10 ms·
Estonian E-Voting Source Code Made Public
- josephlord 13y agoHow does a voter or independent voter know that the code that has been verified is actually running on the machine that they connect to? You have to trust the sys admins. And as we all know: something is trusted if it can break your security policy.
- Lewisham 13y agoAll voting systems that I know of require trust, with or without machines. Do you trust the person counting your ballot to count correctly? There's a district in the UK that prides itself on always being the first to return results. I would be fairly worried about the ballot counters there. Eventually someone has to trust someone to execute correctly. Unless there's some voting system I'm not aware of that doesn't require humans and is easily verifiable at the point of voting by the average voter.
- Anderkent 13y agoThere are theoretical cryptographic systems where each voter can verify that his vote was counted properly, without revealing his vote to anyone. I don't think any have been implemented in practice.
- mzf 13y agoThe voters can check their votes by following method: http://www.vvk.ee/public/Verification_of_I-Votes.pdf http://www.vvk.ee/public/Verification_of_I-Votes.pdf
- revelation 13y agoThat doesn't verify anything. They are shuffling encrypted data between devices, but none of that is connected to the actual results. This isn't verification, it's smoke and mirrors.
- mzf 13y agoThat's not the point of this feature. The point is that if your computer is infected with malicious software that blocks or manipulates your votes then you can detect such things.
- josephlord 13y agoThat in itself is a problem because the ability for the voter to prove who they voted for opens them to coercion or bribery. Although doing it online (or by post) opens that risk anyway.
- dchest 13y agoCan verify != can prove to a third party
- ReidZB 13y agoThis is a critical distinction. As a concrete example, here's how voting worked in a scheme I once read about. On any one ballot, the order of candidates was randomized. Then the way the scheme worked was that after voting, the voter tore off the candidate positions (but not their vote) and threw it away in a huge pile of them, burned it, or whatever. (Made it so that someone couldn't come behind them and figure out their position list, essentially.) Later, after the votes were tallied, the voter could verify that their ballot was (1) counted and (2) counted towards their chosen candidate. But crucially, all they could verify was that the vote counted towards position 1, or position 2, or position 3, ... The point is that since the voter couldn't prove to a coercing party that the position they voted for was (or was not) the candidate the coercer wanted them to vote for, they were immune to coercion. They could prove that they voted for position 2, sure. But which candidate was at position 2? The voter knows the truth because they saw the position list. However, until we have mind-reading technology, a coercing party could only take the voter's word.
- ams6110 13y agoI'm not following how the counting is done. If all the counter has is a ballot with position 2 checked and the corresponding candidate name torn off, how does that vote get tallied to the proper candidate?
- josephlord 13y agoThen if it isn't recorded properly how can you show that an election has been rigged?
- ReidZB 13y agoThe International Association for Cryptologic Research (IACR) uses Helios Voting [1], an implementation of a cryptographic voting protocol [2], to vote for its directors. See the 2010 mock election [3,4] or the 2012 vote for the IACR directors [5]. You can find some other technology resources for Helios here [6]. [1] http://heliosvoting.org/ http://heliosvoting.org/ [2] http://documentation.heliosvoting.org/verification-specs/helios-v3-verification-specs http://documentation.heliosvoting.org/verification-specs/hel... [3] http://www.iacr.org/elections/eVoting/finalReportHelios_2010-09-27.html http://www.iacr.org/elections/eVoting/finalReportHelios_2010... [4] http://www.iacr.org/elections/eVoting/heliosDemo.pdf http://www.iacr.org/elections/eVoting/heliosDemo.pdf [5] https://vote.heliosvoting.org/helios/elections/1df69264-0a48-11e2-8f89-12313f028a58/view https://vote.heliosvoting.org/helios/elections/1df69264-0a48... [6] http://heliosvoting.org/technology/ http://heliosvoting.org/technology/
- polymatter 13y agothe problem with e-voting is any single sys admin has hugely more influence than any single human ballot counter.
- jaakl 13y agothat can happen also with physical voting. I have personal experience (years ago) that I was sysadmin of voting result calculations machine, and I was asked to change some numbers to fit them to the calculation system, as some vote counters had messed or lost some ballot papers. You can verify individual physical votes, but in the big picture (which matters) you must also just trust some sys admins.
