28 ms·

Belenios: Verifiable online voting system

181 points by leonry 2y ago

9dev 2y ago
Can you even reliably verify the entire voting process? From individuals using digital devices to votes being counted and tallies confirmed?
tromp 2y ago
> Using the web interface, the voter enters her credential and selects her vote. Her computer then computes the ballot, which corresponds to the vote encrypted with the election public key. Like most (or all?) online protocols, this doesn't protect against vote selling or vote coercion.
- SamBam 2y ago
  I was going to say. AFAIK, no one has worked out a way that you can verify that your own vote was counted, while preventing you from being able to sell your vote.
  - rcarback 2y ago
    There are a number of such systems that do this via revoting or dummy ballots. One of my projects, Votexx, uses vote nullification (or flipping) via a trusted third party chosen by the voter. The general idea for all of these is if you add uncertainty you reduce what a coercer is willing to pay creating a mutually assured destruction scenario whereby the system being in place ensures nobody ever tries it. Votexx.org if you want to learn more.
    - JanisErdmanis 2y ago
      The website on VoteXX and associated 4 page preprint does not offer comprehensive overview of the system. What happens to verifiabiloty when the vote is nullified? Does voter sees that the vote is cancelled and hence also coercer/briber?
- peterhunt 2y ago
  The same could be said of mail in paper ballots too, which have seen widespread adoption in the United States starting in 2020, so I don’t think this should be a knock against this system.
  - SamBam 2y ago
    How would you prove that you voted how you said you did? If you took a picture of your ballot, or even if you filmed yourself putting it in the envelope and putting it in the mailbox, there's nothing stopping you from taking it out later, tearing it up, and going to vote differently in person.
    - peterhunt 2y ago
      Just do it in person. The voter fills out the ballot in front of the buyer, seals and signs the envelope, and hands it to the buyer in exchange for cash. The buyer then puts it in the mail on the voter’s behalf. The voter could go to a polling place afterwards and attempt to cast a provisional ballot but my understanding is that this is difficult, varies significantly state to state, and in many cases is not possible given that mail in ballots are detached from the voter identity ahead of Election Day in many states.
      - deleted 2y ago
        [deleted]
      - deleted 2y ago
        [deleted]
    - codedokode 2y ago
      First, this is too much trouble and many won't do this, second, you can lie to people that you have the means to verify their vote, third, you might require a person to write a code word on the ballot so that you can verify that they actually casted that ballot.
  - pessimizer 2y ago
    You haven't heard people "knocking" about the widespread adoption of mail in paper ballots? They simply offer no protection against vote coercion which is not a good choice in any election of importance. Pretty sure at least one of the two parties has ending mail-in voting as a long-held position. At the least, this will often result in heads of household voting for their entire families. At the most, it can result in people voting under the supervision of a local gang/militia member. If anyone is looking for the right terminology to find papers, it's "no-receipt" voting. The holy grail is no-receipt, yet verifiable voting, but it might be mathematically impossible.
- kylewatson 2y ago
  The website says that your vote is last-write-wins. I think the idea is I could sell my vote and vote for A, then later re-vote for B. Since you can't trust that I won't just re-vote it won't be worth paying for. But if you held a gun to my head and made me vote at 18:59, with polls closing at 19:00, then I guess it would work. Hell, if you held a gun to my head and had me vote a week early and then blew my brains out, that would probably also keep me from voting again. So it's not complete, but neither is the current system. You could hold a gun to my loved-ones head and tell me to go vote for B in our current system. I could photograph the ballot from the box, cellphones are small these days. Or if I vote by mail I could easily prove to you I voted for B so you would let the hostage free. So I guess it actually is an improvement over the status quo.
  - nmca 2y ago
    hm - do random end times solve that particular issue?
  - codedokode 2y ago
    You don't need any guns here. Just call your employees and make them vote on their phone in your presense. Also lie that you have people able to see how they voted. Also give them some money so that they feel themselves as accomplice.
- baobabKoodaa 2y ago
  There are some voting schemes which protect against vote selling and coercion: https://attejuvonen.fi/thesis https://attejuvonen.fi/thesis
throwaway48476 2y ago
The goal of a voting system is not verifiability, but trust. Without trust elections have no legitimacy.
- the_snooze 2y ago
  I think these are technically interesting systems, but "trust" really is the goal. "Verifiability" doesn't necessarily imply "trust," especially if it's shrowded behind inscruable crypto mumbo-jumbo. A voting system should be something voters and poll workers (i.e., local volunteers) can understand.
  - throwaway48476 2y ago
    A better heuristic is 'can you explain the system to a five year old'.
  - ratorx 2y ago
    Ideally you want both. “Trust” is a bit qualitative and includes a lot of factors outside the voting system itself. Just because a voting system is “simple” doesn’t mean people trust it (e.g. Trump voting shenanigans). Obviously just because there are bad actors which can make trust impossible, doesn’t mean you should give up but it is a separate axis to the voting system itself. On the other hand, “verifiability” is a more useful property on a larger scale. You may trust your local government but do you trust local government in all other districts? What if, with sufficient knowledge you could prove that their voting was right or wrong? I think that also seems like a useful property.
  - rayiner 2y ago
    Correct. The system must be something a bottom 15 percentile person can understand and doesn’t think is magic. https://youtu.be/DUZa7qIGAdo?si=RDsgH2uIKb8k7ueG https://youtu.be/DUZa7qIGAdo?si=RDsgH2uIKb8k7ueG
    - mightyham 2y ago
      Or universal suffrage is fundamentally flawed. If people can't understand mildly complex voting systems then why should they be contributing to making political decisions that are significantly more complex.
trte9343r4 2y ago
In reality private keys will be mailed in insecure envelopes, issued multiple times (just to be sure) or issued to people, who are not citizens, moved away or died.
- inhumantsar 2y ago
  I don't disagree, the identity matching and uniqueness problem is a tough nut to crack. it's worth keeping in mind though that this is an issue the current system faces. voters end up duplicated in the rolls under different addresses or old names, or they don't get removed from the rolls after losing eligibility or dying. once upon a time I got two voter cards in the mail, one forwarded from an old address. I was eligible in two districts after nothing more extraordinary than moving across town. had to call in to get removed from the extra district.
- mariusor 2y ago
  I think this will be prevented when these private keys will be part of the national IDs, similar to how Estonia and other European countries do it. If there's a "national registry of citizens" comprised of public keys, I think it will be easy to organize ballots on top of that.
  - codedokode 2y ago
    The government can issue fake IDs and vote in their name. Especially in countries where there are many migrants who receive citizenship, you can easily issue some extra IDs and nobody notices.
    - JanisErdmanis 2y ago
      This attack vector is no different with paper ballots.
      - codedokode 2y ago
        With paper voting you need both fake IDs and people. You need to recruit people ready to commit a crime, and transport them between polling stations. If you want to add million fake votes, you need somewhere about 100 000 accomplices, each voting 10 times. For comparison, with electronic voting to commit fraud, you need just one patriotic or corrupt system administrator willing to protect the country from an undesirable candidate. It is not difficult to find such type of person. Electronic voting significantly lowers the barrier for commiting fraud by election administrators.
sylware 2y ago
Nothing will beat the paper with physical verification/monitoring of people from different parties with the details of the end results properly published for everybody to double check. The only way to trust voting machines (which could be rigged before delivery), would be to physically watch which buttons the voters did press, and manually account it... which would violate the core rule of anonymity, that to avoid retaliation.
- cies 2y ago
