3 ms·

I think you're missing a few things: Votes should never be identifiable and the count should be verifiable. First of all: using somewhat public things like SSN

I think you're missing a few things: Votes should never be identifiable and the count should be verifiable. First of all: using somewhat public things like SSN, "numbers in your street address" and a credit card number is a terrible idea. All of those have been leaked and are present on things you present to identify yourself or pay. Also requiring a credit card or home to vote would almost certainly be unconstitutional. Getting a "receipt" is also problematic: You should never be able to prove you voted A over B or vice versa since that opens up ways to intimidate people to vote one way and coerce them to prove it. I'm not saying it's impossible but there are so many problems with electronic voting that I don't even know where to start. At least with physical ballots we can manually recount if we need. And that's before we even start talking about how current systems are basically swiss cheese for hacks, just look at the voting village for the last couple of defcons. Related (and amusing) links: https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=w3_0x6oaDmI https://www.youtube.com/watch?v=LkH2r-sNjQs https://www.youtube.com/watch?v=LkH2r-sNjQs https://xkcd.com/2030/ https://xkcd.com/2030/

wavefunction 6y ago
The ballot itself could be a zk-SNARK written to a blockchain signed with a private key owned by the voter.
- SahAssar 6y ago
  Sorry, I'm not well versed enough in zk-SNARK, can you explain how it solves the problems above? If it does do you think that you can make the general public trust/understand it enough to run a election?
- wavefunction 6y ago
  Sorry can't reply to your reply but... Making the ballot a zk-SNARK[0] would allow it to be queried for validity of certain assertions like "Did this ballot contain a vote for Candidate A or Proposition B" without leaking the identity of the voter. The voter's private key could decrypt the entire ballot perhaps for the voter's verification or even as another verifiable assertion that the ballot was signed with the specific key. Perhaps there would be a key provided by the voting authority body as another verifiable assertion that would allow the voting authority body to verify the user for their purposes if required. I agree that the more difficult part of this would be encouraging adoption and supporting use. There are hardware keys like yubikeys or hardware crypto wallets that can be populated with voter-generated keys to be used in the voting process, and these hardware keys could be populated in a process similar to getting a driver's license perhaps, except not waiting for it to arrive in the mail. Perhaps you go into your local clerk's office and they have a one-time key generator that populates your hardware key. I definitely haven't fleshed this idea out beyond some basic musings. [0]https://z.cash/technology/zksnarks/ https://z.cash/technology/zksnarks/
  - kelnos 6y ago
    Doesn't that still allow for vote-selling and vote extortion? Like if my employer threatens to fire me unless I vote a certain way, they'll accept me giving them my receipt saying I voted the way they wanted. Now, they can't prove that the receipt actually belonged to me, but it's certainly harder to procure someone else's receipt (from someone who voted the way the employer wanted).
Twisell 6y ago
Watching these links is really recommended if you don't yet see the issue with e-voting. PS: Well at least the first two, third one being the mandatory xkcd meta-reference :D
totony 6y ago
>Getting a "receipt" is also problematic: You should never be able to prove you voted A over B or vice versa since that opens up ways to intimidate people to vote one way and coerce them to prove it. Your receipt does not have to mention who you voted for in a way that's verifiable by a third party. But this problem is also a problem for mail-in ballots. >using somewhat public things like SSN, "numbers in your street address" and a credit card number is a terrible idea. Agreed, this does not mean that it is not feasible. You could use some zero-knowledge based proof that ensure that the person is allowed to vote and has voted only once without knowing his identity. Mail-in ballots are also problematic in that regard. I dislike that people say evoting is a bad idea when we already have things like mail in ballots which are analogous to a poor e voting system. >Also requiring a credit card or home to vote would almost certainly be unconstitutional. But don't you need a registered address to vote?
- SahAssar 6y ago
  > But don't you need a registered address to vote? I'm not 100% sure here but I thought homeless could vote? > mail in ballots which are analogous to a poor e voting system. I think it is mostly about scale. It is hard to impersonate 10000 people it requires physical objects, it is easier if it is digital. One of the videos deals with this, timecode here: https://youtu.be/LkH2r-sNjQs?t=140 https://youtu.be/LkH2r-sNjQs?t=140
  - totony 6y ago
    That timestamp is talking about physical voting. I'd posit it's easier to impersonate 10k mail in ballots of the same state than (let's say) crack 10k private keys or whatever is used for that system. I agree though that a new system will bring about exploits vectors that are unknown, but I'm not convinced they are as bad as what is implied in that video and this thread.
jjeaff 6y ago
I'm not talking about using SSN or other identifiers to validate voter identity, that would already be done at the polls or however we currently validate mail in ballots (should be something better than forensic signature comparison, though). The identifiers would simply be used so that the individual could check and validate that their vote was counted and counted correctly. But perhaps those identifiers wouldn't be necessary since you could simply assign a random uuid after the person votes that they can then use to look up.

