6 ms·

While reading this I got a sense that all of these anachronistic processes would not exist if voting would be moved online. So many of the contentious issues we

While reading this I got a sense that all of these anachronistic processes would not exist if voting would be moved online. So many of the contentious issues we see here (mail-in ballots arriving late, machines not printing receipts, etc..) would simply not exist. Online voting seems like such a simpler approach.

ebg13 6y ago
> Online voting seems like such a simpler approach. It is! Until you try to secure it. Then it isn't.
- Shared404 6y ago
  And even if you do secure it, if Joe McCitizen can't understand it, it does you no good.
  - u801e 6y ago
    There are plenty of things that people do online without really understanding how it works, but they still do it. Online voting could be done securely over the network and could be authenticated with a certificate associated with one's voter registration that's anonymized in a way that doesn't reveal any information about the voter other than whether they have already voted. Also, it can be an option in addition to voting in person or by mail (like you can do now with taxes).
    - ebg13 6y ago
      > Online voting could be done securely over the network and could be authenticated with a certificate associated with one's voter registration that's anonymized in a way that doesn't reveal any information about the voter other than whether they have already voted. There's a lot of handwaving in this sentence about what can be done. We can't even secure computers when the fate of the entire world _doesn't_ depend on it. You think we can do a better job when control of a nuclear power with the world's largest economy rests in the balance? > like you can do now with taxes I'm not terribly worried about the consequences of someone filing my taxes for me.
      - u801e 6y ago
        > We can't even secure computers when the fate of the entire world _doesn't_ depend on it. This is hyperbole at best. In most cases, international policy does not change all that much regardless of what major party member happens to be president of the US. > I'm not terribly worried about the consequences of someone filing my taxes for me. Unless you have taken the time to fine tune your payments such that you don't receive a refund or owe a significant tax payment, then someone else filing can effectively get your refund, or put information in there that can land you legal trouble or have you owe a significant payment when you actually do not. That said, we have been able to file taxes online for many years now. It would be nice if we could get with the times and do the same for voting.
        Shared404 6y ago
        The problem is voting has to be simple enough that the average citizen can verify it. That is impossible to do with computers with the current average level of computer literacy.
        ebg13 6y ago
        That's a small problem, but not _the_ problem. _The_ problem is that, in our entire history of making networked computers, we have never successfully produced one capable of guaranteeing end-to-end security once someone starts poking at it. The person you're replying to is wishfully handwaving away electronic attacks like we haven't been facing an endless cascading catastrophe of device security breaches since practically forever. They further keep equating property theft scenarios, where you would easily notice that your money went to someone else, or personal harrassment scenarios, where your first consequence is a human individual audit not a national election outcome, with scenarios where you'd have no idea that your vote was changed unless you start implementing policies that would allow people to sell their votes, which is something that we don't allow for a reason. Paper ballots kept in small batches distributed among thousands of precincts that are counted by hand with opposition observers are hard to systematically rig. Bits in a cloud machine somewhere that lose all connection to your action are not. They further handwave away the significance of stealing an election because catastrophic harm would only happen _sometimes_.
marios 6y ago
I worry about online voting not being transparent enough
buzzert 6y ago
It’s trading one set of problems for an entirely different (and far scarier, IMO) set of problems.
pontus 6y ago
I used to be in your camp, but ultimately I think the decentralization and heterogeneity of the election processes provides a non-trivial layer of "security by obfuscation". In other words, if we streamline the process too well, we'll find ourselves with a system with a handful of highly vulnerable points of failure. I would much prefer a seemingly archaic system that, at the cost of annoyances and delays, at least provides us with a reasonable sense of conviction that the results are accurate.
- brundolf 6y ago
  Computers make it very easy to centrally modify/control information. Sometimes that's a good thing, sometimes it's a terrible thing.
  - MaxBarraclough 6y ago
    It's also unique in its specifics. Voting is an unusual data-management challenge as we want a paper-trail (we want to be able to verify the correctness of the count), and voter anonymity (it must be impossible to prove that a specific person voted a specific way). We can do this robustly and easily with paper-based voting. Electronic systems are often deeply flawed. Bruce Schneier's article on this: https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html https://www.schneier.com/blog/archives/2018/04/securing_elec...
- ryanobjc 6y ago
  Don’t forget the worst of the delays this year we’re deliberately left in place by GOP legislatures. There was a massive shift to mail in voting yet no changes to how they’re processed. The pre-canvass part: opening mail in ballots, verifying them, preparing them for tabulation, can be securely done before the election. Most states with substantial mail in already do this. That means on Election Day, workers merely have to tabulate ballots which is a lot less work. But in PA specifically the legislature declined to allow pre-canvass before the election. When done right we have have reasonable speed and security.
- brandmeyer 6y ago
  It also makes it much easier to directly observe which systems work better and which systems don't. Imagine for a moment that the entire country was using the exact same ballot process in 2000: The punch system that lead to so much ambiguity in FL. Its one thing to look at a system and say in the abstract "this could be much more reliable." Its another entirely to say "Look at states X, Y, and Z: Their process is actually much more reliable". I expect the same thing to happen after this election. Once things calm down, several states are going to improve their processes.
heavyset_go 6y ago
If you think IoT is bad when it comes to security, imagine what will happen when IoT is applied to voting. Insecure and hackable voting machines were already a problem more than a decade ago, and they're still a problem today.
burkaman 6y ago