  A cachier roll, that is locked into the voting machine. The voter selects an option on the machine, each option has a number. Once the voter confirmed it's pick the number is printed on the cashier roll and "rolled" into view for the voter (a small slit window of some transparent material will do). The voter can then see the number was printed. After the voter presses the "done" button, or leaves the booth, the vote is rolled beyond the window so the next voter cannot see what the previous voter voted. The rolls used can be marked uniquely. The voting machine will print an opening and closing pattern so no votes can be added before or after.
- baobabKoodaa 2y ago
  There are various methods to trust voting machines. The simplest example is a machine which immediately prints out a paper trail that the voter verifies.
oakesm9 2y ago
Tom Scott videos which cover why electronic voting is a bad idea: https://youtu.be/w3_0x6oaDmI?si=kGDOYOb_RiiQaZ3u https://youtu.be/w3_0x6oaDmI?si=kGDOYOb_RiiQaZ3u https://youtu.be/LkH2r-sNjQs?si=YdQgNC4uUZDUDbab https://youtu.be/LkH2r-sNjQs?si=YdQgNC4uUZDUDbab
- mariusor 2y ago
  Something being hard does not mean that it should not be tried. There are methods for preventing all the issues Tom Scott raises.
  - sanbor 2y ago
    Voting with pencil and paper is easy, everybody can participate in the voting process and understand it. Also, paper and pencil are more sustainable (can be made from recycled paper and trees, which you can plant, as opposed of mining minerals, shipping, and maintaining thoudsands of computers, with batteries in case there is a power outage).
    - yoavm 2y ago
      everyone _that can make it to the ballot_ can participate. also most people have computers already, so you don't need to ship anything. from a sustainable perspective, I'm assuming it's better to have everyone stay home instead of travel to the nearest ballot, and just use their anyway-always-on device.
      - mariusor 2y ago
        Also "everyone that can be arsed" to make it to the ballot. Which is a notorious problem that democracies are faced with today. Younger demographics don't get involved considering the election process too much of a chore in comparison with the outcomes.
    - _heimdall 2y ago
      Especially with something like voting, it is worth considering those who actually can't use paper and pencil. In college I worked in a research lab building accessible voting systems. We regularly ran test elections with the deaf and blind community. Its both amazing to see how adapted a person can become to living in a world that assumes a certain level of physical ability. Its also amazing to see how horribly inaccessible most voting systems are. With paper ballots, for example, you are usually limited to sitting in a booth with a poll worker and telling them how to fill in your ballot. That does technically work, but breaks voter privacy and you have no way of knowing if they filled it in right because, well, you can't see the ballot.
pjkundert 2y ago
Use homomorphic encryption to allow a voter to create multiple “valid” keys from their root key, and sell those votes to as many people as they want! Provide instructions publicly on exactly how to do so. Then, the voter can vote using their root key, reversing all the sold votes and cast a vote for their preferred candidate. Vote selling problem solved.
- deleted 2y ago
  [deleted]
stoical1 2y ago
Current and past voting systems have always been counterpart to boundaries of land, thus government of that land. Physically showing up at the polling station is symbolic enough for that realisation
breuleux 2y ago
Voting is a deeply flawed decision making process compared to deliberation. If there are too many stakeholders for direct deliberation to scale, it is better to just pick a random sample of them and have them deliberate. You can have the sample vote afterwards to get the final result if they can't come to an agreement, but then you don't need fancy tech to check or tally the votes, you just need a room.
- declan_roberts 2y ago
  Sure as long as I get to pick the sample.
  - AngriestLettuce 2y ago
    Sure, as long as it's a random sample
    - declan_roberts 2y ago
      Absolutely, as long as I get to pick the random number generator that generates the random sample.
      - breuleux 2y ago
        The way it would likely work is that a cryptographically secure open source random algorithm is made known long in advance which takes, say, a full hour to run on top of the line computers. In the hour before it is run, anyone can send in a number of their choosing, which are all added up (or rather their concatenation is cryptographically hashed) to make the seed. Then anyone can check that their number was indeed included and run the algorithm themselves to verify. It really only takes a single honest person to send in a 20-digit number to make it basically impossible to manipulate. Maybe I'm missing something.
      - JanisErdmanis 2y ago
        One way to resolve the issue is to use a distributed randomness generator like DRand which is threshold decryption based and hence can offer some robustness as well.
cqqxo4zV46cp 2y ago
As usual, good old fashioned pen and paper is worlds better than this or any other attempt by overzealous tech people with a hammer looking to hit this particular nail.
- schroeding 2y ago
  Agreed, the classic process also requires no trust into something technical (which, to most people, is equal to magic - hell, even as a CS major it's non-trivial to understand this), but only trusting ten-thousands of your fellow citizens with very different political affiliations, keeping each other in check. Easy to understand, easy to implement, easy to be a part of.
- pessimizer 2y ago
  Good old fashioned pen and paper has tons of problems, and doesn't meet most of the guarantees that these voting systems are going after. Also, good old-fashioned pen and paper, when used, is surrounded by various systems and various equipment in order to: keep it anonymous and to make sure that a voter can't prove their vote to others, prevent false votes from being added and real votes from being thrown away, etc. Which is why you get things like voting booths, indelible ink marks on people's hands, elaborate secured containers for cast votes with elaborate seals, and extensive timed processes around how votes should be handled while being moved or counted, including complicated politically-aware algorithms about the selection of observers and counters, and counter-observers (and even foreign observers.) The rules about spoilage in most paper and pen voting systems are probably more complicated and involved than the core algorithms of any of these voting systems. There's was no golden age of voting when elections were trustworthy. Anonymity is a hard problem.
  - schroeding 2y ago
    > Also, good old-fashioned pen and paper, when used, is surrounded by various systems and various equipment I don't know what the US does, but this is how it works in Germany: Around half-ish of the polling station staff are clerks of the local administration (normal office workers of the city hall, who almost always serve their whole life - they are not re-appointed by the current ruling party), half (or more) are citizens. If not enough citizens sign up voluntarily, random citizens are drafted. The equipment is: A list of all eligible citizens, who can vote (no registration is required), a ballot box with a very flimsy padlock, for which the polling station staff has the key, mobile privacy screens for the voters, pens and the actual ballots. If a citizen wants to vote, they show their national ID (something which the US does not have, I know, but that's not the fault of the paper voting process) and get a ballot. They make their choice behind the privacy screen and put the ballot in the ballot box. After the polling station closes, the ballot box is shaken around a bit and anyone[1] can come to look / supervise the polling station staff as they count the votes. The number of votes must be round about equal to the number of voters. The result if given to the city hall via phone, the ballots get put into the ballot box and can be recounted later, if necessary. City hall puts all results on their website, so the polling stations can verify. If a ballot has more than the allowed number of votes or something written on it, the polling station staff holds a quick vote, majority decides. That's all, the whole process. No ink, no complex seals (the key for the ballot box is in a box with the blank ballots, it's only there to prevent accidental opening of the ballot box), no timed process (except "voting until 18 o'clock"), no politically motivated selection of polling station staff or observers. Would you really say that this is more complicated than electronic voting, including understanding the algorithms? Especially for someone with no CS background. And it works - will you sometimes have one ballot more than voters? Yeah, sure, because someone may forgot to count a voter. But those tiny, human discrepancies IMO don't matter when you have >1000 ballots. The result is correct enough, and based on keeping each other in check, not on technical security measures. Everyone can understand the process, and everyone can be a part of it. It does not meet the correctness guarantees of (perfect, untamperable) electronic voting, but it's IMO a heck of a lot simpler, just as trustworthy at scale and anonymous. [1] literally anyone, even non-citizens, no registration required - we even give them coffee if some is still left :D
