3 ms·

You still didn't prove the non existence of cryptographic backdoor, hardware backdoor or anything else in the chain. There's also a decent chance the audit fai

You still didn't prove the non existence of cryptographic backdoor, hardware backdoor or anything else in the chain. There's also a decent chance the audit fail, then now what do you do? A person can be unreachable. Do you now cancel the entire system because a person was unreachable? If the answer is no, the audit is useless. It was already proved many times that audits which don't have any penalty or contingency when they fail are meaningless. Moreover, You can't trust anyone's random other than your own. In this case, the so called auditors are also a small point of failure, and if you allow any1 to audit, people will eventually find someone who's missing. Audits are like stack cookies, they are terrible security practice. You need to have security boundaries and defend them to have a good security system. Attempting to check if the horses left the stable is not a reliable boundary, it's good only as supplemental security measure. Just like having a blue team and a red team isn't enough, you need to have firewalls, you need to have defensible network architecture. You need endpoint protection, and you need to keep everything updated.

JanisErdmanis 4y ago
> A person can be unreachable. Do you now cancel the entire system because a person was unreachable? You can always source the missing people on national TV ;) The goal of the audit is to estimate the number of voters who could have been compromised and the effect it could have had on the election result. In case the percentage of unreachable voters has been larger than the difference between losing and winning parties, then elections could be cancelled elsewise the result stands. > You need to have security boundaries and defend them to have a good security system. I don't see much difference between corporate practices that aim to prevent unauthorised access to secrets and digital identity management at the state level. Am I missing something?
- machina_ex_deus 4y ago
  Yes, the threat model is that the government is the malicious entity and the people are the verifier. If the government creates the code and the protocols they are hard to secure against the government itself. Elections are the only time you do not trust your government because in elections you establish your trust. If you trust the government with elections that's a circular trust problem and it only needs to win once. So the boundaries are what the people can verify, what many Bobs and Alices can do physically together in the real world to see that real Bob and Alice exists and support the government. And the government is Eve. If you're giving Eve the power to determine who's real without needing to present a real human, you already lost. Audits means that Eve only needs to compromise a few more auditors. Real elections Eve needs to compromise impossible number of people.
  - JanisErdmanis 4y ago
    > If the government creates the code and the protocols, they are hard to secure against the government itself. > Elections are the only time you do not trust your government because in elections you establish your trust. If you trust the government with elections that's a circular trust problem and it only needs to win once. I wholeheartedly agree. I think you may find a good read on electoral transparency which develops that further: > Olivier Belanger, Randi Markussen, Lorena Ronquillo, Carsten Schurmann, Framing Electoral Transparency: A Comparative Analysis of Three E-vote Counting Ceremonies, 2016. From the top thread, I thought you attacked the notion of a digital identity itself.

JanisErdmanis 4y ago

> A person can be unreachable. Do you now cancel the entire system because a person was unreachable? You can always source the missing people on national TV ;) The goal of the audit is to estimate the number of voters who could have been compromised and the effect it could have had on the election result. In case the percentage of unreachable voters has been larger than the difference between losing and winning parties, then elections could be cancelled elsewise the result stands. > You need to have security boundaries and defend them to have a good security system. I don't see much difference between corporate practices that aim to prevent unauthorised access to secrets and digital identity management at the state level. Am I missing something?

machina_ex_deus 4y ago
Yes, the threat model is that the government is the malicious entity and the people are the verifier. If the government creates the code and the protocols they are hard to secure against the government itself. Elections are the only time you do not trust your government because in elections you establish your trust. If you trust the government with elections that's a circular trust problem and it only needs to win once. So the boundaries are what the people can verify, what many Bobs and Alices can do physically together in the real world to see that real Bob and Alice exists and support the government. And the government is Eve. If you're giving Eve the power to determine who's real without needing to present a real human, you already lost. Audits means that Eve only needs to compromise a few more auditors. Real elections Eve needs to compromise impossible number of people.
- JanisErdmanis 4y ago
  > If the government creates the code and the protocols, they are hard to secure against the government itself. > Elections are the only time you do not trust your government because in elections you establish your trust. If you trust the government with elections that's a circular trust problem and it only needs to win once. I wholeheartedly agree. I think you may find a good read on electoral transparency which develops that further: > Olivier Belanger, Randi Markussen, Lorena Ronquillo, Carsten Schurmann, Framing Electoral Transparency: A Comparative Analysis of Three E-vote Counting Ceremonies, 2016. From the top thread, I thought you attacked the notion of a digital identity itself.