I agree with you, except that I saw all the "anachronistic processes" as meaningful and useful backup systems. Obviously online voting would be simpler for the voter, I don't think anyone would deny that, but you wouldn't get: 1. Your physical signature witnessed by a poll worker, and your identity and presence physically recorded in several different locations. 2. A physical paper ballot only accessible by poll workers. 3. A locally stored electronic ballot only accessible by poll workers. 4. Multiple physical receipts with your votes, distributed to many different physical locations only accessible to poll workers. 5. A trained poll worker available to help at the time and place that you vote. 6. An easy backup plan if something goes wrong. Online voting is optimized for the happy path, but handling all the edge cases where something could go wrong is extremely difficult to implement and difficult for voters to understand. With online voting you need to ensure the security of the voter's physical device, operating system, web browser, each link in their internet connection, and all of those for the voting servers as well. After implementing processes to secure all of that, you need to communicate the security in a way that an average voter can understand it. You also need to think about what to do when a voter needs help, or their computer crashes mid-vote, or their power goes out, or someone sends them the wrong link, etc. etc. etc. Current processes are a little more complicated up front, but processes for preventing and correcting errors are easy to implement and understand.
AnimalMuppet 6y ago
The thing is, your grandma can watch a paper process, understand it, and verify that no shenanigans happened during the part that she was watching. But she can't do the same for online voting. She's not going to audit the software used. She's not going to verify network integrity, or authenticate packets. The manual processes are much better for transparency and verifiability. And we really badly need those qualities right now, when you have to be able to prove to the other side that the vote was legit, and be able to prove that every claim otherwise is false.
- ryanobjc 6y ago
  Yes exactly this so much. I’ve done poll clerk and the security of the process depends on security seals and armed guards and all sorts of things that are easy to understand.
g00gler 6y ago
In Pennsylvania there was a web tool via the department of state to check if your mail in ballot was counted. I can picture several ways to do a hybrid (mail + online) election like getting a code in the mail, voting online, then being able to ensure your ballot was counted correctly by using your code. It seems to make a lot more sense than having states count for a week.
- jpttsn 6y ago
  Randomizing would be even faster and easier, if you just want incorrect answers in record time. Voting has a short list of maybe four easily stated requirements. Online voting “solutions” tend to solve one or two, forget about the others, and try to compensate on user experience.
  - MaxBarraclough 6y ago
    > Voting has a short list of maybe four easily stated requirements. Online voting “solutions” tend to solve one or two, forget about the others, and try to compensate on user experience. Right. In this case: > then being able to ensure your ballot was counted correctly by using your code This fails the voter anonymity requirement. There must not be a database associating each voter with which way they voted.
- jeffbezos982134 6y ago
  I second that. People could still count for weeks afterwards to make sure everything comes out on the up and up.
MaxBarraclough 6y ago
> Online voting seems like such a simpler approach. It isn't. Bruce Schneier has written about how online voting is a terrible idea in general [0], and how real-world attempts at it are often woefully incompetent. [1][2] Voting should remain paper-based. [0] https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html https://www.schneier.com/blog/archives/2018/04/securing_elec... [1] https://www.schneier.com/blog/archives/2019/12/election_machin_2.html https://www.schneier.com/blog/archives/2019/12/election_mach... [2] https://www.schneier.com/blog/archives/2020/02/voatz_internet_.html https://www.schneier.com/blog/archives/2020/02/voatz_interne...
pgrote 6y ago
It could be. With voting I think the consideration is a barrier for voting. In many states you do not need to prove it to vote. Some states allow a normal vote and some states make them provisional. Still, no concrete identification is required when voting in most states. The voter is trusted to be who they say they are under possible penalty. This only applies to in person voting. Almost all states allowing mail in voting do not require notarization. With electronic voting you have a huge barrier in that not everyone has access to the means to vote electronically. You disenfranchise a pool of voters. https://ballotpedia.org/Voter_identification_laws_by_state https://ballotpedia.org/Voter_identification_laws_by_state
cm2187 6y ago
Beyond hacking, there is a reason to do polls in person. It is also a protection against people being coerced or selling their vote. When they are at the polling station, no outside force can exert any influence as the vote is fully confidential.
pkulak 6y ago
Decentralized, paper elections are the entire strength of the American system. Rigging an election means dealing with 50 entirely independent processes and modifying/creating millions of physical pieces of paper. Off the top of my head I can think of half a dozen ways to steal a centralized, digital election.
tehlike 6y ago
Mandatory xkcd: https://xkcd.com/2030/ https://xkcd.com/2030/
- MaxBarraclough 6y ago
  It's true that the software field is bad at what it does. When someone makes a truly secure piece of software, they get a PhD and repeatedly make the HN front-page. [0] It's not just a matter of writing code with no bugs, though. As I mentioned this another comment, [1] voting is unusual as we must be confident in the correctness of the count, and confident that it's not possible to prove whether a particular person voted a particular way. There's also a trust issue: with a digital system, a single corrupt official will likely be able to do far more damage to the vote than with a paper-based system. Even if the system is somehow structured to resist this, public trust might still be less than in a paper-based system. [0] https://ts.data61.csiro.au/projects/seL4/ https://ts.data61.csiro.au/projects/seL4/ [1] https://news.ycombinator.com/item?id=25048971 https://news.ycombinator.com/item?id=25048971
  - tehlike 6y ago
    You are correct. It needs to be anonymous, untamperable, auditable. I recently had a discussion with a friend who asked me how to implement a write only audit log that will comply with some finra regulation. I asked him how tamper proof it needs to be, and mentioned his system admin could practically stop the log writer, do shady stuff, and start the log writer and there is nothing you can do about it. As long as someone has access to the system, things can go wrong. I am hoping zero knowledge proof systems will provide some guarantees here some day.