- deleted 13y ago[deleted]
- rimantas 13y agoThere usually are representatives of various political parties at each polling station during elections in my country. How do you watch electroing vote counting? How do you recount in case of doubt?
- salvadors 13y agoWith physical voting you need more than observers at the counting itself. One common means of electoral fraud is to introduce boxes full of pre-cast votes for your candidate into the counting process.
- josephlord 13y agoThere are a number of checks that can (and are) put in place in physical paper based elections that mean large scale collusion is needed to make large scale fraud work. 1) Observers at polling stations. 2) Sealed ballot boxes. 3) Observers from many parties and neutrals at counts. 4) Physical votes retained and recountable. It isn't going to be completely secure but if you measure the systems security by how few people you could rig an election with it is an order of magnitude harder [edit: to rig].
- revelation 13y agoThats why any person can act as an observer if they so wish and oversee the person counting your ballot. I can not possibly do the same with a turing machine.
- bkmartin 13y agoSo why can't you be an observer of the sys admin when they install the software. Witness some chain of command that the software has come from an authorized source, meets a digital check-sum and is installed properly. It can then be secured by another party with a two password "lock box" type approach kind of like we use with our crypto system at work that guards our CC processing. There are systems invented and implemented in the world already that can rid your concern over some rogue sys admin. Takes all of 1 minute of critical thinking.
- LinaLauneBaer 13y agoYou have to be very competent to oversee all of this. How many people can verify a digital check-sum? In contrast regular people usually have the mental capabilities to count votes.
- revelation 13y agoYou don't seem to understand, so heres a whitepaper [1] from Rop Gonggrijp on how to play chess on a Nedap voting computer. And the Nedap machines are special-built and programmed to ensure the authenticity of the votes, using anything from printers to read only memory. Not fucking Python running on a loosely secured Linux box. [1]: http://wijvertrouwenstemcomputersniet.nl/images/9/91/Es3b-en.pdf http://wijvertrouwenstemcomputersniet.nl/images/9/91/Es3b-en...
- deleted 13y ago[deleted]
- revelation 13y agoDespite the halting problem being unsolvable, formal verification is a huge area in computer science. News flash: you can not formally verify some web app running on Python running on Linux, being fed with input from a gigabit link to the complete outside world. So the idea of using Python for an electric voting machine is dead from the onset, a complete no-starter. (And yes, of course computer languages are inherently more or less secure by themselves, through the simple proxy of allowing programmers to make (or prevent) severe errors. Think C and fixed-size buffers on the stack.)
- abdel 13y agohttps://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%3F https://en.wikipedia.org/wiki/Quis_custodiet_ipsos_custodes%...
- prawks 13y agoAllow the voter access to an installer/reinstaller which you can check the md5 of? I'm not a security expert, how effective could that be in providing this kind of verification?
- abecedarius 13y agoYou can do a lot better than the usual practice: http://zesty.ca/pubs/yee-phd.pdf http://zesty.ca/pubs/yee-phd.pdf "I examine the question of how to design election-related software, with particular attention to the threat of insider attacks, and propose the goal of simplifying the software in electronic voting machines. I apply a technique called prerendering to reduce the security-critical, voting-specific software by a factor of 10 to 100 while supporting similar or better usability and accessibility, compared to today’s voting machines. Smaller and simpler software generally contributes to easier verification and higher confidence. "I demonstrate and validate the prerendering approach by presenting Pvote, a vote-entry program that allows a high degree of freedom in the design of the user interface and supports synchronized audio and video, touchscreen input, and input devices for people with disabilities. Despite all its capabilities, Pvote is just 460 lines of Python code; thus, it directly addresses the conflict between flexibility and reliability that underlies much of the current controversy over electronic voting. A security review of Pvote found no bugs in the Pvote code and yielded lessons on the practice of adversarial code review. The analysis and design methods I used, including the prerendering technique, are also applicable to other high-assurance software." (No, it doesn't solve all of your problem.)
- betterunix 13y ago"How does a voter or independent voter know that the code that has been verified is actually running on the machine that they connect to?" You know, there is a technical solution to that problem: https://en.wikipedia.org/wiki/Verifiable_computing https://en.wikipedia.org/wiki/Verifiable_computing
- relix 13y agoCreative Commons-licensed, written in Python using vim, shared on Github. It ticks all the boxes, just sad that the README is empty. Unless I'm mistaken, I can't find any tests though. Maybe they didn't release it, but it's a bit worrying.
