4 ms·

Liquid democracy, direct democracies and all these shenanigans sound good on paper but they are incredibly easy to manipulate by the government. Only paper bal

Liquid democracy, direct democracies and all these shenanigans sound good on paper but they are incredibly easy to manipulate by the government. Only paper ballots, with humans counting them, and humans observing them, can properly be "Proof of human": proof that there's an actual human being behind the vote. The fundamental problem in "Proof of human" is that fake identities are easily fabricated, dead humans can keep on voting if the government "forgets" about them, and finally, backdoors can be inserted into software systems creating a single point of failure, and the incentives of the government funding these systems is to get re-elected. Mail ballots, voting machines, and early voting where there are months of voting and volunteers don't have time to oversee months of voting, it's all problematic. The fundamental measure in "Proof of human" is how many humans you need to trust to have confidence in the results. Do you need million election workers to go rogue? 100,000? 100? or maybe only 20 election workers in the right position can completely change the result? That's what makes the difference between fraud being a conspiracy and plausible: the number of people who need to be part of the conspiracy. Getting a cryptographic backdoor in electronic voting systems is not even in conspiracy land, it requires only handful of people to be a part of it, and it can even happen remotely by an adversary country (such as Russia).

JanisErdmanis 4y ago
The proof of human problems is actually addressable. We can imagine that the state publishes all public keys of its citizens in persistent storage, perhaps engraved in the stone, along with the name and where to find the person. To verify that the state is keeping the record of citizens, accurate auditors come in. They can select 100 individuals verifiably random (for instance, taking hash function and sorting) and try to reach out to these individuals and check that they indeed own the keys they have been assigned, for instance, signing an auditor-given message. The number of individuals who did not have the correct keys or were unreachable could then be used to infer the legitimacy of elections being run.
- machina_ex_deus 4y ago
  You still didn't prove the non existence of cryptographic backdoor, hardware backdoor or anything else in the chain. There's also a decent chance the audit fail, then now what do you do? A person can be unreachable. Do you now cancel the entire system because a person was unreachable? If the answer is no, the audit is useless. It was already proved many times that audits which don't have any penalty or contingency when they fail are meaningless. Moreover, You can't trust anyone's random other than your own. In this case, the so called auditors are also a small point of failure, and if you allow any1 to audit, people will eventually find someone who's missing. Audits are like stack cookies, they are terrible security practice. You need to have security boundaries and defend them to have a good security system. Attempting to check if the horses left the stable is not a reliable boundary, it's good only as supplemental security measure. Just like having a blue team and a red team isn't enough, you need to have firewalls, you need to have defensible network architecture. You need endpoint protection, and you need to keep everything updated.
  - JanisErdmanis 4y ago
    > A person can be unreachable. Do you now cancel the entire system because a person was unreachable? You can always source the missing people on national TV ;) The goal of the audit is to estimate the number of voters who could have been compromised and the effect it could have had on the election result. In case the percentage of unreachable voters has been larger than the difference between losing and winning parties, then elections could be cancelled elsewise the result stands. > You need to have security boundaries and defend them to have a good security system. I don't see much difference between corporate practices that aim to prevent unauthorised access to secrets and digital identity management at the state level. Am I missing something?
    - machina_ex_deus 4y ago
      Yes, the threat model is that the government is the malicious entity and the people are the verifier. If the government creates the code and the protocols they are hard to secure against the government itself. Elections are the only time you do not trust your government because in elections you establish your trust. If you trust the government with elections that's a circular trust problem and it only needs to win once. So the boundaries are what the people can verify, what many Bobs and Alices can do physically together in the real world to see that real Bob and Alice exists and support the government. And the government is Eve. If you're giving Eve the power to determine who's real without needing to present a real human, you already lost. Audits means that Eve only needs to compromise a few more auditors. Real elections Eve needs to compromise impossible number of people.
