper trail to fall back on. There’s also some theories that voting at home on something like your phone is far more subjected to coercion. This is why some states refuse to go 100% mail-in this year, even at the expense of public health. Sure, someone can always threaten you to vote a certain way, but polling places are designed to prevent that as much as possible. Then there’s just us, the population. We live in an age that people doubt vaccines, or think the earth is flat, or that COVID 19 is a fake crisis manufactured by the Democrats to win the election. If 100% of votes are done digitally, some group will undoubtedly not believe the outcome of the election.

dragonwriter 6y ago
> There are no do-overs in an election Sure there are, quite literally Ordering a new election from scratch is a not-unheard-of remedy for election irregularities for which there is no other way to correct the irregularity.
- jarjoura 6y ago
  Do you have an example of a presidential election that was redone? In 2000 Bush vs Gore, the Supreme Court canceled the recount. That’s the closest I’ve seen to the courts stepping in to fix a mess.
  - dragonwriter 6y ago
    > Do you have an example of a presidential election that was redone? The (completely optional) popular elections for US Presidential electors don't generally have laws that would support a judicially-ordered revote as a remedy because they have a built-in after the fact legislative remedy, since the legislature ultimately decides the mechanism by which electors are assigned (and can simply do so itself), and can revise it's decision even after a public balloting has occurred (in principle, such an retrospective change removes the states electoral votes from the safe harbor provision that applies to procedures fully adopted in advance, but then the safe harbor rule itself is unenforceable and effectively a symbolic statement of intent.) But that's a fairly special case, and a result of the peculiar design of US Presidential elections, not something general to elections. This doesn't prevent a do-over, it just means that it wouldn't come from judiciary. It also means that the decision would be highly partisan. While not about do overs (but potentially about legislative intervention in other ways), that's why the anti-mail-ballot propaganda (and Trump's double voting advocacy) is heavily targeting Republican-legislative-majority states that are polling close or leaning Biden.

abeppu 6y ago

This article highlights the trade-off between the secrecy of ballots, and the ability of the individual voter to confirm their vote was correctly recorded. But the other discrepancy relative to banking is that for elections, we want to also verify that no extra votes were snuck in. By comparison, while I require my bank to get my balance and transaction correct, I have no expectation that I'll be able to verify that balances for all other accounts were summed correctly.

blfr 6y ago
While we don't do it individually, we have regulators who (are supposed to) control the money creation by banks. Just like we have semi-independent election boards that (again, are supposed to) verify the balances.
- anoncake 6y ago
  Which isn't possible in case of an election. If you knew the proper result, you wouldn't need the election.

henrikschroder 6y ago

Finally an article pointing out that online banking is always "fixable", there's always a human that can look at a bunch of electronic transactions and decide if they're correct or not. For voting, there's no such thing. Nobody knows what the result is, whatever comes out of the black box that is electronic voting is the result, for better or worse. You can't independently verify it, because that breaks the voter secrecy, and you can't allow anyone to override the results and "fix" it to whatever it "should" be, because that's outright voter fraud. Papers and envelopes is the only way to go.

codeguro 6y ago
You’ve clearly never heard of homomorphic encryption. There exists a way to cryptographically secure a vote while also preserving privacy. It’s even individually verifiable. And as a bonus, you can’t sell it even though you can verify it. Do some research, there even exists a youtube video putting it in simple terms. The answer is homomorphoc encryption.
- pessimizer 6y ago
  > And as a bonus, you can’t sell it even though you can verify it. How does homomorphic encryption keep me from selling my id and password to someone who will vote for me, or keep someone from standing over my shoulder and watching me vote?
- henrikschroder 6y ago
  > There exists a way to cryptographically secure Fantastic, can you explain that to my 95 year old grandmother? > there even exists a youtube video She doesn't know what YouTube is. You're showing the third weakness of online voting, and that is that because we have to trust whatever result the system produces, everyone in society also has to be able to understand the system. I'm sure I could understand your solution, but I'm a nerd, and you shouldn't have to be a nerd to understand it. It's hard enough to convince people that experts are right about trivial bullshit, why should anyone trust the experts about online voting? The simplicity of voting through papers and envelopes and urns is its greatest strength. Everyone can look at the process, everyone is even invited to observe the process, and you can easily detect cheating or other irregularities. Everyone can be a poll worker, and that's a fundamental pillar of democracy, that we all build the voting machine together, so that we together can trust the result, even though we may have completely opposite political opinions.

1f60c 6y ago

Relevant XKCD: https://xkcd.com/2030/ https://xkcd.com/2030/

NiceWayToDoIT 6y ago
I love it. I came to this thread here expecting I will find many different ideas, instead I found: no, impossible, are you crazy, never, it will not fly, heads will explode :D ... I would really like if I found even attempt of ideas, or even break down of problem to many points ... something along those lines ...

solinent 6y ago

At Waterloo in Canada we're taught in our computer security class that paper can be more secure than a computer, especially in a voting system, and in fact that's the reason we don't switch like our southern neighbours. I'd say that every medium we use throughout time typically can never be replaced. We'll keep paper forever--just use it only when it benefits us over computers.

rektide 6y ago

As if we have online banks. A couple counties have some national systems for APIs to bank with. But it's a wild west story everywhere else & this "online banking" we have is all a masquerade on an old barely working distinctly un-on-line batch processing shite system we've endured & been stuck with.

rektide 6y ago
We should totally be open to online voting in some countries where politicians give a shit, run the programs with transparency & open source, & operate at smaller levels of scale than this sizable dis-federating mess (To the Union forever).

deleted 6y ago

[deleted]

tomp 6y ago

I mean the answer is pretty obvious. We don't care about problems with online banking; we force banks to care - if something (anything) goes wrong, the bank is on the line for any losses, worst case scenario is, a bank collapses. With voting, whoever is the online voting provider (even if it's "the government" i.e. the bureaucrats and the party/parties currently in power), isn't really responsible... if some things go wrong, nothing happens... if too many things go wrong, the whole system collapses.