- sjtgraham 13y agoIs the editor a program is written in really a criterion you evaluate software against?
- technimad 13y agoNo matter how open the code is. It is extremly hard, if not impossible, to ensure this code is running on the actual systems. E-voting sounds intersting in theory, but in practice it is basically not worth the trouble. It is way more complex than a regular system with ballots and the only gain is that the results can be published sooner.
- relix 13y agoI don't agree with that last sentence though. It's not more complex because you don't need to spread booths all around the country, get volunteers to sit a whole day at the booths, secure the ballots, count the ballots, recount the ballots, etc... It takes a lot of logistics to do papervoting and it's probably more expensive too, compared to a centralized datacenter. They probably still have booths for people without computers, but they surely need less. Also, if voting is not compulsory, there's a lot less friction to actually go vote from the comfort of your home, whenever you want, than there is to get to a booth and stand in a queue on voting day, it would surely result in a higher turnout.
- DanBC 13y agoThe UK has had problems with fathers using the votes of everyone in their family via postal voting. I'd be interested to see if electronic voting fixes that, or makes it worse.
- relix 13y agoIt fixes it somewhat, depending how far the person will go to claim those votes: iirc you get a week to vote, and the last vote you make counts. So even though your father might stand next to you and watch as you vote for his candidate, you can always recast your vote later. This doesn't solve the problem in case the person keeps an eye on you from the time you voted until the deadline, or steals your ID card until after the deadline.
- Already__Taken 13y ago
- jpalomaki 13y agoGithub link: https://github.com/vvk-ehk/evalimine https://github.com/vvk-ehk/evalimine
- mtgx 13y agoThere was this talk on TED a few years ago about e-voting without fraud: https://www.youtube.com/watch?v=izddjAp_N4I https://www.youtube.com/watch?v=izddjAp_N4I I think they had a website for it, too, but I can't find it right now, and don't remember how it was called exactly.
- Create 13y ago“You can't solve social problems with software.” (Marcus Ranum). It isn't clear from the talk, that: - you cannot inject votes digitally (within parts of the system) - you may only verify your own vote, and may or may not know about "extra" votes, especially under low turnout, which is very frequent (the euphemism is "democratic deficit") - supersedes chain voting: it is not clear, that voters cannot be bribed, where the briber can ask for your receipt to verify your voting (currently this is done by buffering voting slips: the first is taken out, filled out in front of the briber and exchanged for the clean copy inside the booth, which in turn is taken out etc.).
- pwr 13y agoSadly many of the identifiers are named in estonian. Limiting this project to estonian developers only. I'm aware that this is _estonians_ voting system, but i'm sure there are developers all around the world who would be interested in contributing (especially security audits would be interesting) to this project without the necessity to reverse engineering/translating the code.
- rimantas 13y agoMust be Estonian thing. I had to deal with the system that was also born in Estonia but went international later. Estonian comments and names did not make it easier.
- bragh 13y agoNot only identifiers, but comments and log messages too. I guess the code doesn't hold up to the high opinion I had of Cybernetica AS.
- seren 13y agoThis is anecdotal but I worked (shortly) somewhere where a developer did not write comments, variable, functions, etc in English on purpose, so that the code would not be outsourced in the future. The fact that it did not raised any eyebrows showed that overall the place had other issues all around...
- gotofritz 13y agoWe all know naming things is one of the most difficult things in programming. Give the guys a chance, let them do it in the language they are fluent in, rather than the language you grew up with
- spajus 13y agoNaming variables in national language is typically done by students or otherwise inexperienced programmers.
- mzf 13y agoSome heavy security checks: https://github.com/vvk-ehk/evalimine/blob/master/ivote-server/hes/vote_analyzer.py https://github.com/vvk-ehk/evalimine/blob/master/ivote-serve...
- lucaspiller 13y agoSend a pull request :)
- skrebbel 13y agoLicense says "no derivatives"
- daxelrod 13y agoInteresting. That doesn't seem to square with this item from GitHub's ToS: > By setting your repositories to be viewed publicly, you agree to allow others to view and fork your repositories. https://help.github.com/articles/github-terms-of-service#f-copyright-and-content-ownership https://help.github.com/articles/github-terms-of-service#f-c...