ebg13 6y ago

> Online voting seems like such a simpler approach. It is! Until you try to secure it. Then it isn't.

Shared404 6y ago
And even if you do secure it, if Joe McCitizen can't understand it, it does you no good.
- u801e 6y ago
  There are plenty of things that people do online without really understanding how it works, but they still do it. Online voting could be done securely over the network and could be authenticated with a certificate associated with one's voter registration that's anonymized in a way that doesn't reveal any information about the voter other than whether they have already voted. Also, it can be an option in addition to voting in person or by mail (like you can do now with taxes).
  - ebg13 6y ago
    > Online voting could be done securely over the network and could be authenticated with a certificate associated with one's voter registration that's anonymized in a way that doesn't reveal any information about the voter other than whether they have already voted. There's a lot of handwaving in this sentence about what can be done. We can't even secure computers when the fate of the entire world _doesn't_ depend on it. You think we can do a better job when control of a nuclear power with the world's largest economy rests in the balance? > like you can do now with taxes I'm not terribly worried about the consequences of someone filing my taxes for me.
    - u801e 6y ago
      > We can't even secure computers when the fate of the entire world _doesn't_ depend on it. This is hyperbole at best. In most cases, international policy does not change all that much regardless of what major party member happens to be president of the US. > I'm not terribly worried about the consequences of someone filing my taxes for me. Unless you have taken the time to fine tune your payments such that you don't receive a refund or owe a significant tax payment, then someone else filing can effectively get your refund, or put information in there that can land you legal trouble or have you owe a significant payment when you actually do not. That said, we have been able to file taxes online for many years now. It would be nice if we could get with the times and do the same for voting.
      - Shared404 6y ago
        The problem is voting has to be simple enough that the average citizen can verify it. That is impossible to do with computers with the current average level of computer literacy.
        ebg13 6y ago
        That's a small problem, but not _the_ problem. _The_ problem is that, in our entire history of making networked computers, we have never successfully produced one capable of guaranteeing end-to-end security once someone starts poking at it. The person you're replying to is wishfully handwaving away electronic attacks like we haven't been facing an endless cascading catastrophe of device security breaches since practically forever. They further keep equating property theft scenarios, where you would easily notice that your money went to someone else, or personal harrassment scenarios, where your first consequence is a human individual audit not a national election outcome, with scenarios where you'd have no idea that your vote was changed unless you start implementing policies that would allow people to sell their votes, which is something that we don't allow for a reason. Paper ballots kept in small batches distributed among thousands of precincts that are counted by hand with opposition observers are hard to systematically rig. Bits in a cloud machine somewhere that lose all connection to your action are not. They further handwave away the significance of stealing an election because catastrophic harm would only happen _sometimes_.

