4 ms·

Don't trust computers for voting. Bits are easy to tamper with, specially when the populace doesn't know shit about computers (and rightfully so). You can envi

by kaoD 14y ago

Don't trust computers for voting. Bits are easy to tamper with, specially when the populace doesn't know shit about computers (and rightfully so). You can envision a system as complicated as you want, but it'll always have some sort of flaw because, well, bits are bits. I've had this discussion with many people and the same solutions arise again and again... but most are useless. You could get the source code for the voting program... what if your compiler is backdoored? You could compile the compiler yourself, with which compiler? The backdoored one? And even if the compiler is trustworthy... who's guaranteeing that the real binary is installed in the machine? You could download it in an USB drive and check yourself or get a hash from the machine but... how can you be sure the machine is reporting the binary that's actually running and not just a fake reply? Could you trust the reported MD5/downloaded binary from the machine? Easy! - you say - You could upload the binary yourself to the machine! But how would you be sure you're running the uploaded binary and not a fake one? And what if any of the machines inbetween are rigged? Then cryptoguys come in: you could digitally sign your vote (forget secrecy) with a state-issued certificate (we have those in Spain with our NID). Maybe encrypt it so that only the far end could read it. You'd then check if your vote's been cast fine online. But how'd you be sure you got the real result? Once the data left the machine you have to trust that everything's fine on the receiving end. What if the vote count just ignores votes and just does whatever it wants? And the worst of all... how's your granny supposed to check it herself? There are some advanced cryptographic techniques relevant to e-vote (some are quite clever) but even the best cryptographers will tell you: do not trust electronic voting! My advice is: keep with pen and paper! It's easy to tamper with too, but more people know how it works and it's easy to see the inner workings compared to bits over the wire.

