3 ms·

The proof of human problems is actually addressable. We can imagine that the state publishes all public keys of its citizens in persistent storage, perhaps engr

The proof of human problems is actually addressable. We can imagine that the state publishes all public keys of its citizens in persistent storage, perhaps engraved in the stone, along with the name and where to find the person. To verify that the state is keeping the record of citizens, accurate auditors come in. They can select 100 individuals verifiably random (for instance, taking hash function and sorting) and try to reach out to these individuals and check that they indeed own the keys they have been assigned, for instance, signing an auditor-given message. The number of individuals who did not have the correct keys or were unreachable could then be used to infer the legitimacy of elections being run.

machina_ex_deus 4y ago
You still didn't prove the non existence of cryptographic backdoor, hardware backdoor or anything else in the chain. There's also a decent chance the audit fail, then now what do you do? A person can be unreachable. Do you now cancel the entire system because a person was unreachable? If the answer is no, the audit is useless. It was already proved many times that audits which don't have any penalty or contingency when they fail are meaningless. Moreover, You can't trust anyone's random other than your own. In this case, the so called auditors are also a small point of failure, and if you allow any1 to audit, people will eventually find someone who's missing. Audits are like stack cookies, they are terrible security practice. You need to have security boundaries and defend them to have a good security system. Attempting to check if the horses left the stable is not a reliable boundary, it's good only as supplemental security measure. Just like having a blue team and a red team isn't enough, you need to have firewalls, you need to have defensible network architecture. You need endpoint protection, and you need to keep everything updated.
- JanisErdmanis 4y ago
  > A person can be unreachable. Do you now cancel the entire system because a person was unreachable? You can always source the missing people on national TV ;) The goal of the audit is to estimate the number of voters who could have been compromised and the effect it could have had on the election result. In case the percentage of unreachable voters has been larger than the difference between losing and winning parties, then elections could be cancelled elsewise the result stands. > You need to have security boundaries and defend them to have a good security system. I don't see much difference between corporate practices that aim to prevent unauthorised access to secrets and digital identity management at the state level. Am I missing something?
  - machina_ex_deus 4y ago
    Yes, the threat model is that the government is the malicious entity and the people are the verifier. If the government creates the code and the protocols they are hard to secure against the government itself. Elections are the only time you do not trust your government because in elections you establish your trust. If you trust the government with elections that's a circular trust problem and it only needs to win once. So the boundaries are what the people can verify, what many Bobs and Alices can do physically together in the real world to see that real Bob and Alice exists and support the government. And the government is Eve. If you're giving Eve the power to determine who's real without needing to present a real human, you already lost. Audits means that Eve only needs to compromise a few more auditors. Real elections Eve needs to compromise impossible number of people.
    - JanisErdmanis 4y ago
      > If the government creates the code and the protocols, they are hard to secure against the government itself. > Elections are the only time you do not trust your government because in elections you establish your trust. If you trust the government with elections that's a circular trust problem and it only needs to win once. I wholeheartedly agree. I think you may find a good read on electoral transparency which develops that further: > Olivier Belanger, Randi Markussen, Lorena Ronquillo, Carsten Schurmann, Framing Electoral Transparency: A Comparative Analysis of Three E-vote Counting Ceremonies, 2016. From the top thread, I thought you attacked the notion of a digital identity itself.
Rexxar 4y ago
> The proof of human problems is actually addressable I think it's fundamentally impossible and I have yet to see something that make me envision the possibility it could be possible. The most important part of democratic vote is not the ballot box but the voting booth : the place where you have the guaranty that every citizen go only once per vote, is alone and can decide by himself without any external pressure what to put in the ballot box. Every electronic or remote systems is subject in a way or an other to the risk of vote buying or threat to force people to vote against their will.
- JanisErdmanis 4y ago
  The top thread emphasises the problem of digital identity. It's the question of how we can be sure that the digital credentials with which voters participate have been allocated fairly, like having fake passports printed, impersonating dead people or voting in place of those who often don't come to vote. > I have yet to see something that make me envision the possibility it could be possible. Remote electronic voting is a very hard problem to crack. The systems that could have some merit have fallen out from academic endeavours. I recommend looking at this paper could help to envision the possibility: > Rolf Haenni, Oliver Spycher, Secure Internet Voting on Limited Devices with Anonymized DSA Public Keys, 2011.