catapart 2y ago
Awesome! I hadn't heard of this. Obviously not something that seems reasonable for government implementation, but this seems like it would be great for soliciting a specific kind of feedback about a project or business. Board elections, or product reviews from third party stakeholders, or stuff like that. Truly auditable voting is definitely a tough enough problem that I'd never want to tackle it myself, so I'm glad this is available should I ever find a use for it!
JanisErdmanis 2y ago
Warning: This is going to be a rant. The Belenios voting system is one of the E2E verifiable ones that allows the voter to ensure that their vote is correctly counted without submitting trust to a third party, which is necessary to prevent a corrupt election authority from deceiving and manipulating election results. However, it is also one of the underperforming ones in terms of usability. Like most of the existing E2E verifiable systems, deployability is a logistical nightmare if one wants to safeguard both privacy and resistance against sabotage. In particular, if I understand correctly, individual verifiability is ensured through a challenge where the voter, after casting a vote to the server, has a chance to test the voting client by challenging it with revelling encryption exponent to the server, which then can decrypt the vote and show it on the screen. This one is a bit concerning in itself, as the voting client can decide to manipulate only votes cast for one candidate. Whereas checking and casting the same vote again would reveal the vote to potentially corrupt authority. Imagine explaining to ordinary voters such verifiability guarantees. There are better systems where one can get a tracking number at the end of the vote and check it with all cast votes when they are decrypted (one can look up Selene). Another issue with the system and all existing E2E verifiable voting systems is the deployment of a threshold decryption ceremony. To recap for everyone. Before the elections, the authority manages the creation of a shared public key between multiple parties, which voters use to encrypt their votes during the vote. After the vote, all encrypted votes go through reencryption mixes or are homomorphically tallied and then finally, the votes are threshold decrypted. The challenge here is choosing the redundancy threshold of a number of all parties that need to come together to decrypt the election result. If too few come together, the election result can remain undecrypted, whereas if the hold is set too low, a small minority could collude and see how everyone has voted. Hence, securing both privacy and robustness is an expensive activity. The website offers the service for those who don’t want to deploy the system themselves. The issue is that the voters’ privacy is handed over to the running service. There is no way to verify to what extent the parties used by the organisation are truly independent and would safeguard their vote privacy. My biggest gripe is that theese arguments don’t land well to thoose who are acustomed to mathematical formalism of security definitions and proofs. The E2E verifiability with strong privacy guarantees can also be achieved in expoinentiation mix setting wihtout the need to threshold decryption ceremony [1, 2]. Receipt freeness is still an unresolved challenge here, but I see a path to resolve it with ideas similar to those used in Selene. Whereas if you are concerned about fairness not being distributed between multiple parties, please explain to me an attack vector there that can’t be accounted for! [1]: https://www.usenix.org/legacy/events/evtwote11/tech/final_files/Haenni.pdf https://www.usenix.org/legacy/events/evtwote11/tech/final_fi... [2]: https://eprint.iacr.org/2024/1040 https://eprint.iacr.org/2024/1040
exabrial 2y ago
Personally I love the idea of a fully verifiable election. I do the the current election protocol my county uses is pretty good: you present id in one room, they check your eligibility, then you’re given an anonymous ticket, in another room you vote using said ticket, and get a receipt. You can see your but counted online using said receipt. There are two problems with this: 1. You can’t verify extra or in eligible voters voted. 2. It relies on trust that to tell you your vote was counted. I am very interested in reading about this protocol, and it might make a fun hobby to re implement it as a research project. The one issue I have is: the act of physically showing up is an important one. Mass stuffing of ballot boxes is nearly impossible when physical presence is required. It also puts ‘your ass in the game’, meaning you really care so to speak; as you have to do a minor piece of physical labor in order to get your vote counted. If this protocol could be adapted to the physical world, I think it would be perfect barring any other issues.
- thepra 2y ago
  Please forget about showing up physically, it's noble to think of "you really care" but in places with organized crime they have ways to count if those that depend on them come and vote for their "right" choice. It has been estimated that around 20-30% of IRL votes in Italy follow the organized crimes choice.
  - tossandthrow 2y ago
    You don't think this is even more pronounced if the criminals can keep af gun to your head in your own home when voting? That said - I am yet to see any protocol that is resilient against not showing up IRL (due to the exact reason above).
    - oivey 2y ago
      Criminals showing up to your house, putting a gun to your head, and demanding your vote is a fantasy. You don’t need to defend against it because it’s a totally unscalable way to steal an election.
egberts1 2y ago
The many ways that an electronic ballot machine can lose its integrity: https://x.com/TallJohnSilver/status/1721918130568511822 https://x.com/TallJohnSilver/status/1721918130568511822
- mariusor 2y ago
  Any idea how those apply to the current topic? Just on a quick glance some of the voter fraud methods don't seem to apply: unregistered voter, multiple voting, etc.
nemoniac 2y ago
It's worth noting that it's licensed AGPL so the source code is open and available. Arguably this is necessary for a fully verifiable election system. Or is there some kind of zero knowledge approach to it?
atoav 2y ago
One important thing about any voting system – digital or not – is that it has to be good at producing agreeable consent. That means bitter, betrayed and hurt (but reasonable/democratic!) losing parties need to be able to say: yeah we accept the result because we are confident in the outcome of the election. This is something all digital systems are really bad at, even if everything is readable and verifiable, unless all your members know how to read that code. Edit: and even if they know how to read that code, can they trust the machines are running that code at the big day?
- baobabKoodaa 2y ago
  Disagree. It's enough for the average voter to trust that some other people - independent experts - are able to verify the vote. Not everyone needs to be an expert at anything. I wrote more about this trust aspect in the appendix of my thesis on voting: https://attejuvonen.fi/thesis https://attejuvonen.fi/thesis
  - matheusmoreira 2y ago
    It's not enough. It's not enough at all. Experts are easily compromised. The system by which power is transferred from the people to representatives needs to be literally self-evident. Any system that the "average voter" cannot understand should be literally unconstitutional. Deviating from this puts the results of all elections in doubt. People will question the results, and they will have a point because the system is not actually verifiable and trustworthy to the average person and therefore they have no reason to accept the results. If you're lucky you'll end up with numerous political prisoners at the end of the whole process.
    - baobabKoodaa 2y ago
      Okay, so you will only accept some theoretical, idealistic, perfect voting system, which at this time does not exist. And until one is invented, you want all non-perfect voting systems to be "literally unconstitutional". How do you want government to function until a perfect voting system is invented? Should we just have dictatorship until that time?
efitz 2y ago