marios 6y ago

I worry about online voting not being transparent enough

buzzert 6y ago

It’s trading one set of problems for an entirely different (and far scarier, IMO) set of problems.

pontus 6y ago

I used to be in your camp, but ultimately I think the decentralization and heterogeneity of the election processes provides a non-trivial layer of "security by obfuscation". In other words, if we streamline the process too well, we'll find ourselves with a system with a handful of highly vulnerable points of failure. I would much prefer a seemingly archaic system that, at the cost of annoyances and delays, at least provides us with a reasonable sense of conviction that the results are accurate.

brundolf 6y ago
Computers make it very easy to centrally modify/control information. Sometimes that's a good thing, sometimes it's a terrible thing.
- MaxBarraclough 6y ago
  It's also unique in its specifics. Voting is an unusual data-management challenge as we want a paper-trail (we want to be able to verify the correctness of the count), and voter anonymity (it must be impossible to prove that a specific person voted a specific way). We can do this robustly and easily with paper-based voting. Electronic systems are often deeply flawed. Bruce Schneier's article on this: https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html https://www.schneier.com/blog/archives/2018/04/securing_elec...
ryanobjc 6y ago
Don’t forget the worst of the delays this year we’re deliberately left in place by GOP legislatures. There was a massive shift to mail in voting yet no changes to how they’re processed. The pre-canvass part: opening mail in ballots, verifying them, preparing them for tabulation, can be securely done before the election. Most states with substantial mail in already do this. That means on Election Day, workers merely have to tabulate ballots which is a lot less work. But in PA specifically the legislature declined to allow pre-canvass before the election. When done right we have have reasonable speed and security.
brandmeyer 6y ago
It also makes it much easier to directly observe which systems work better and which systems don't. Imagine for a moment that the entire country was using the exact same ballot process in 2000: The punch system that lead to so much ambiguity in FL. Its one thing to look at a system and say in the abstract "this could be much more reliable." Its another entirely to say "Look at states X, Y, and Z: Their process is actually much more reliable". I expect the same thing to happen after this election. Once things calm down, several states are going to improve their processes.

heavyset_go 6y ago

If you think IoT is bad when it comes to security, imagine what will happen when IoT is applied to voting. Insecure and hackable voting machines were already a problem more than a decade ago, and they're still a problem today.

burkaman 6y ago

I agree with you, except that I saw all the "anachronistic processes" as meaningful and useful backup systems. Obviously online voting would be simpler for the voter, I don't think anyone would deny that, but you wouldn't get: 1. Your physical signature witnessed by a poll worker, and your identity and presence physically recorded in several different locations. 2. A physical paper ballot only accessible by poll workers. 3. A locally stored electronic ballot only accessible by poll workers. 4. Multiple physical receipts with your votes, distributed to many different physical locations only accessible to poll workers. 5. A trained poll worker available to help at the time and place that you vote. 6. An easy backup plan if something goes wrong. Online voting is optimized for the happy path, but handling all the edge cases where something could go wrong is extremely difficult to implement and difficult for voters to understand. With online voting you need to ensure the security of the voter's physical device, operating system, web browser, each link in their internet connection, and all of those for the voting servers as well. After implementing processes to secure all of that, you need to communicate the security in a way that an average voter can understand it. You also need to think about what to do when a voter needs help, or their computer crashes mid-vote, or their power goes out, or someone sends them the wrong link, etc. etc. etc. Current processes are a little more complicated up front, but processes for preventing and correcting errors are easy to implement and understand.