eli 14y ago
Mostly agree, but paper ballots are expensive to administer and count and we currently don't like to spend very much on our elections. Also, you still need a system for the disabled that ideally also preserves secrecy - not everyone can hold a pen.
- kaoD 14y ago
  I prefer trusted to cheap (and I certainly hope everyone else does). Of course the government prefers cheap, but it probably prefers tamperable too :P Good call about the disabled. What are the current systems doing for them?
  - eli 14y ago
    Secure, anonymous voting for the disabled is a big reason we have so many electronic voting machines. It was a big part of the Help America Votes Act. There are many vendors with solutions. The AutoMark is a popular one -- it can enlarge type or even read you the choices and let you make a selection by blowing in a tube. There are many systems for the disabled -- it was a big priority of the Help America Votes Act, which is what prompted this wave of computerized voting machines. The Auto
- Tobu 14y ago
  Coming from a country with sane election practices, paper ballots don't cost anything but volunteer time to operate and there is no barrier to participating. On accessibility, we have printed papers each with a name on them that we secretly stuff inside an envelope. A blind person who didn't get Braille papers or prepare their envelope on their own can ask the officials (multiple volunteers from a plurality of parties) to read the papers for them so that they can remember the order.
- jbooth 14y ago
  And the contracts for these machines are what, cheap? I've be interested to see a source for the contention that paper's actually more expensive -- not saying you're wrong, but I'd have guessed paper is cheaper with all of the volunteer labor involved.
Strilanc 14y ago
Verifying that the right binary was uploaded is solving the wrong problem. Who cares what the source code claims to do? We care about what it actually does. Real cryptographic voting systems use verifiable protocols. You don't trust the machine, you force it to follow a protocol that involves proving its actions are correct at every step. You can verify basically everything except destruction of information (i.e. there's no way to prove with cryptography that a video camera didn't record the voter). Video with an example of a verifiable voting protocol: http://www.youtube.com/watch?v=ZDnShu5V99s http://www.youtube.com/watch?v=ZDnShu5V99s
- kaoD 14y ago
  Yeah, it was just a tour over the most common flawed arguments in favor of e-vote. I just got tired and stopped somewhere (you can see I got a bit into secure protocols instead of secure programs). Last time I checked the protocols had several drawbacks (including the "destruction" problem, vulnerable to collusion, etc.) Maybe I missed good protocols? Could you please point me to good papers? (a video is too slow and hard to skim over). Thanks! I'll check the video ASAP and report back if I have questions!
  - Strilanc 14y ago
    I don't know enough to point you at good protocols. The video covers basically all I know, and it's five years old. I mainly commented to remind people that computer voting systems don't have to be glorified counters. You can actually use their strengths (crypto), instead of only inheriting their weaknesses (malleability).
- rejschaap 14y ago
  You are right that it is not about the software. I think you are wrong thinking that it is about the protocol. It probably should be about the data. The data should be openly available to everyone. But there are some requirements to the data that make this tricky (understatement). With the data in your hand it should be possible to independently verify the results. It should be possible to individually verify that your vote is somehow in there. But it should NOT be possible to link votes to individuals, it should be completely anonymous. This is not a problem that is likely to be solved by software engineers. If there is a solution, it is in crypto and math more than software. I do think this is an important problem to solve. It would enable the ultimate democratization. Instead of voting for representatives it would become feasible to directly vote on issues by referendum. If tech is about anything, it's about democratization and cutting out the middle man.
stagas 14y ago
Maybe with some bitcoin technology with a voting blockchain where it protects double voting and each one can verify their own vote integrity but still remain anonymous to everyone else.
pbz 14y ago
I would take the approach of broadcasting the vote to several monitors. When you place a vote you get a confirmation number. That vote is then uploaded to N third parties that later verify that they all got the same votes. Then the voter could go online, type in this special ID and verification code and see that indeed his vote was counted as voted. This doesn't mean that you couldn't or shouldn't have a paper trail as well. As long as you have a single end-point, then yes, the issues you brought up are valid.
jbooth 14y ago
The great thing about this comment is our security measures stop like 2 or 3 levels before even reaching the point you're describing as insecure. Like the people involved even know what an MD5 is?
pandaman 14y ago
Cryptography for vote is super easy : each voter submits a secret prime number with the ballot and then the product of all such numbers is published together with the vote. It's as secret as factorization and everybody can check if their vote has been counted.
- njharman 14y ago
  Does this stop multiple votes by same person? Votes by imaginary people? Does this stop keeping your secret prime number but discarding or changing your vote? Super easy, you should go shopping.
  - pandaman 14y ago
    No, it also does not cure cancer and does not ensure the world peace. It only ensures that one can prove they voted and makes re-counting possible if needed.
    - ReidZB 14y ago
      Well, the grandparent's comment isn't asking if your scheme cures cancer and ensures world peace. Instead they're asking if your scheme is at least as secure as other current cryptographic voting protocols out there, the answer to which is "no." If this problem were so trivial, then I think some of the big names in crypto would not have wasted their time on studying solutions. As it is, though, I don't think there are any convincing arguments for why this problem is "trivial." Instead, there's a laundry list of properties you want a good voting protocol to have, and developing a cryptographically secure protocol that satisfies those properties is highly nontrivial.
      - pandaman 14y ago
        This scheme is more secure than paper ballots, which are advocated as better than the current cryptographic protocols, whichever they are. Better in a sense that every property of paper ballots can be also applied to the prime multiplication plus it allows verification that you cannot have with the paper ballots. My opponent did not question particular properties of this scheme but instead went on the tangent of properties, which none of voting methods currently has. Hence, she or he could as well request cancer cure.

by kaoD 14y ago

eli 14y ago

Mostly agree, but paper ballots are expensive to administer and count and we currently don't like to spend very much on our elections. Also, you still need a system for the disabled that ideally also preserves secrecy - not everyone can hold a pen.

kaoD 14y ago
I prefer trusted to cheap (and I certainly hope everyone else does). Of course the government prefers cheap, but it probably prefers tamperable too :P Good call about the disabled. What are the current systems doing for them?
- eli 14y ago
  Secure, anonymous voting for the disabled is a big reason we have so many electronic voting machines. It was a big part of the Help America Votes Act. There are many vendors with solutions. The AutoMark is a popular one -- it can enlarge type or even read you the choices and let you make a selection by blowing in a tube. There are many systems for the disabled -- it was a big priority of the Help America Votes Act, which is what prompted this wave of computerized voting machines. The Auto
Tobu 14y ago
Coming from a country with sane election practices, paper ballots don't cost anything but volunteer time to operate and there is no barrier to participating. On accessibility, we have printed papers each with a name on them that we secretly stuff inside an envelope. A blind person who didn't get Braille papers or prepare their envelope on their own can ask the officials (multiple volunteers from a plurality of parties) to read the papers for them so that they can remember the order.
jbooth 14y ago
And the contracts for these machines are what, cheap? I've be interested to see a source for the contention that paper's actually more expensive -- not saying you're wrong, but I'd have guessed paper is cheaper with all of the volunteer labor involved.