Involving computers in vote tallying is an invitation to fraud. In the US right now, our problems are well understood and primarily relate to ensuring that only legally eligible people vote, and that the vote was cast by that actual person. These are fundamentally not technical problems. We have known about them for decades if not centuries and as recently as the early 2000s the Carter-Baker commission laid out the problems and the relatively straightforward solutions. There have always been political “machines” in big cities, and if given the opportunity, they will try to stuff ballot boxes, intimidate voters, harvest ballots, exclude observers, apply voting laws unequally, and do any number of other shenanigans to give their party an advantage. This has reached epic proportions since mail-in ballots for able bodied voters was normalized during COVID. And the problems have all been exacerbated by the unwillingness of the courts to force states to abide by their own voting laws. Election administration is not difficult, it is a straightforward set of tasks that require diligence and integrity, and that benefits greatly from having highly motivated partisan observers at every stage of the process. Technology currently used in voting mostly just introduces more ways to mess up elections either intentionally (via manipulation, by administrators or hackers) or accidentally (as via bugs). The fixes as I said, are simple but inconvenient: 1. Diligently clean voter rolls every year, or even throw them out and restart every year 2. Strongly authenticate voters via in-person registration with trusted nonpartisan agents (government officials) and verify eligibility to vote (citizenship, residency, age, selective service) 3. Vote in person. If intimidation is known to be a problem in a precinct, bring in state police (not local). Note that machine precincts are likely determinable via statistical and electoral analysis, eg where can small swings have big electoral impact). You don’t have to fortify everywhere. 4. Check voter id at the polls. 5. Paper ballots, hand counted on the day of election. 6. Invalidate the count and require revote from any precinct that counts any vote not in the presence of partisan observers from any party on the ballot that asks. Do not allow any vote to be counted after results are reported; the remedy for custody mistakes and “finding uncounted votes” is re-vote. 7. Publicly post precinct level results BEFORE reporting to the county or state. Publicly post county results before reporting to the state. This allows independent channels to confirm that tallies at the county or state level are not tampered with or inadvertently miscomputed. 8. Fast track any election challenge hearings from any eligible voter in an election and do not allow judges to reject cases due to standing, mootness or laches. 9. Absentee ballots should be rare and require proof of need and extraordinary verification with partisan monitoring.
mcny 2y ago
> The account creation failed because the password is too weak (it is too simplistic/systematic). Please try again with a different one. What does it want in a password? Would be nice if it actually listed out the requirements from the get go.
6r17 2y ago
Did anyone think of blockchain for a voting system ? I had a feeling it would be useful in this scenario as anyone could actually check it's own vote and the outcome. However reading comments here I may be delusionnal in regards to the requirements of such technology.
- lesuorac 2y ago
  Typically you want votes to be non-identifiable so you can't show that Person A voted for Candidate 1. This is why your mail in ballots in the US have the double envelope system. The outer envelope identifies the ballot (but not your vote) and if there's only 1 submission then it's likely legit. At that point the inner ballot can be counted along with other legit ballots and it won't be identifiable back to you.
- flanked-evergl 2y ago
  The biggest problem with anything blockchain relating to the real world is the oracle problem. The benefits that blockchain offers are only applicable to things that exist on the blockchain, and people don't exist on the blockchain. https://chain.link/education-hub/oracle-problem https://chain.link/education-hub/oracle-problem
poopsmithe 2y ago
Does this solve Sybil attacks?
smfjaw 2y ago
I wonder why no one has introduced a hybrid of the two, for example, you have a private key on your Gov ID, you turn up to the polling station, sign your paper with your ID, bob's your dads brother. Seems like this would solve the ballot stuffing issues as well as being easily electronically verifiable, it's just not a fully digital solution
- deleted 2y ago
  [deleted]
codedokode 2y ago
This is not about government elections, right? Because it seems to have no protection from creating millions of fake accounts and voting in their name. Another problem with electronic voting is that votes can be bought or people might be pressured to vote specific way. The voter might save hashes/keys as a proof that they voted for a certain candidate and this can be used as a basis for payout or not being punished.
- illiac786 2y ago
  this only solves one problem: make a vote verifiable. It does not solve who is entitled to vote and how to identify this person – how could it? it’s different in every country. I do think it’s very useful though, it’s like one huge chunk of work done.
  - codedokode 2y ago
    > It does not solve who is entitled to vote and how to identify this person Without this the whole system can be easily compromised.
    - illiac786 2y ago
      as I said, it’s one block in the solution. A big one. Also, identifying individuals online is a totally different problem.
andrewstuart 2y ago
Australia, with a first class reputation for election credibility, uses paper ballots.
ktzar 2y ago
a common problem of all systems that include a way for voters to verify their vote is that it opens the possibility of parties buying votes, as you can prove your voted for them.
sputr 2y ago
We did something similar with eglasovanje.si (currently only in Slovenian). Our idea is that secret online elections do not need a technological solution, but a procedural one. We wrote a whole bunch on the topic here (again, use automatic translation) https://eglasovanje.si/vsi-clanki https://eglasovanje.si/vsi-clanki
gloosx 2y ago
Personally I think the biggest flaw in any online voting system is that a network-connected computing device cannot be trusted by any party. Email inbox can not be trusted or verified. Such a simplistic online voting would never stand a chance against malicious actors who are somewhat more sophisticated and creative. The future of paper voting can be something like a quick fingertip-actuated DNA sequencer which will imprint your DNA hash right into the paper ballot, but it will never be an effective system on top of the current network architecture. You have to show up personally to vote. Like can you imagine voting with SMS or something? This is complete non-sense. However I think this tool would work pretty good on a smaller community scale.
- atoav 2y ago
  I think there is a niche for electronic voting for low impact decision making. Used as such it could actually make societies more democratic. Elections that have the potential to shift the power structure of a state are not low impact decisions. Paper ballots being slow and labour intensive is a feature, not a bug for really high stake decisions like who is in charge of a nuclear arsenal for the next years. The more I know about electronics and programming the worse I think the idea of E-voting is for such occasions.
- noodlesUK 2y ago
  In practice, I think that there are a number of fairly high quality voting systems available. A key part of that is maintaining a secret ballot. 1. Widespread voting in person at a number of distributed sites, with paper ballots and either hand counting or machine counting with risk limiting audits. This is pretty technologically trivial to implement, but requires manpower. 2. Widespread postal voting as it's done in places like Oregon, where there's a non-serialised ballot inside a serialised envelope. All voters are sent an envelope and ballot via postal mail, and the return can be done at either a drop box or through the postal system. On election day, all valid envelopes are opened and emptied under the watchful eyes of observers from each party. They are then counted by hand or with machines and risk limiting audits. What should not exist are voting machines. There should always be a paper ballot in the process somewhere that is human readable.
- 2y ago
flanked-evergl 2y ago
I would love to see constitutional amendments in every western country that outlaws all forms of electronic voting.
egberts1 2y ago
Integrity Verifiability Absolute Privacy between the above two Sounds like Time, Money, Resource: only pick two.
gxt 2y ago
There is a contradiction on the first page. If "ballots are signed by the voter credential" then there is no vote privacy. Electronic voting system must be prohibited across the board. Every system is vulnerable, electronic system are all remote controllable, I much prefer to have a person within the jurisdiction to go after than someone outside of it. I don't understand howhy it's ever made out to be more complex than that.
hulitu 2y ago
> Belenios: Verifiable online voting system As long as we trust "certificate authorities", this is pure bulshit.