AnimalMuppet 6y ago

The thing is, your grandma can watch a paper process, understand it, and verify that no shenanigans happened during the part that she was watching. But she can't do the same for online voting. She's not going to audit the software used. She's not going to verify network integrity, or authenticate packets. The manual processes are much better for transparency and verifiability. And we really badly need those qualities right now, when you have to be able to prove to the other side that the vote was legit, and be able to prove that every claim otherwise is false.

ryanobjc 6y ago
Yes exactly this so much. I’ve done poll clerk and the security of the process depends on security seals and armed guards and all sorts of things that are easy to understand.

g00gler 6y ago

In Pennsylvania there was a web tool via the department of state to check if your mail in ballot was counted. I can picture several ways to do a hybrid (mail + online) election like getting a code in the mail, voting online, then being able to ensure your ballot was counted correctly by using your code. It seems to make a lot more sense than having states count for a week.

jpttsn 6y ago
Randomizing would be even faster and easier, if you just want incorrect answers in record time. Voting has a short list of maybe four easily stated requirements. Online voting “solutions” tend to solve one or two, forget about the others, and try to compensate on user experience.
- MaxBarraclough 6y ago
  > Voting has a short list of maybe four easily stated requirements. Online voting “solutions” tend to solve one or two, forget about the others, and try to compensate on user experience. Right. In this case: > then being able to ensure your ballot was counted correctly by using your code This fails the voter anonymity requirement. There must not be a database associating each voter with which way they voted.
jeffbezos982134 6y ago
I second that. People could still count for weeks afterwards to make sure everything comes out on the up and up.

MaxBarraclough 6y ago

> Online voting seems like such a simpler approach. It isn't. Bruce Schneier has written about how online voting is a terrible idea in general [0], and how real-world attempts at it are often woefully incompetent. [1][2] Voting should remain paper-based. [0] https://www.schneier.com/blog/archives/2018/04/securing_electi_1.html https://www.schneier.com/blog/archives/2018/04/securing_elec... [1] https://www.schneier.com/blog/archives/2019/12/election_machin_2.html https://www.schneier.com/blog/archives/2019/12/election_mach... [2] https://www.schneier.com/blog/archives/2020/02/voatz_internet_.html https://www.schneier.com/blog/archives/2020/02/voatz_interne...

pgrote 6y ago

It could be. With voting I think the consideration is a barrier for voting. In many states you do not need to prove it to vote. Some states allow a normal vote and some states make them provisional. Still, no concrete identification is required when voting in most states. The voter is trusted to be who they say they are under possible penalty. This only applies to in person voting. Almost all states allowing mail in voting do not require notarization. With electronic voting you have a huge barrier in that not everyone has access to the means to vote electronically. You disenfranchise a pool of voters. https://ballotpedia.org/Voter_identification_laws_by_state https://ballotpedia.org/Voter_identification_laws_by_state

cm2187 6y ago

Beyond hacking, there is a reason to do polls in person. It is also a protection against people being coerced or selling their vote. When they are at the polling station, no outside force can exert any influence as the vote is fully confidential.

pkulak 6y ago

Decentralized, paper elections are the entire strength of the American system. Rigging an election means dealing with 50 entirely independent processes and modifying/creating millions of physical pieces of paper. Off the top of my head I can think of half a dozen ways to steal a centralized, digital election.

tehlike 6y ago

Mandatory xkcd: https://xkcd.com/2030/ https://xkcd.com/2030/

MaxBarraclough 6y ago
It's true that the software field is bad at what it does. When someone makes a truly secure piece of software, they get a PhD and repeatedly make the HN front-page. [0] It's not just a matter of writing code with no bugs, though. As I mentioned this another comment, [1] voting is unusual as we must be confident in the correctness of the count, and confident that it's not possible to prove whether a particular person voted a particular way. There's also a trust issue: with a digital system, a single corrupt official will likely be able to do far more damage to the vote than with a paper-based system. Even if the system is somehow structured to resist this, public trust might still be less than in a paper-based system. [0] https://ts.data61.csiro.au/projects/seL4/ https://ts.data61.csiro.au/projects/seL4/ [1] https://news.ycombinator.com/item?id=25048971 https://news.ycombinator.com/item?id=25048971
- tehlike 6y ago
  You are correct. It needs to be anonymous, untamperable, auditable. I recently had a discussion with a friend who asked me how to implement a write only audit log that will comply with some finra regulation. I asked him how tamper proof it needs to be, and mentioned his system admin could practically stop the log writer, do shady stuff, and start the log writer and there is nothing you can do about it. As long as someone has access to the system, things can go wrong. I am hoping zero knowledge proof systems will provide some guarantees here some day.