3 ms·

But why do we need cryptography if we are not trying to keep it anonymous? If we remove the requirement of anonymity then the task is not much different from co

by chr1 6y ago

But why do we need cryptography if we are not trying to keep it anonymous? If we remove the requirement of anonymity then the task is not much different from counting upvotes on a video. Which is easy to implement, and easy to verify by different parties running the summation algorithm and by people checking their vote status on the site after the result is computed.

tsimionescu 6y ago
Anonymity is crucial to voting, so 'online voting would be easy if we gave up anonymity' would not hold up. However, cryptography is not necessary just for anonymity, and the extreme difficulty of ensuring the system is neither rigged nor hackable is not just in understanding cryptography. The way the current voting systems work, each party and many outside observers are going to collaborate on tallying votes in all voting places, and then collaborate in centralizing those votes in progressively larger centers, all the way to the national level. Parties have alternative counts, and they can check their numbers. Since this is a representative democracy, we can trust that the the people we voted for are either convinced the election is fair, or they are collaborating with their political opponents to cheat, which would mean that the election didn't matter anyway. In an online system, we first need to check that the servers are running the code they claim they are running - not just once, but during the entire electoral process. We need to check that the database of votes contains all of the actual votes that were cast, and no votes that weren't cast, again, not just once, but during the entire process. We need to check that the database used to display results online is the same database used to tabulate the official result. Of course, we also need to make sure the system is highly-available and not prone to DDoS attacks. We need to ensure that someone cutting a few wires doesn't prevent a whole county from voting. And of course, we need ways to fix all of these problems if and when they do appear. Say you have an entire county claiming their votes are incorrectly tallied. What happens next? How many people will have enough know-how to check whether there was a bug in the system or the people are lying? How long will it take to audit all of the code that ran (this is important because it is delaying the end of the election)? Not to mention, you wouldn't really achieve that much. Voting will still have to be done from highly secure machines, so you will still have to go to a polling station (it would be absurdly easy to hack people's PC to have them cast the wrong vote). The same goes for checking the result of your vote. Overall, an online voting system would be as difficult for people to use. It would take less time to tabulate the votes, but probably much more time to resolve disputes. It would be much, much more complex, and the number of people who could understand and check it would go down by at least 1000x. The attack surface would increase tremendously. Imagine trying to protect your national voting system from the NSA and CIA. How many countries in the world would have the know-how to combat this very real threat? Especially while probably running US-made chips?
- chr1 6y ago
  > Anonymity is crucial to voting Why do you think it is crucial? It did not exist in USA until 1888, it did not exist in Rome until 139 BC, start of the end of Roman republic. And in Rome the secret ballot actually have caused civil war, by encouraging the people to vote for laws they could not defend. So voting have worked well without anonymity in the past, and you need better argument why anonymity is crucial, before starting to explore all the unnecessary complexity that it adds to voting.
  - tsimionescu 6y ago
    All of my comment was about the needles complexity that online voting brings to the system even if you disregard anonymity.
    - chr1 6y ago
      Sorry, i have misinterpreted your comment, but reading it again i still do not quite understand it. If voting is open people can simply vote from their phones, everyone can check the status of their own vote, there can be two several independent servers running the software and checking each other, the list of voters will be verified the same way it is verified now. Also at first this will not replace normal voting, but augment it for voting on laws. All of this already works in voteflux which is open on github.
      - tsimionescu 6y ago
        If your tap A on your phone, and your phone shows you that you voted for A, but you later check from your PC and you can see there that you voted for B, what do you do? What do the authorities do? Imagine how easy it would be for the NSA/CIA/NKVD/etc. to deploy malware to infect hundreds of millions of computers to make all those people think that they've voted for someone else. If even 10% of them never bother to check from an uninfected device, the election is meaningless. Also, who deploys the servers? Who controls physical access to them? Who is allowed to check the software running on them? Sure, votsflux may have all their code on GitHub, but the real servers may be running slightly different code, which messes with the data in careful ways. I assume you can export all of the voter data to do the calculations yourself, so at least you can check that when the server says A won, you can check the numbers yourself. But what if they return a slightly altered list, such that if I check my own vote with the vote check API, it shows that I voted for B, but when the data table is exported, I appear to have voted for A, or I appear not to have voted at all? If they change the vote just a bit, odds are few people will ever find out the discrepancies. And even if they can be found out, how long will it take? After the election is over, but before we can have confidence that the results are meaningful, someone needs to make sure that the votes of the vast majority (depending on the closeness of the vote, even 99%+) of people have been checked against the tables that the server produced. This may take days. Also, an adversary can attack this process - get many people to claim that the server incorrectly tabulated their results, that their phones were hacked etc. The authorities will need to spend weeks investigating just to convince themselves whether the results were true or not. And the investigation will have to be handled by trusted experts, who could be bought themselves... Electronic voting is not feasible, and any state that attempts neither cares for its citizens right to vote nor does it understand the sophistication of state-level attackers.