181 points by leonry 2y ago

9dev 2y ago

Can you even reliably verify the entire voting process? From individuals using digital devices to votes being counted and tallies confirmed?

tromp 2y ago

> Using the web interface, the voter enters her credential and selects her vote. Her computer then computes the ballot, which corresponds to the vote encrypted with the election public key. Like most (or all?) online protocols, this doesn't protect against vote selling or vote coercion.

SamBam 2y ago
I was going to say. AFAIK, no one has worked out a way that you can verify that your own vote was counted, while preventing you from being able to sell your vote.
- rcarback 2y ago
  There are a number of such systems that do this via revoting or dummy ballots. One of my projects, Votexx, uses vote nullification (or flipping) via a trusted third party chosen by the voter. The general idea for all of these is if you add uncertainty you reduce what a coercer is willing to pay creating a mutually assured destruction scenario whereby the system being in place ensures nobody ever tries it. Votexx.org if you want to learn more.
  - JanisErdmanis 2y ago
    The website on VoteXX and associated 4 page preprint does not offer comprehensive overview of the system. What happens to verifiabiloty when the vote is nullified? Does voter sees that the vote is cancelled and hence also coercer/briber?
peterhunt 2y ago
The same could be said of mail in paper ballots too, which have seen widespread adoption in the United States starting in 2020, so I don’t think this should be a knock against this system.
- SamBam 2y ago
  How would you prove that you voted how you said you did? If you took a picture of your ballot, or even if you filmed yourself putting it in the envelope and putting it in the mailbox, there's nothing stopping you from taking it out later, tearing it up, and going to vote differently in person.
  - peterhunt 2y ago
    Just do it in person. The voter fills out the ballot in front of the buyer, seals and signs the envelope, and hands it to the buyer in exchange for cash. The buyer then puts it in the mail on the voter’s behalf. The voter could go to a polling place afterwards and attempt to cast a provisional ballot but my understanding is that this is difficult, varies significantly state to state, and in many cases is not possible given that mail in ballots are detached from the voter identity ahead of Election Day in many states.
    - deleted 2y ago
      [deleted]
    - deleted 2y ago
      [deleted]
  - codedokode 2y ago
    First, this is too much trouble and many won't do this, second, you can lie to people that you have the means to verify their vote, third, you might require a person to write a code word on the ballot so that you can verify that they actually casted that ballot.
- pessimizer 2y ago
  You haven't heard people "knocking" about the widespread adoption of mail in paper ballots? They simply offer no protection against vote coercion which is not a good choice in any election of importance. Pretty sure at least one of the two parties has ending mail-in voting as a long-held position. At the least, this will often result in heads of household voting for their entire families. At the most, it can result in people voting under the supervision of a local gang/militia member. If anyone is looking for the right terminology to find papers, it's "no-receipt" voting. The holy grail is no-receipt, yet verifiable voting, but it might be mathematically impossible.
kylewatson 2y ago
The website says that your vote is last-write-wins. I think the idea is I could sell my vote and vote for A, then later re-vote for B. Since you can't trust that I won't just re-vote it won't be worth paying for. But if you held a gun to my head and made me vote at 18:59, with polls closing at 19:00, then I guess it would work. Hell, if you held a gun to my head and had me vote a week early and then blew my brains out, that would probably also keep me from voting again. So it's not complete, but neither is the current system. You could hold a gun to my loved-ones head and tell me to go vote for B in our current system. I could photograph the ballot from the box, cellphones are small these days. Or if I vote by mail I could easily prove to you I voted for B so you would let the hostage free. So I guess it actually is an improvement over the status quo.
- nmca 2y ago
  hm - do random end times solve that particular issue?
- codedokode 2y ago
  You don't need any guns here. Just call your employees and make them vote on their phone in your presense. Also lie that you have people able to see how they voted. Also give them some money so that they feel themselves as accomplice.
baobabKoodaa 2y ago
There are some voting schemes which protect against vote selling and coercion: https://attejuvonen.fi/thesis https://attejuvonen.fi/thesis

throwaway48476 2y ago

The goal of a voting system is not verifiability, but trust. Without trust elections have no legitimacy.

the_snooze 2y ago
I think these are technically interesting systems, but "trust" really is the goal. "Verifiability" doesn't necessarily imply "trust," especially if it's shrowded behind inscruable crypto mumbo-jumbo. A voting system should be something voters and poll workers (i.e., local volunteers) can understand.
- throwaway48476 2y ago
  A better heuristic is 'can you explain the system to a five year old'.
- ratorx 2y ago
  Ideally you want both. “Trust” is a bit qualitative and includes a lot of factors outside the voting system itself. Just because a voting system is “simple” doesn’t mean people trust it (e.g. Trump voting shenanigans). Obviously just because there are bad actors which can make trust impossible, doesn’t mean you should give up but it is a separate axis to the voting system itself. On the other hand, “verifiability” is a more useful property on a larger scale. You may trust your local government but do you trust local government in all other districts? What if, with sufficient knowledge you could prove that their voting was right or wrong? I think that also seems like a useful property.
- rayiner 2y ago
  Correct. The system must be something a bottom 15 percentile person can understand and doesn’t think is magic. https://youtu.be/DUZa7qIGAdo?si=RDsgH2uIKb8k7ueG https://youtu.be/DUZa7qIGAdo?si=RDsgH2uIKb8k7ueG
  - mightyham 2y ago
    Or universal suffrage is fundamentally flawed. If people can't understand mildly complex voting systems then why should they be contributing to making political decisions that are significantly more complex.

trte9343r4 2y ago

In reality private keys will be mailed in insecure envelopes, issued multiple times (just to be sure) or issued to people, who are not citizens, moved away or died.

inhumantsar 2y ago
I don't disagree, the identity matching and uniqueness problem is a tough nut to crack. it's worth keeping in mind though that this is an issue the current system faces. voters end up duplicated in the rolls under different addresses or old names, or they don't get removed from the rolls after losing eligibility or dying. once upon a time I got two voter cards in the mail, one forwarded from an old address. I was eligible in two districts after nothing more extraordinary than moving across town. had to call in to get removed from the extra district.
mariusor 2y ago
I think this will be prevented when these private keys will be part of the national IDs, similar to how Estonia and other European countries do it. If there's a "national registry of citizens" comprised of public keys, I think it will be easy to organize ballots on top of that.
- codedokode 2y ago
  The government can issue fake IDs and vote in their name. Especially in countries where there are many migrants who receive citizenship, you can easily issue some extra IDs and nobody notices.
  - JanisErdmanis 2y ago
    This attack vector is no different with paper ballots.
    - codedokode 2y ago
      With paper voting you need both fake IDs and people. You need to recruit people ready to commit a crime, and transport them between polling stations. If you want to add million fake votes, you need somewhere about 100 000 accomplices, each voting 10 times. For comparison, with electronic voting to commit fraud, you need just one patriotic or corrupt system administrator willing to protect the country from an undesirable candidate. It is not difficult to find such type of person. Electronic voting significantly lowers the barrier for commiting fraud by election administrators.