- 3pt14159 13y agoView and fork does not mean view and fork and edit. Some of us fork just so we can security audit the code once and then have a safe place to clone from.
- baldurthoremils 13y agoThe license (Creative Commons Attribution-NonCommercial-NoDerivs 3.0) is a strange choice for a project published on Github. Github encourages forking and making changes, which goes against the NoDerivs part of the license, unless I'm misunderstanding something.
- bru 13y agoYou're right. CC licenses are not for software and are incompatible with the GPL. Read more at http://wiki.creativecommons.org/Frequently_Asked_Questions#Can_I_apply_a_Creative_Commons_license_to_software.3F http://wiki.creativecommons.org/Frequently_Asked_Questions#C...
- oellegaard 13y agoThis seems like a good contract to the typical (american-inspired) secrecy around governmental systems. I would also like to believe open source makes software more secure, but I'm not sure if there is any research that confirms it. Oh, and cool its made in python and not some enterprise java or .NET :)
- skrebbel 13y agoWe're getting off topic, but you do know that it's perfectly possible to write decent Java or C# without it being "enterprise", right? (whatever that means) I'm starting to get sick of this "ruby/python/nodejs = cool, java/.net = slow bloated enterprise crap for men with suits" attitude that keeps reappearing here on HN. Whether your work environment is cool, whether your code is decent and snappy, all that has very little to do with your programming language choice. Admittedly, if you compare modern Ruby to VB6 you might conclude that VB sucks, but that's an unfair comparison since the technologies are a decade apart. It's like saying Python rocks because you hate COBOL. You can work at a scrappy startup and code lean C#, and you can work at a bureaucratic departmentalized hell and code AbstractProxyProviderFactoryProviders in Python. And, yes, you can even work at a bureaucratic departmentalized hell and code decent Python. Or Java. Or C#. Or Ruby.
- eli 13y agoJava Enterprise Edition is the name of an Oracle product. http://www.oracle.com/technetwork/java/javaee/overview/index.html http://www.oracle.com/technetwork/java/javaee/overview/index... It's "enterprise" literally by definition.
- skrebbel 13y agoIndeed, and so it's uncool and crappier than Python? How is that related? The OP clearly used the term "enterprise" with a negative connotation. I doubt he was referring to a brand name.
- joelthelion 13y ago
- zimbatm 13y agoCommon, not a single positive comment ? Things in the administration always take time. At least it's a move in the right direction. Next add a build CI to produce signed images. Then propose USB keys for people to boot their own system on the voting booth. At least it's better than the Diebold debacle in the states.
- rimantas 13y agoIMHO internet voting falls under "because you can does not mean you should".
- jsaxton86 13y agoThere are two parts to this story: -Estonia has an internet voting system -Estonia just released the source code to their voting system Even if internet voting is a terrible idea, a transparent election system is a very good idea, and releasing the source code for your voting system is a big step in that direction.
- kmfrk 13y agoIll-advised or not, at lot of countries are considering e-voting. I think it's a bad idea as well, but like you, I think it's weird to be upset that there are people who want to help achieve the best solution/compromise, in the event that your country's government vote to implement something like this. I'm as pro-government as the next European, but we can all think of horrible government project failures.
- pavel_lishin 13y agoCan you expand on that? I could probably blab for three minutes on either side of the argument, but I don't know if I have any strong opinions about it right now.
- btbuildem 13y agoShrink the scope and decentralize to reduce risk. In this case, at a cultural level: don't vote on puppets, but vote on everything the puppets do. We have the technology to enable direct democracy.
- ChrisAntaki 13y agoCould it be, that secret ballots are insecure? https://en.wikipedia.org/wiki/Secret_ballot https://en.wikipedia.org/wiki/Secret_ballot In the US, we officially supported secret ballots in 1892. Still, I wonder if we all found the strength to open up the ballot, if that wouldn't eliminate some of the viability of voting fraud? I'll start, I voted for Obama in 2008 & 2012.
- zanny 13y agoA lot of people are in circumstances where those they can't escape from (parents, abusive boyfriends, etc) will physically assult you for voting for the guy they didn't like. In the more general case, you can lose friends not going with the collective choice, and open ballots expose that, which makes more people vote for the guy their friends want rather than what they want to maintain social acceptance.