by chr1 6y ago

tsimionescu 6y ago

Anonymity is crucial to voting, so 'online voting would be easy if we gave up anonymity' would not hold up. However, cryptography is not necessary just for anonymity, and the extreme difficulty of ensuring the system is neither rigged nor hackable is not just in understanding cryptography. The way the current voting systems work, each party and many outside observers are going to collaborate on tallying votes in all voting places, and then collaborate in centralizing those votes in progressively larger centers, all the way to the national level. Parties have alternative counts, and they can check their numbers. Since this is a representative democracy, we can trust that the the people we voted for are either convinced the election is fair, or they are collaborating with their political opponents to cheat, which would mean that the election didn't matter anyway. In an online system, we first need to check that the servers are running the code they claim they are running - not just once, but during the entire electoral process. We need to check that the database of votes contains all of the actual votes that were cast, and no votes that weren't cast, again, not just once, but during the entire process. We need to check that the database used to display results online is the same database used to tabulate the official result. Of course, we also need to make sure the system is highly-available and not prone to DDoS attacks. We need to ensure that someone cutting a few wires doesn't prevent a whole county from voting. And of course, we need ways to fix all of these problems if and when they do appear. Say you have an entire county claiming their votes are incorrectly tallied. What happens next? How many people will have enough know-how to check whether there was a bug in the system or the people are lying? How long will it take to audit all of the code that ran (this is important because it is delaying the end of the election)? Not to mention, you wouldn't really achieve that much. Voting will still have to be done from highly secure machines, so you will still have to go to a polling station (it would be absurdly easy to hack people's PC to have them cast the wrong vote). The same goes for checking the result of your vote. Overall, an online voting system would be as difficult for people to use. It would take less time to tabulate the votes, but probably much more time to resolve disputes. It would be much, much more complex, and the number of people who could understand and check it would go down by at least 1000x. The attack surface would increase tremendously. Imagine trying to protect your national voting system from the NSA and CIA. How many countries in the world would have the know-how to combat this very real threat? Especially while probably running US-made chips?

chr1 6y ago
> Anonymity is crucial to voting Why do you think it is crucial? It did not exist in USA until 1888, it did not exist in Rome until 139 BC, start of the end of Roman republic. And in Rome the secret ballot actually have caused civil war, by encouraging the people to vote for laws they could not defend. So voting have worked well without anonymity in the past, and you need better argument why anonymity is crucial, before starting to explore all the unnecessary complexity that it adds to voting.
- tsimionescu 6y ago
  All of my comment was about the needles complexity that online voting brings to the system even if you disregard anonymity.
  - chr1 6y ago
    Sorry, i have misinterpreted your comment, but reading it again i still do not quite understand it. If voting is open people can simply vote from their phones, everyone can check the status of their own vote, there can be two several independent servers running the software and checking each other, the list of voters will be verified the same way it is verified now. Also at first this will not replace normal voting, but augment it for voting on laws. All of this already works in voteflux which is open on github.
    - tsimionescu 6y ago
      If your tap A on your phone, and your phone shows you that you voted for A, but you later check from your PC and you can see there that you voted for B, what do you do? What do the authorities do? Imagine how easy it would be for the NSA/CIA/NKVD/etc. to deploy malware to infect hundreds of millions of computers to make all those people think that they've voted for someone else. If even 10% of them never bother to check from an uninfected device, the election is meaningless. Also, who deploys the servers? Who controls physical access to them? Who is allowed to check the software running on them? Sure, votsflux may have all their code on GitHub, but the real servers may be running slightly different code, which messes with the data in careful ways. I assume you can export all of the voter data to do the calculations yourself, so at least you can check that when the server says A won, you can check the numbers yourself. But what if they return a slightly altered list, such that if I check my own vote with the vote check API, it shows that I voted for B, but when the data table is exported, I appear to have voted for A, or I appear not to have voted at all? If they change the vote just a bit, odds are few people will ever find out the discrepancies. And even if they can be found out, how long will it take? After the election is over, but before we can have confidence that the results are meaningful, someone needs to make sure that the votes of the vast majority (depending on the closeness of the vote, even 99%+) of people have been checked against the tables that the server produced. This may take days. Also, an adversary can attack this process - get many people to claim that the server incorrectly tabulated their results, that their phones were hacked etc. The authorities will need to spend weeks investigating just to convince themselves whether the results were true or not. And the investigation will have to be handled by trusted experts, who could be bought themselves... Electronic voting is not feasible, and any state that attempts neither cares for its citizens right to vote nor does it understand the sophistication of state-level attackers.