sylware 2y ago

Nothing will beat the paper with physical verification/monitoring of people from different parties with the details of the end results properly published for everybody to double check. The only way to trust voting machines (which could be rigged before delivery), would be to physically watch which buttons the voters did press, and manually account it... which would violate the core rule of anonymity, that to avoid retaliation.

cies 2y ago
A cachier roll, that is locked into the voting machine. The voter selects an option on the machine, each option has a number. Once the voter confirmed it's pick the number is printed on the cashier roll and "rolled" into view for the voter (a small slit window of some transparent material will do). The voter can then see the number was printed. After the voter presses the "done" button, or leaves the booth, the vote is rolled beyond the window so the next voter cannot see what the previous voter voted. The rolls used can be marked uniquely. The voting machine will print an opening and closing pattern so no votes can be added before or after.
baobabKoodaa 2y ago
There are various methods to trust voting machines. The simplest example is a machine which immediately prints out a paper trail that the voter verifies.

oakesm9 2y ago

Tom Scott videos which cover why electronic voting is a bad idea: https://youtu.be/w3_0x6oaDmI?si=kGDOYOb_RiiQaZ3u https://youtu.be/w3_0x6oaDmI?si=kGDOYOb_RiiQaZ3u https://youtu.be/LkH2r-sNjQs?si=YdQgNC4uUZDUDbab https://youtu.be/LkH2r-sNjQs?si=YdQgNC4uUZDUDbab

mariusor 2y ago
Something being hard does not mean that it should not be tried. There are methods for preventing all the issues Tom Scott raises.
- sanbor 2y ago
  Voting with pencil and paper is easy, everybody can participate in the voting process and understand it. Also, paper and pencil are more sustainable (can be made from recycled paper and trees, which you can plant, as opposed of mining minerals, shipping, and maintaining thoudsands of computers, with batteries in case there is a power outage).
  - yoavm 2y ago
    everyone _that can make it to the ballot_ can participate. also most people have computers already, so you don't need to ship anything. from a sustainable perspective, I'm assuming it's better to have everyone stay home instead of travel to the nearest ballot, and just use their anyway-always-on device.
    - mariusor 2y ago
      Also "everyone that can be arsed" to make it to the ballot. Which is a notorious problem that democracies are faced with today. Younger demographics don't get involved considering the election process too much of a chore in comparison with the outcomes.
  - _heimdall 2y ago
    Especially with something like voting, it is worth considering those who actually can't use paper and pencil. In college I worked in a research lab building accessible voting systems. We regularly ran test elections with the deaf and blind community. Its both amazing to see how adapted a person can become to living in a world that assumes a certain level of physical ability. Its also amazing to see how horribly inaccessible most voting systems are. With paper ballots, for example, you are usually limited to sitting in a booth with a poll worker and telling them how to fill in your ballot. That does technically work, but breaks voter privacy and you have no way of knowing if they filled it in right because, well, you can't see the ballot.

pjkundert 2y ago

Use homomorphic encryption to allow a voter to create multiple “valid” keys from their root key, and sell those votes to as many people as they want! Provide instructions publicly on exactly how to do so. Then, the voter can vote using their root key, reversing all the sold votes and cast a vote for their preferred candidate. Vote selling problem solved.

deleted 2y ago
[deleted]

stoical1 2y ago

Current and past voting systems have always been counterpart to boundaries of land, thus government of that land. Physically showing up at the polling station is symbolic enough for that realisation

breuleux 2y ago

Voting is a deeply flawed decision making process compared to deliberation. If there are too many stakeholders for direct deliberation to scale, it is better to just pick a random sample of them and have them deliberate. You can have the sample vote afterwards to get the final result if they can't come to an agreement, but then you don't need fancy tech to check or tally the votes, you just need a room.

declan_roberts 2y ago
Sure as long as I get to pick the sample.
- AngriestLettuce 2y ago
  Sure, as long as it's a random sample
  - declan_roberts 2y ago
    Absolutely, as long as I get to pick the random number generator that generates the random sample.
    - breuleux 2y ago
      The way it would likely work is that a cryptographically secure open source random algorithm is made known long in advance which takes, say, a full hour to run on top of the line computers. In the hour before it is run, anyone can send in a number of their choosing, which are all added up (or rather their concatenation is cryptographically hashed) to make the seed. Then anyone can check that their number was indeed included and run the algorithm themselves to verify. It really only takes a single honest person to send in a 20-digit number to make it basically impossible to manipulate. Maybe I'm missing something.
    - JanisErdmanis 2y ago
      One way to resolve the issue is to use a distributed randomness generator like DRand which is threshold decryption based and hence can offer some robustness as well.

cqqxo4zV46cp 2y ago

As usual, good old fashioned pen and paper is worlds better than this or any other attempt by overzealous tech people with a hammer looking to hit this particular nail.

schroeding 2y ago
Agreed, the classic process also requires no trust into something technical (which, to most people, is equal to magic - hell, even as a CS major it's non-trivial to understand this), but only trusting ten-thousands of your fellow citizens with very different political affiliations, keeping each other in check. Easy to understand, easy to implement, easy to be a part of.
pessimizer 2y ago
Good old fashioned pen and paper has tons of problems, and doesn't meet most of the guarantees that these voting systems are going after. Also, good old-fashioned pen and paper, when used, is surrounded by various systems and various equipment in order to: keep it anonymous and to make sure that a voter can't prove their vote to others, prevent false votes from being added and real votes from being thrown away, etc. Which is why you get things like voting booths, indelible ink marks on people's hands, elaborate secured containers for cast votes with elaborate seals, and extensive timed processes around how votes should be handled while being moved or counted, including complicated politically-aware algorithms about the selection of observers and counters, and counter-observers (and even foreign observers.) The rules about spoilage in most paper and pen voting systems are probably more complicated and involved than the core algorithms of any of these voting systems. There's was no golden age of voting when elections were trustworthy. Anonymity is a hard problem.
- schroeding 2y ago
  > Also, good old-fashioned pen and paper, when used, is surrounded by various systems and various equipment I don't know what the US does, but this is how it works in Germany: Around half-ish of the polling station staff are clerks of the local administration (normal office workers of the city hall, who almost always serve their whole life - they are not re-appointed by the current ruling party), half (or more) are citizens. If not enough citizens sign up voluntarily, random citizens are drafted. The equipment is: A list of all eligible citizens, who can vote (no registration is required), a ballot box with a very flimsy padlock, for which the polling station staff has the key, mobile privacy screens for the voters, pens and the actual ballots. If a citizen wants to vote, they show their national ID (something which the US does not have, I know, but that's not the fault of the paper voting process) and get a ballot. They make their choice behind the privacy screen and put the ballot in the ballot box. After the polling station closes, the ballot box is shaken around a bit and anyone[1] can come to look / supervise the polling station staff as they count the votes. The number of votes must be round about equal to the number of voters. The result if given to the city hall via phone, the ballots get put into the ballot box and can be recounted later, if necessary. City hall puts all results on their website, so the polling stations can verify. If a ballot has more than the allowed number of votes or something written on it, the polling station staff holds a quick vote, majority decides. That's all, the whole process. No ink, no complex seals (the key for the ballot box is in a box with the blank ballots, it's only there to prevent accidental opening of the ballot box), no timed process (except "voting until 18 o'clock"), no politically motivated selection of polling station staff or observers. Would you really say that this is more complicated than electronic voting, including understanding the algorithms? Especially for someone with no CS background. And it works - will you sometimes have one ballot more than voters? Yeah, sure, because someone may forgot to count a voter. But those tiny, human discrepancies IMO don't matter when you have >1000 ballots. The result is correct enough, and based on keeping each other in check, not on technical security measures. Everyone can understand the process, and everyone can be a part of it. It does not meet the correctness guarantees of (perfect, untamperable) electronic voting, but it's IMO a heck of a lot simpler, just as trustworthy at scale and anonymous. [1] literally anyone, even non-citizens, no registration required - we even give them coffee if some is still left :D

catapart 2y ago

Awesome! I hadn't heard of this. Obviously not something that seems reasonable for government implementation, but this seems like it would be great for soliciting a specific kind of feedback about a project or business. Board elections, or product reviews from third party stakeholders, or stuff like that. Truly auditable voting is definitely a tough enough problem that I'd never want to tackle it myself, so I'm glad this is available should I ever find a use for it!