- Rexxar 4y ago
  > The proof of human problems is actually addressable I think it's fundamentally impossible and I have yet to see something that make me envision the possibility it could be possible. The most important part of democratic vote is not the ballot box but the voting booth : the place where you have the guaranty that every citizen go only once per vote, is alone and can decide by himself without any external pressure what to put in the ballot box. Every electronic or remote systems is subject in a way or an other to the risk of vote buying or threat to force people to vote against their will.
  - JanisErdmanis 4y ago
    The top thread emphasises the problem of digital identity. It's the question of how we can be sure that the digital credentials with which voters participate have been allocated fairly, like having fake passports printed, impersonating dead people or voting in place of those who often don't come to vote. > I have yet to see something that make me envision the possibility it could be possible. Remote electronic voting is a very hard problem to crack. The systems that could have some merit have fallen out from academic endeavours. I recommend looking at this paper could help to envision the possibility: > Rolf Haenni, Oliver Spycher, Secure Internet Voting on Limited Devices with Anonymized DSA Public Keys, 2011.
tgsovlerkhgsel 4y ago
Passive/lazy participants are more than enough to manipulate the system, you don't even need to fake anything. https://news.ycombinator.com/item?id=34363267 https://news.ycombinator.com/item?id=34363267
- tdeck 4y ago
  Based on that description, it sounds like the worst outcome is that it becomes like regular representative democracy.
  - tgsovlerkhgsel 4y ago
    If there was a regular requirement to re-confirm delegations, maybe, but "chain delegations" are another problem. Voting power is transferable. If A and B delegate to C, and C delegates to D, D has a voting power of 4. The goal of liquid democracy was specifically to not be a regular representative democracy, and to (meaningfully) allow direct participation, and it fails spectacularly at that.
  - mistermann 4y ago
    It's a tough call: do we choose a new political system that could potentially become corrupt, or stick with the one we know to be corrupt?
hgsgm 4y ago
Huh? Liquid democracy can do delegating via paper votes. There is nothing inherently electronic about liquid democracy. We have a Congress, which is a (highly viscous) form of liquid democracy. Are you worried about Congress having fake votes?
anonymouskimmer 4y ago
> "Only paper ballots, with humans counting them, and humans observing them, can properly be "Proof of human"" In Glarus and Appenzell Innerrhoden the discussion, voting, and vote counting is live and in person. The votes are typically tallied by counting raised hands. Probably superior to counting paper ballots.
panick21_ 4y ago
Those are two separate problems that you are mixing up. Nothing about liquid or direct democracy is about electronic voting. Here in Switzerland some cantons literally do direct democracy by hand raising to decide on government issues. Both direct and liquid democracy can be conducted with paper.
- machina_ex_deus 4y ago
  Hands raised is even better, fair point. So long as you're physically verifying humans, it's good. The problem is that usually direct and liquid democracy aren't scalable, and you're not going to do country wide elections on everything. So these methods tend to converge to some electronic hack instead.
  - panick21_ 4y ago
    In Switzerland we do direct democracy with paper and count the votes in a 1 day. This can be done many times a year. > and you're not going to do country wide elections on everything. Well sure. As in you can't make literally every single choice of a government by direct democracy. That literally impossible because those are millions and millions of choices every minute. Nothing will solve that problem, in the end of the day you need some people to simply have people doing their job to make these choices based on what was decided on a higher level. So the question is how do these people get in those jobs and then do they select the people that work below them or who does that. In Switzerland we elect a parliament, that parliament elects top level ministers and their choices can be over-written or new laws can be interceded with direct democracy. You can alternatively have a system where instead of the parliament electing top ministers, a liquid democracy system elects those ministers and makes the choices normally made by parliament. The ministers work for the liquid democracy and have to implement the choices made in that system. Or you could go beyond just the ministers and elect a broader set of people. > So these methods tend to converge to some electronic hack instead. No its not some 'electronic hack'. Its just a question about what things should we want to use these systems for and what not. Nobody proposes to use liquid democracy to decide what kind of colors should be used when buying new pens or whatever.