MrXOR 6y ago

Online Voting is a very hard problem. In "political" online voting, you (voters) are adversary, everyone is adversary, everything is adversary. Your enemies are all APT groups around the world. You can't trust others, you can't trust yourself, you are alone.

pixelmonkey 6y ago

Schneier on Security covering voting machines in 2004, a few years after the Year 2000 "hanging chad" debacle in Florida that kicked off the current "modernization" wave. The tl;dr is that online and electronic voting optimizes the wrong metrics during an election. https://www.schneier.com/blog/archives/2004/11/the_problem_wit.html https://www.schneier.com/blog/archives/2004/11/the_problem_w...

jspaetzel 6y ago

These issues exist for mail in voting as well. The main difference is how well the average Joe understands computers vs mail. There could be a secure opt-in system for online voting. Heck they could mail out the ballot and let you submit it online.

deleted 6y ago

[deleted]

lordnacho 6y ago

I tend to think the arguments in favour of the old paper system are flawed. They basically say that the paper system is easier to understand for everyone and easier to prove, and maybe cost more to corrupt. But that is an illusion that could very well be shattered in a few weeks, for those who stick to American politics. The advantage of the paper system is that people are familiar with it, and they think they know how it works. Much like you might think you know how accessing a website works, you actually don't know every detail in that stack. Do you really know how the light in the fibres get read? How virtual memory and TLB works? What about rendering the page in react? I can say I studied all these things and I still don't entirely know how the whole thing works, I am simply confident that certain abstractions are going to hold, so I don't worry about the nitty gritty of how semiconductors and lasers work. In paper voting land, it is the same. Everyone who has voted has seen the interface: you get a piece of paper, you put it into a box, and in the evening someone is chosen to disappoint the nation for the next few years. You imagine that in between there are competent and honest people counting the votes, reporting their subtally, and totalling the numbers they get, up a tree to someone who ends up with the whole picture, which he then dutifully reports to the nation. But what is holding this together? Essentially, just faith. There may be checks designed at various points to make sure nobody does a bad job of counting, but with enough contention this will break. The system might do just fine if one or two people forget a pile of votes, sure. But what if you have people complaining that they can't vote in the first place? What if everyone decides they need to contest the vote if their guy doesn't win? What if there are complaints about the aggregation? There could easily be a situation where everyone thinks the system is just broken and will never work again with the current system. What moving to electronic voting could give us is sacrificibility. You have a shit election, you blame the system, you make a new one. Paper voting isn't branded ("Accenture Voter System") and will remain stained by problems.

abdullahkhalids 6y ago
You are misrepresenting the checks in the paper system. There are representatives of all major parties and the state at the voting station. The representatives have competing interests, so you can trust that they won't collude. Plus the state rep has a legal responsibility to ensure there is no cheating. You put the piece of paper in a locked box - a lock that was checked by all these reps. So, no wrong votes in the box. At the end of the day, all party reps watch as the state rep counts the votes. So the counting is also right. Then the counts are written on a final document, which is then signed by the state reps and party reps. At the main station, more party reps can check that all papers were collected and correctly added for the final tally. Anyone who wants to mess with the voting has to corrupt all of these reps for a voting station, in order to probably move the votes by like <1%. Then repeat for many different voting stations to actually change the winner. As long as you trust the local party rep (hopefully you have interacted them) who is standing at the voting booth, you can believe at the emotional level that your voting booth got the right result.

anigbrowl 6y ago

What if voting were not so high-stakes (giving all your political capital in a given sphere to a single individual for 2-6 years)? We have the technology to edit our legal corpus directly, a sort of Wikilegia if you like. If governance were less of a black box many elected offices would not be necessary, and many popular disputes would be be obviated. Of course, this would bring challenges of its own and be subject to other sorts of abuse, as we can see from influence campaigns on social media and indeed things like edit wars on Wikipedia. Nonetheless, a great deal of our political decision-making could be distributed and would have far greater legitimacy as a result.

adolph 6y ago
I wonder if the low temporal resolution of current democracy contributes to polarization since the relation of vote to government decision is by proxy instead of being direct. Maybe letting some person or legislature make decisions between elections is as outmoded as the electoral college. Also, I’m not certain if it makes sense to vote in terms of making a decision for one thing or another, but vote in terms of how you think the majority of others will vote. That way people don’t vote for what they think is in their own interest but in what they think the community thinks is in the interest of the whole.

jellicle 6y ago

All the things that anyone thinks can go wrong with online voting are already features of the voting system today. Your votes are tabulated by online computers, who send votes electronically to other computers, all of them with bottom-of-the-barrel security, and the totals are reported as gospel (or manipulated, who knows). Bad actors can force people to vote as they wish. Everything is closed source and secret. That's how elections are conducted today. A proper online voting system could have maximal verification. Bruce Schneier could be handcuffed to the mainframe to verify it. Offer a $1 million bounty for every bug found. Make a system that has multiple independent watchdogs watching each other, and if the code on any is changed they all freak out. Every line of code could be scrutinized.

motohagiography 6y ago

Electronic voting is a recipe for civil unrest because there is no way to demonstrate its legitimacy to the people who participate in it and are subject to the results. !remindme 2020-11-04

74ls00 6y ago

The main thing I’ve never understood is why online voting is even desirable. Even if it were as secure what’s wrong with going to a polling station? If it’s inaccessible to many busy people then let’s make it a public holiday. What problem are we trying to solve?