JanisErdmanis 2y ago

Warning: This is going to be a rant. The Belenios voting system is one of the E2E verifiable ones that allows the voter to ensure that their vote is correctly counted without submitting trust to a third party, which is necessary to prevent a corrupt election authority from deceiving and manipulating election results. However, it is also one of the underperforming ones in terms of usability. Like most of the existing E2E verifiable systems, deployability is a logistical nightmare if one wants to safeguard both privacy and resistance against sabotage. In particular, if I understand correctly, individual verifiability is ensured through a challenge where the voter, after casting a vote to the server, has a chance to test the voting client by challenging it with revelling encryption exponent to the server, which then can decrypt the vote and show it on the screen. This one is a bit concerning in itself, as the voting client can decide to manipulate only votes cast for one candidate. Whereas checking and casting the same vote again would reveal the vote to potentially corrupt authority. Imagine explaining to ordinary voters such verifiability guarantees. There are better systems where one can get a tracking number at the end of the vote and check it with all cast votes when they are decrypted (one can look up Selene). Another issue with the system and all existing E2E verifiable voting systems is the deployment of a threshold decryption ceremony. To recap for everyone. Before the elections, the authority manages the creation of a shared public key between multiple parties, which voters use to encrypt their votes during the vote. After the vote, all encrypted votes go through reencryption mixes or are homomorphically tallied and then finally, the votes are threshold decrypted. The challenge here is choosing the redundancy threshold of a number of all parties that need to come together to decrypt the election result. If too few come together, the election result can remain undecrypted, whereas if the hold is set too low, a small minority could collude and see how everyone has voted. Hence, securing both privacy and robustness is an expensive activity. The website offers the service for those who don’t want to deploy the system themselves. The issue is that the voters’ privacy is handed over to the running service. There is no way to verify to what extent the parties used by the organisation are truly independent and would safeguard their vote privacy. My biggest gripe is that theese arguments don’t land well to thoose who are acustomed to mathematical formalism of security definitions and proofs. The E2E verifiability with strong privacy guarantees can also be achieved in expoinentiation mix setting wihtout the need to threshold decryption ceremony [1, 2]. Receipt freeness is still an unresolved challenge here, but I see a path to resolve it with ideas similar to those used in Selene. Whereas if you are concerned about fairness not being distributed between multiple parties, please explain to me an attack vector there that can’t be accounted for! [1]: https://www.usenix.org/legacy/events/evtwote11/tech/final_files/Haenni.pdf https://www.usenix.org/legacy/events/evtwote11/tech/final_fi... [2]: https://eprint.iacr.org/2024/1040 https://eprint.iacr.org/2024/1040

exabrial 2y ago

Personally I love the idea of a fully verifiable election. I do the the current election protocol my county uses is pretty good: you present id in one room, they check your eligibility, then you’re given an anonymous ticket, in another room you vote using said ticket, and get a receipt. You can see your but counted online using said receipt. There are two problems with this: 1. You can’t verify extra or in eligible voters voted. 2. It relies on trust that to tell you your vote was counted. I am very interested in reading about this protocol, and it might make a fun hobby to re implement it as a research project. The one issue I have is: the act of physically showing up is an important one. Mass stuffing of ballot boxes is nearly impossible when physical presence is required. It also puts ‘your ass in the game’, meaning you really care so to speak; as you have to do a minor piece of physical labor in order to get your vote counted. If this protocol could be adapted to the physical world, I think it would be perfect barring any other issues.

thepra 2y ago
Please forget about showing up physically, it's noble to think of "you really care" but in places with organized crime they have ways to count if those that depend on them come and vote for their "right" choice. It has been estimated that around 20-30% of IRL votes in Italy follow the organized crimes choice.
- tossandthrow 2y ago
  You don't think this is even more pronounced if the criminals can keep af gun to your head in your own home when voting? That said - I am yet to see any protocol that is resilient against not showing up IRL (due to the exact reason above).
  - oivey 2y ago
    Criminals showing up to your house, putting a gun to your head, and demanding your vote is a fantasy. You don’t need to defend against it because it’s a totally unscalable way to steal an election.

egberts1 2y ago

The many ways that an electronic ballot machine can lose its integrity: https://x.com/TallJohnSilver/status/1721918130568511822 https://x.com/TallJohnSilver/status/1721918130568511822

mariusor 2y ago
Any idea how those apply to the current topic? Just on a quick glance some of the voter fraud methods don't seem to apply: unregistered voter, multiple voting, etc.

nemoniac 2y ago

It's worth noting that it's licensed AGPL so the source code is open and available. Arguably this is necessary for a fully verifiable election system. Or is there some kind of zero knowledge approach to it?

atoav 2y ago

One important thing about any voting system – digital or not – is that it has to be good at producing agreeable consent. That means bitter, betrayed and hurt (but reasonable/democratic!) losing parties need to be able to say: yeah we accept the result because we are confident in the outcome of the election. This is something all digital systems are really bad at, even if everything is readable and verifiable, unless all your members know how to read that code. Edit: and even if they know how to read that code, can they trust the machines are running that code at the big day?

baobabKoodaa 2y ago
Disagree. It's enough for the average voter to trust that some other people - independent experts - are able to verify the vote. Not everyone needs to be an expert at anything. I wrote more about this trust aspect in the appendix of my thesis on voting: https://attejuvonen.fi/thesis https://attejuvonen.fi/thesis
- matheusmoreira 2y ago
  It's not enough. It's not enough at all. Experts are easily compromised. The system by which power is transferred from the people to representatives needs to be literally self-evident. Any system that the "average voter" cannot understand should be literally unconstitutional. Deviating from this puts the results of all elections in doubt. People will question the results, and they will have a point because the system is not actually verifiable and trustworthy to the average person and therefore they have no reason to accept the results. If you're lucky you'll end up with numerous political prisoners at the end of the whole process.
  - baobabKoodaa 2y ago
    Okay, so you will only accept some theoretical, idealistic, perfect voting system, which at this time does not exist. And until one is invented, you want all non-perfect voting systems to be "literally unconstitutional". How do you want government to function until a perfect voting system is invented? Should we just have dictatorship until that time?