machina_ex_deus 4y ago

You still didn't prove the non existence of cryptographic backdoor, hardware backdoor or anything else in the chain. There's also a decent chance the audit fail, then now what do you do? A person can be unreachable. Do you now cancel the entire system because a person was unreachable? If the answer is no, the audit is useless. It was already proved many times that audits which don't have any penalty or contingency when they fail are meaningless. Moreover, You can't trust anyone's random other than your own. In this case, the so called auditors are also a small point of failure, and if you allow any1 to audit, people will eventually find someone who's missing. Audits are like stack cookies, they are terrible security practice. You need to have security boundaries and defend them to have a good security system. Attempting to check if the horses left the stable is not a reliable boundary, it's good only as supplemental security measure. Just like having a blue team and a red team isn't enough, you need to have firewalls, you need to have defensible network architecture. You need endpoint protection, and you need to keep everything updated.

JanisErdmanis 4y ago
> A person can be unreachable. Do you now cancel the entire system because a person was unreachable? You can always source the missing people on national TV ;) The goal of the audit is to estimate the number of voters who could have been compromised and the effect it could have had on the election result. In case the percentage of unreachable voters has been larger than the difference between losing and winning parties, then elections could be cancelled elsewise the result stands. > You need to have security boundaries and defend them to have a good security system. I don't see much difference between corporate practices that aim to prevent unauthorised access to secrets and digital identity management at the state level. Am I missing something?
- machina_ex_deus 4y ago
  Yes, the threat model is that the government is the malicious entity and the people are the verifier. If the government creates the code and the protocols they are hard to secure against the government itself. Elections are the only time you do not trust your government because in elections you establish your trust. If you trust the government with elections that's a circular trust problem and it only needs to win once. So the boundaries are what the people can verify, what many Bobs and Alices can do physically together in the real world to see that real Bob and Alice exists and support the government. And the government is Eve. If you're giving Eve the power to determine who's real without needing to present a real human, you already lost. Audits means that Eve only needs to compromise a few more auditors. Real elections Eve needs to compromise impossible number of people.
  - JanisErdmanis 4y ago
    > If the government creates the code and the protocols, they are hard to secure against the government itself. > Elections are the only time you do not trust your government because in elections you establish your trust. If you trust the government with elections that's a circular trust problem and it only needs to win once. I wholeheartedly agree. I think you may find a good read on electoral transparency which develops that further: > Olivier Belanger, Randi Markussen, Lorena Ronquillo, Carsten Schurmann, Framing Electoral Transparency: A Comparative Analysis of Three E-vote Counting Ceremonies, 2016. From the top thread, I thought you attacked the notion of a digital identity itself.

Rexxar 4y ago

> The proof of human problems is actually addressable I think it's fundamentally impossible and I have yet to see something that make me envision the possibility it could be possible. The most important part of democratic vote is not the ballot box but the voting booth : the place where you have the guaranty that every citizen go only once per vote, is alone and can decide by himself without any external pressure what to put in the ballot box. Every electronic or remote systems is subject in a way or an other to the risk of vote buying or threat to force people to vote against their will.

JanisErdmanis 4y ago
The top thread emphasises the problem of digital identity. It's the question of how we can be sure that the digital credentials with which voters participate have been allocated fairly, like having fake passports printed, impersonating dead people or voting in place of those who often don't come to vote. > I have yet to see something that make me envision the possibility it could be possible. Remote electronic voting is a very hard problem to crack. The systems that could have some merit have fallen out from academic endeavours. I recommend looking at this paper could help to envision the possibility: > Rolf Haenni, Oliver Spycher, Secure Internet Voting on Limited Devices with Anonymized DSA Public Keys, 2011.