JanisErdmanis 4y ago

The proof of human problems is actually addressable. We can imagine that the state publishes all public keys of its citizens in persistent storage, perhaps engraved in the stone, along with the name and where to find the person. To verify that the state is keeping the record of citizens, accurate auditors come in. They can select 100 individuals verifiably random (for instance, taking hash function and sorting) and try to reach out to these individuals and check that they indeed own the keys they have been assigned, for instance, signing an auditor-given message. The number of individuals who did not have the correct keys or were unreachable could then be used to infer the legitimacy of elections being run.

machina_ex_deus 4y ago
You still didn't prove the non existence of cryptographic backdoor, hardware backdoor or anything else in the chain. There's also a decent chance the audit fail, then now what do you do? A person can be unreachable. Do you now cancel the entire system because a person was unreachable? If the answer is no, the audit is useless. It was already proved many times that audits which don't have any penalty or contingency when they fail are meaningless. Moreover, You can't trust anyone's random other than your own. In this case, the so called auditors are also a small point of failure, and if you allow any1 to audit, people will eventually find someone who's missing. Audits are like stack cookies, they are terrible security practice. You need to have security boundaries and defend them to have a good security system. Attempting to check if the horses left the stable is not a reliable boundary, it's good only as supplemental security measure. Just like having a blue team and a red team isn't enough, you need to have firewalls, you need to have defensible network architecture. You need endpoint protection, and you need to keep everything updated.
- JanisErdmanis 4y ago
  > A person can be unreachable. Do you now cancel the entire system because a person was unreachable? You can always source the missing people on national TV ;) The goal of the audit is to estimate the number of voters who could have been compromised and the effect it could have had on the election result. In case the percentage of unreachable voters has been larger than the difference between losing and winning parties, then elections could be cancelled elsewise the result stands. > You need to have security boundaries and defend them to have a good security system. I don't see much difference between corporate practices that aim to prevent unauthorised access to secrets and digital identity management at the state level. Am I missing something?
  - machina_ex_deus 4y ago
    Yes, the threat model is that the government is the malicious entity and the people are the verifier. If the government creates the code and the protocols they are hard to secure against the government itself. Elections are the only time you do not trust your government because in elections you establish your trust. If you trust the government with elections that's a circular trust problem and it only needs to win once. So the boundaries are what the people can verify, what many Bobs and Alices can do physically together in the real world to see that real Bob and Alice exists and support the government. And the government is Eve. If you're giving Eve the power to determine who's real without needing to present a real human, you already lost. Audits means that Eve only needs to compromise a few more auditors. Real elections Eve needs to compromise impossible number of people.
Rexxar 4y ago
> The proof of human problems is actually addressable I think it's fundamentally impossible and I have yet to see something that make me envision the possibility it could be possible. The most important part of democratic vote is not the ballot box but the voting booth : the place where you have the guaranty that every citizen go only once per vote, is alone and can decide by himself without any external pressure what to put in the ballot box. Every electronic or remote systems is subject in a way or an other to the risk of vote buying or threat to force people to vote against their will.
- JanisErdmanis 4y ago
  The top thread emphasises the problem of digital identity. It's the question of how we can be sure that the digital credentials with which voters participate have been allocated fairly, like having fake passports printed, impersonating dead people or voting in place of those who often don't come to vote. > I have yet to see something that make me envision the possibility it could be possible. Remote electronic voting is a very hard problem to crack. The systems that could have some merit have fallen out from academic endeavours. I recommend looking at this paper could help to envision the possibility: > Rolf Haenni, Oliver Spycher, Secure Internet Voting on Limited Devices with Anonymized DSA Public Keys, 2011.

tgsovlerkhgsel 4y ago

Passive/lazy participants are more than enough to manipulate the system, you don't even need to fake anything. https://news.ycombinator.com/item?id=34363267 https://news.ycombinator.com/item?id=34363267

tdeck 4y ago
Based on that description, it sounds like the worst outcome is that it becomes like regular representative democracy.
- tgsovlerkhgsel 4y ago
  If there was a regular requirement to re-confirm delegations, maybe, but "chain delegations" are another problem. Voting power is transferable. If A and B delegate to C, and C delegates to D, D has a voting power of 4. The goal of liquid democracy was specifically to not be a regular representative democracy, and to (meaningfully) allow direct participation, and it fails spectacularly at that.
- mistermann 4y ago
  It's a tough call: do we choose a new political system that could potentially become corrupt, or stick with the one we know to be corrupt?

hgsgm 4y ago

Huh? Liquid democracy can do delegating via paper votes. There is nothing inherently electronic about liquid democracy. We have a Congress, which is a (highly viscous) form of liquid democracy. Are you worried about Congress having fake votes?

anonymouskimmer 4y ago

> "Only paper ballots, with humans counting them, and humans observing them, can properly be "Proof of human"" In Glarus and Appenzell Innerrhoden the discussion, voting, and vote counting is live and in person. The votes are typically tallied by counting raised hands. Probably superior to counting paper ballots.

panick21_ 4y ago

Those are two separate problems that you are mixing up. Nothing about liquid or direct democracy is about electronic voting. Here in Switzerland some cantons literally do direct democracy by hand raising to decide on government issues. Both direct and liquid democracy can be conducted with paper.

machina_ex_deus 4y ago
Hands raised is even better, fair point. So long as you're physically verifying humans, it's good. The problem is that usually direct and liquid democracy aren't scalable, and you're not going to do country wide elections on everything. So these methods tend to converge to some electronic hack instead.
- panick21_ 4y ago
  In Switzerland we do direct democracy with paper and count the votes in a 1 day. This can be done many times a year. > and you're not going to do country wide elections on everything. Well sure. As in you can't make literally every single choice of a government by direct democracy. That literally impossible because those are millions and millions of choices every minute. Nothing will solve that problem, in the end of the day you need some people to simply have people doing their job to make these choices based on what was decided on a higher level. So the question is how do these people get in those jobs and then do they select the people that work below them or who does that. In Switzerland we elect a parliament, that parliament elects top level ministers and their choices can be over-written or new laws can be interceded with direct democracy. You can alternatively have a system where instead of the parliament electing top ministers, a liquid democracy system elects those ministers and makes the choices normally made by parliament. The ministers work for the liquid democracy and have to implement the choices made in that system. Or you could go beyond just the ministers and elect a broader set of people. > So these methods tend to converge to some electronic hack instead. No its not some 'electronic hack'. Its just a question about what things should we want to use these systems for and what not. Nobody proposes to use liquid democracy to decide what kind of colors should be used when buying new pens or whatever.