- ChrisAntaki 13y agoThose are extreme cases! I hope your family isn't beating you often, for your voting habits.
- omh 13y agoThere's plenty of other cases as well. What about someone who bribes people to vote for them, and can check up on it? Or if your boss tells you who to vote for and threatens to fire you otherwise?
- deleted 13y ago[deleted]
- ChrisAntaki 13y agoThese are examples of Voting Fraud. https://en.wikipedia.org/wiki/Vote_selling https://en.wikipedia.org/wiki/Vote_selling Secret ballots make it easier to pull off.
- kmfrk 13y agoVote for Bobby Tables!
- ChrisAntaki 13y agoNice, I'm looking forward to USA's voting software landing on GitHub.
- vvllddrr 13y agoThe title is wrong (the article isn't, necessarily). The license, https://github.com/vvk-ehk/evalimine/blob/master/LICENSE https://github.com/vvk-ehk/evalimine/blob/master/LICENSE, is non-free/open source.
- yaddayadda 13y agoThe "Creative Commons Attribution-NonCommercial-NoDerivs 3.0 Unported License" is an "open source" license. The source code itself is "open" and can be redistributed for free (beer not speech). But it is disappointing that they have opted to prohibit derivatives, and it makes their posting of the code to GitHub an interesting choice.
- eli 13y agoA pull request would technically be violating the license, no?
- yaddayadda 13y agoIANAL, but as I understand the license, yes it would violate the license. Although, if I released something under a no-derivatives license on github, I'd be less worried about pull requests and more worried about derivatives made outside GitHub.
- joestringer 13y agoWhat if you clone the repo before the license was added? Then do you get code in the public domain?
- nitrogen 13y agoNo, the default state of software is copyrighted and not redistributable. You need a specific license to give you the right to modify and/or redistribute software (though I think copyright should be changed to allow private modification for certain purposes).
- 13y ago
- ERRnews 13y agoOriginal story at http://news.err.ee/politics/0233b688-b116-44c3-98ca-89a4057acad8 http://news.err.ee/politics/0233b688-b116-44c3-98ca-89a4057a... has been updated with some background - domestic controversy and such
- knqku 13y agoEven more controversy: * Release of E-Election Software Code 'Did Not Go Far Enough' http://news.err.ee/sci-tech/940d2015-ffe1-4c9f-98e8-6fc60935fa0c http://news.err.ee/sci-tech/940d2015-ffe1-4c9f-98e8-6fc60935... * Architect: E-Election Code Should Not Be a Free-for-All http://news.err.ee/sci-tech/7f244d47-86ee-41bd-a544-87bd756b2b41 http://news.err.ee/sci-tech/7f244d47-86ee-41bd-a544-87bd756b...
- dobbsbob 13y agoLot's of proposals have been submitted on the bitcoin forums for some sort of cryptocurrency solution/proof of work online voting, where there is full transparency by looking at the block chain to see how many votes somebody had, and prevention of a malicious actor forging votes. Of course you have to trust whoever is mining the coins and handing them out, and trust end users sytems aren't compromised. I would expect in my country anyways that any online voting would be DDOS'd by idiots looking for a soap box the media will pay attention to and create a huge debacle resulting in them scrapping it and forcing a regular ol' paper vote.
- thinkmoore 13y agoThere has been significant work in the academic community about electronic voting schemes. For example, Civitas (http://www.cs.cornell.edu/Projects/civitas/ http://www.cs.cornell.edu/Projects/civitas/) is a voting system developed by researches at Cornell that provides universal verifiability, voter verifiability, anonymity, and coercion resistance. It is also implemented in a security-typed programming language, which provides additional guarantees about the correctness of its implementation.
- ikarustigger 13y agoYou should read the book "ein König für Deutschland" (a King for germany) - it very reasonably makes clear why computer-based voting always will be Much easier manipulable and why democracies should stay with paper based Voting.
- ikarustigger 13y agoYou should read the book "ein König für Deutschland" (a King for germany) - it very reasonably makes clear why computer-based voting always will be Much easier manipulable and why democracies should stay with paper based Voting.
- marze 13y agoSo surely some open source hardware + software voting machines are being developed somewhere... True?
- deleted 13y ago[deleted]