Strilanc 14y ago

Verifying that the right binary was uploaded is solving the wrong problem. Who cares what the source code claims to do? We care about what it actually does. Real cryptographic voting systems use verifiable protocols. You don't trust the machine, you force it to follow a protocol that involves proving its actions are correct at every step. You can verify basically everything except destruction of information (i.e. there's no way to prove with cryptography that a video camera didn't record the voter). Video with an example of a verifiable voting protocol: http://www.youtube.com/watch?v=ZDnShu5V99s http://www.youtube.com/watch?v=ZDnShu5V99s

kaoD 14y ago
Yeah, it was just a tour over the most common flawed arguments in favor of e-vote. I just got tired and stopped somewhere (you can see I got a bit into secure protocols instead of secure programs). Last time I checked the protocols had several drawbacks (including the "destruction" problem, vulnerable to collusion, etc.) Maybe I missed good protocols? Could you please point me to good papers? (a video is too slow and hard to skim over). Thanks! I'll check the video ASAP and report back if I have questions!
- Strilanc 14y ago
  I don't know enough to point you at good protocols. The video covers basically all I know, and it's five years old. I mainly commented to remind people that computer voting systems don't have to be glorified counters. You can actually use their strengths (crypto), instead of only inheriting their weaknesses (malleability).
rejschaap 14y ago
You are right that it is not about the software. I think you are wrong thinking that it is about the protocol. It probably should be about the data. The data should be openly available to everyone. But there are some requirements to the data that make this tricky (understatement). With the data in your hand it should be possible to independently verify the results. It should be possible to individually verify that your vote is somehow in there. But it should NOT be possible to link votes to individuals, it should be completely anonymous. This is not a problem that is likely to be solved by software engineers. If there is a solution, it is in crypto and math more than software. I do think this is an important problem to solve. It would enable the ultimate democratization. Instead of voting for representatives it would become feasible to directly vote on issues by referendum. If tech is about anything, it's about democratization and cutting out the middle man.

stagas 14y ago

Maybe with some bitcoin technology with a voting blockchain where it protects double voting and each one can verify their own vote integrity but still remain anonymous to everyone else.

pbz 14y ago

I would take the approach of broadcasting the vote to several monitors. When you place a vote you get a confirmation number. That vote is then uploaded to N third parties that later verify that they all got the same votes. Then the voter could go online, type in this special ID and verification code and see that indeed his vote was counted as voted. This doesn't mean that you couldn't or shouldn't have a paper trail as well. As long as you have a single end-point, then yes, the issues you brought up are valid.

jbooth 14y ago

The great thing about this comment is our security measures stop like 2 or 3 levels before even reaching the point you're describing as insecure. Like the people involved even know what an MD5 is?

pandaman 14y ago

Cryptography for vote is super easy : each voter submits a secret prime number with the ballot and then the product of all such numbers is published together with the vote. It's as secret as factorization and everybody can check if their vote has been counted.

njharman 14y ago
Does this stop multiple votes by same person? Votes by imaginary people? Does this stop keeping your secret prime number but discarding or changing your vote? Super easy, you should go shopping.
- pandaman 14y ago
  No, it also does not cure cancer and does not ensure the world peace. It only ensures that one can prove they voted and makes re-counting possible if needed.
  - ReidZB 14y ago
    Well, the grandparent's comment isn't asking if your scheme cures cancer and ensures world peace. Instead they're asking if your scheme is at least as secure as other current cryptographic voting protocols out there, the answer to which is "no." If this problem were so trivial, then I think some of the big names in crypto would not have wasted their time on studying solutions. As it is, though, I don't think there are any convincing arguments for why this problem is "trivial." Instead, there's a laundry list of properties you want a good voting protocol to have, and developing a cryptographically secure protocol that satisfies those properties is highly nontrivial.
    - pandaman 14y ago
      This scheme is more secure than paper ballots, which are advocated as better than the current cryptographic protocols, whichever they are. Better in a sense that every property of paper ballots can be also applied to the prime multiplication plus it allows verification that you cannot have with the paper ballots. My opponent did not question particular properties of this scheme but instead went on the tangent of properties, which none of voting methods currently has. Hence, she or he could as well request cancer cure.