efitz 2y ago

Involving computers in vote tallying is an invitation to fraud. In the US right now, our problems are well understood and primarily relate to ensuring that only legally eligible people vote, and that the vote was cast by that actual person. These are fundamentally not technical problems. We have known about them for decades if not centuries and as recently as the early 2000s the Carter-Baker commission laid out the problems and the relatively straightforward solutions. There have always been political “machines” in big cities, and if given the opportunity, they will try to stuff ballot boxes, intimidate voters, harvest ballots, exclude observers, apply voting laws unequally, and do any number of other shenanigans to give their party an advantage. This has reached epic proportions since mail-in ballots for able bodied voters was normalized during COVID. And the problems have all been exacerbated by the unwillingness of the courts to force states to abide by their own voting laws. Election administration is not difficult, it is a straightforward set of tasks that require diligence and integrity, and that benefits greatly from having highly motivated partisan observers at every stage of the process. Technology currently used in voting mostly just introduces more ways to mess up elections either intentionally (via manipulation, by administrators or hackers) or accidentally (as via bugs). The fixes as I said, are simple but inconvenient: 1. Diligently clean voter rolls every year, or even throw them out and restart every year 2. Strongly authenticate voters via in-person registration with trusted nonpartisan agents (government officials) and verify eligibility to vote (citizenship, residency, age, selective service) 3. Vote in person. If intimidation is known to be a problem in a precinct, bring in state police (not local). Note that machine precincts are likely determinable via statistical and electoral analysis, eg where can small swings have big electoral impact). You don’t have to fortify everywhere. 4. Check voter id at the polls. 5. Paper ballots, hand counted on the day of election. 6. Invalidate the count and require revote from any precinct that counts any vote not in the presence of partisan observers from any party on the ballot that asks. Do not allow any vote to be counted after results are reported; the remedy for custody mistakes and “finding uncounted votes” is re-vote. 7. Publicly post precinct level results BEFORE reporting to the county or state. Publicly post county results before reporting to the state. This allows independent channels to confirm that tallies at the county or state level are not tampered with or inadvertently miscomputed. 8. Fast track any election challenge hearings from any eligible voter in an election and do not allow judges to reject cases due to standing, mootness or laches. 9. Absentee ballots should be rare and require proof of need and extraordinary verification with partisan monitoring.

mcny 2y ago

> The account creation failed because the password is too weak (it is too simplistic/systematic). Please try again with a different one. What does it want in a password? Would be nice if it actually listed out the requirements from the get go.

6r17 2y ago

Did anyone think of blockchain for a voting system ? I had a feeling it would be useful in this scenario as anyone could actually check it's own vote and the outcome. However reading comments here I may be delusionnal in regards to the requirements of such technology.

lesuorac 2y ago
Typically you want votes to be non-identifiable so you can't show that Person A voted for Candidate 1. This is why your mail in ballots in the US have the double envelope system. The outer envelope identifies the ballot (but not your vote) and if there's only 1 submission then it's likely legit. At that point the inner ballot can be counted along with other legit ballots and it won't be identifiable back to you.
flanked-evergl 2y ago
The biggest problem with anything blockchain relating to the real world is the oracle problem. The benefits that blockchain offers are only applicable to things that exist on the blockchain, and people don't exist on the blockchain. https://chain.link/education-hub/oracle-problem https://chain.link/education-hub/oracle-problem

poopsmithe 2y ago

Does this solve Sybil attacks?

smfjaw 2y ago

I wonder why no one has introduced a hybrid of the two, for example, you have a private key on your Gov ID, you turn up to the polling station, sign your paper with your ID, bob's your dads brother. Seems like this would solve the ballot stuffing issues as well as being easily electronically verifiable, it's just not a fully digital solution

deleted 2y ago
[deleted]

codedokode 2y ago

This is not about government elections, right? Because it seems to have no protection from creating millions of fake accounts and voting in their name. Another problem with electronic voting is that votes can be bought or people might be pressured to vote specific way. The voter might save hashes/keys as a proof that they voted for a certain candidate and this can be used as a basis for payout or not being punished.

illiac786 2y ago
this only solves one problem: make a vote verifiable. It does not solve who is entitled to vote and how to identify this person – how could it? it’s different in every country. I do think it’s very useful though, it’s like one huge chunk of work done.
- codedokode 2y ago
  > It does not solve who is entitled to vote and how to identify this person Without this the whole system can be easily compromised.
  - illiac786 2y ago
    as I said, it’s one block in the solution. A big one. Also, identifying individuals online is a totally different problem.

andrewstuart 2y ago

Australia, with a first class reputation for election credibility, uses paper ballots.

ktzar 2y ago

a common problem of all systems that include a way for voters to verify their vote is that it opens the possibility of parties buying votes, as you can prove your voted for them.

sputr 2y ago

We did something similar with eglasovanje.si (currently only in Slovenian). Our idea is that secret online elections do not need a technological solution, but a procedural one. We wrote a whole bunch on the topic here (again, use automatic translation) https://eglasovanje.si/vsi-clanki https://eglasovanje.si/vsi-clanki

gloosx 2y ago

Personally I think the biggest flaw in any online voting system is that a network-connected computing device cannot be trusted by any party. Email inbox can not be trusted or verified. Such a simplistic online voting would never stand a chance against malicious actors who are somewhat more sophisticated and creative. The future of paper voting can be something like a quick fingertip-actuated DNA sequencer which will imprint your DNA hash right into the paper ballot, but it will never be an effective system on top of the current network architecture. You have to show up personally to vote. Like can you imagine voting with SMS or something? This is complete non-sense. However I think this tool would work pretty good on a smaller community scale.

atoav 2y ago
I think there is a niche for electronic voting for low impact decision making. Used as such it could actually make societies more democratic. Elections that have the potential to shift the power structure of a state are not low impact decisions. Paper ballots being slow and labour intensive is a feature, not a bug for really high stake decisions like who is in charge of a nuclear arsenal for the next years. The more I know about electronics and programming the worse I think the idea of E-voting is for such occasions.
noodlesUK 2y ago
In practice, I think that there are a number of fairly high quality voting systems available. A key part of that is maintaining a secret ballot. 1. Widespread voting in person at a number of distributed sites, with paper ballots and either hand counting or machine counting with risk limiting audits. This is pretty technologically trivial to implement, but requires manpower. 2. Widespread postal voting as it's done in places like Oregon, where there's a non-serialised ballot inside a serialised envelope. All voters are sent an envelope and ballot via postal mail, and the return can be done at either a drop box or through the postal system. On election day, all valid envelopes are opened and emptied under the watchful eyes of observers from each party. They are then counted by hand or with machines and risk limiting audits. What should not exist are voting machines. There should always be a paper ballot in the process somewhere that is human readable.
2y ago

flanked-evergl 2y ago

I would love to see constitutional amendments in every western country that outlaws all forms of electronic voting.

egberts1 2y ago

Integrity Verifiability Absolute Privacy between the above two Sounds like Time, Money, Resource: only pick two.

gxt 2y ago

There is a contradiction on the first page. If "ballots are signed by the voter credential" then there is no vote privacy. Electronic voting system must be prohibited across the board. Every system is vulnerable, electronic system are all remote controllable, I much prefer to have a person within the jurisdiction to go after than someone outside of it. I don't understand howhy it's ever made out to be more complex than that.

hulitu 2y ago

> Belenios: Verifiable online voting system As long as we trust "certificate authorities", this is pure bulshit.