wavefunction 6y ago

The ballot itself could be a zk-SNARK written to a blockchain signed with a private key owned by the voter.

SahAssar 6y ago
Sorry, I'm not well versed enough in zk-SNARK, can you explain how it solves the problems above? If it does do you think that you can make the general public trust/understand it enough to run a election?
wavefunction 6y ago
Sorry can't reply to your reply but... Making the ballot a zk-SNARK[0] would allow it to be queried for validity of certain assertions like "Did this ballot contain a vote for Candidate A or Proposition B" without leaking the identity of the voter. The voter's private key could decrypt the entire ballot perhaps for the voter's verification or even as another verifiable assertion that the ballot was signed with the specific key. Perhaps there would be a key provided by the voting authority body as another verifiable assertion that would allow the voting authority body to verify the user for their purposes if required. I agree that the more difficult part of this would be encouraging adoption and supporting use. There are hardware keys like yubikeys or hardware crypto wallets that can be populated with voter-generated keys to be used in the voting process, and these hardware keys could be populated in a process similar to getting a driver's license perhaps, except not waiting for it to arrive in the mail. Perhaps you go into your local clerk's office and they have a one-time key generator that populates your hardware key. I definitely haven't fleshed this idea out beyond some basic musings. [0]https://z.cash/technology/zksnarks/ https://z.cash/technology/zksnarks/
- kelnos 6y ago
  Doesn't that still allow for vote-selling and vote extortion? Like if my employer threatens to fire me unless I vote a certain way, they'll accept me giving them my receipt saying I voted the way they wanted. Now, they can't prove that the receipt actually belonged to me, but it's certainly harder to procure someone else's receipt (from someone who voted the way the employer wanted).

Twisell 6y ago

Watching these links is really recommended if you don't yet see the issue with e-voting. PS: Well at least the first two, third one being the mandatory xkcd meta-reference :D

totony 6y ago

>Getting a "receipt" is also problematic: You should never be able to prove you voted A over B or vice versa since that opens up ways to intimidate people to vote one way and coerce them to prove it. Your receipt does not have to mention who you voted for in a way that's verifiable by a third party. But this problem is also a problem for mail-in ballots. >using somewhat public things like SSN, "numbers in your street address" and a credit card number is a terrible idea. Agreed, this does not mean that it is not feasible. You could use some zero-knowledge based proof that ensure that the person is allowed to vote and has voted only once without knowing his identity. Mail-in ballots are also problematic in that regard. I dislike that people say evoting is a bad idea when we already have things like mail in ballots which are analogous to a poor e voting system. >Also requiring a credit card or home to vote would almost certainly be unconstitutional. But don't you need a registered address to vote?

SahAssar 6y ago
> But don't you need a registered address to vote? I'm not 100% sure here but I thought homeless could vote? > mail in ballots which are analogous to a poor e voting system. I think it is mostly about scale. It is hard to impersonate 10000 people it requires physical objects, it is easier if it is digital. One of the videos deals with this, timecode here: https://youtu.be/LkH2r-sNjQs?t=140 https://youtu.be/LkH2r-sNjQs?t=140
- totony 6y ago
  That timestamp is talking about physical voting. I'd posit it's easier to impersonate 10k mail in ballots of the same state than (let's say) crack 10k private keys or whatever is used for that system. I agree though that a new system will bring about exploits vectors that are unknown, but I'm not convinced they are as bad as what is implied in that video and this thread.

jjeaff 6y ago

I'm not talking about using SSN or other identifiers to validate voter identity, that would already be done at the polls or however we currently validate mail in ballots (should be something better than forensic signature comparison, though). The identifiers would simply be used so that the individual could check and validate that their vote was counted and counted correctly. But perhaps those identifiers wouldn't be necessary since you could simply assign a random uuid after the person votes that they can then use to look up.