5 ms·

I thought of a simple solution to the verifiability problem, what do you think ? - When voting, each voter receive a receipt with a random number assigned to h

by Buetol 12y ago

I thought of a simple solution to the verifiability problem, what do you think ? - When voting, each voter receive a receipt with a random number assigned to his vote - All the votes are published with the random numbers alongside them - Each voter can verify that his vote was correctly saved by looking at his assigned number in the list It's not perfect but relying on a central server is far worse I think (like the paper said)

Tomte 12y ago
At the very least the voter would need to supply the random number. Otherwise the server can lump together several voters who voted for the same option. I don't know offhand how Debian is doing it, but they've got some mechanism like that for their ballots. Since it's been around forever I'd guess it's solid.
aianus 12y ago
Unfortunately this enables someone to coerce or bribe you into voting for a certain candidate, since the coercer would be able to demand to see your receipt and verify you complied. Here's a rather long but very interesting tech talk about electronic voting schemes which maintain the secret ballot property: https://www.youtube.com/watch?v=ZDnShu5V99s https://www.youtube.com/watch?v=ZDnShu5V99s
- Buetol 12y ago
  Thanks, I looked a bit at the Helios voting system and thought it was a complicated mess but this video explains everything really well!
coretx 12y ago
The Estonian E-voting system is incredibly broken by design as you can see in this CCC lecture: https://www.youtube.com/watch?v=JY_pHvhE4os https://www.youtube.com/watch?v=JY_pHvhE4os ( by J. Alex Halderman )
- polymatter 12y ago
  That was a very interesting video but I think you misrepresent it slightly. Its clear the Estonian E-voting system was designed very very well in comparison to the ridiculously bad Diabold machines of yesteryear. The problem was that the current state-of-the-art hasn't advanced enough to make major fraud at least as hard as the paper ballot. And that means that e-voting makes it plausible for state actors to dictate election results, which in a democracy is a very bad thing. In other words, there was no way Estonia could make it perfect and anything less than perfect is broken. The important point for me was that getting e-voting right is so incredibly important to a democracy that it should be treated as a national security issue. The Estonian E-voting system was clearly treated as a government IT project as procedures like "don't plug in a personal USB stick into the master counting server" are violated if its more convenient than replacing the broken DVD drive. Worse, politics gets mixed in which means that security concerns are dismissed with complacent and technically questionable statements like "nice people who care about computer hygiene have no viruses".
  - salvadors 12y ago
    > anything less than perfect is broken Why? Even without getting into complex election fraud, parties in many countries already know how to buy votes in a paper-ballot system: you simply offer a bottle of vodka for a cell-phone photo of the ballot marked the way you want. And even without that, there's a much simpler calculation in play in Estonia. Keskerakond (the party closely allied with Putin's party), only got 7.7% of the e-votes in the most recent election: the demographics of online voters has very little overlap with their supporters. If only the paper-based votes were counted, Keskerakond would have won the election. Sure, they'd still have the complication of actually forming a government; but it's much more likely they'd be able to do that with a first-place showing (and possibly without Savisaar). With those sorts of numbers, if I were a Keskerakond strategist, I'd be doing everything I possibly could to discredit e-voting too. And the more "useful idiots" I could find, who'll merrily interfere in the elections a country they know very little about because it suits their own ideals, the better.
    - 12y ago
salvadors 12y ago
The Estonian voting system already allows you to verify your vote from a second device for a short time period. This certainly doesn't protect against all attacks (and it's only one part of the security system) — but it _does_ help against the threat of a virus that invisibly intercepts your vote to turn it into something different. If people started reporting that their phone showed a different vote to what they thought they'd cast via their laptop, then the election would be in trouble. The fact that it only shows you this for a short time period also gets around the problem of you being able to show to a third party how you voted (in cases of vote-buying or coercion), because under the Estonian system you can also vote as many times as you like (with only the final vote being counted). So you could use this verification to 'prove' to someone that you voted the way they wanted you to — and then log in again an hour later and vote for someone different.
- polymatter 12y ago
  But it also means that a virus that intercepts your PIN and your ID card can log in an hour later and vote for someone different. You then would have no way of knowing.
  - salvadors 12y ago
    As I said, this particular approach isn't a solution to every potential problem. However, I'm much less concerned with this threat than with the much simpler virus that simply changes your vote in real time. Most people I know don't leave their ID card connected at all time; so the virus would need to wait for the next opportune moment, rather than silently casting this vote whilst you're not at my computer — thus significantly increasing the chances that at least some people would notice it. If it also had to load the voting software again to send the vote (I don't know enough about the protocols around this to know if it would have to or not), then it would be even more likely that some people would notice. And on top of that, don't forget that the ID-card software shows on launch how many times you've digitally signed things. Most people almost certainly don't pay much attention to that number, but I'm sure some people would notice it rising unexpectedly from the virus, and an investigation could happen.

by Buetol 12y ago

Tomte 12y ago

At the very least the voter would need to supply the random number. Otherwise the server can lump together several voters who voted for the same option. I don't know offhand how Debian is doing it, but they've got some mechanism like that for their ballots. Since it's been around forever I'd guess it's solid.

aianus 12y ago

Unfortunately this enables someone to coerce or bribe you into voting for a certain candidate, since the coercer would be able to demand to see your receipt and verify you complied. Here's a rather long but very interesting tech talk about electronic voting schemes which maintain the secret ballot property: https://www.youtube.com/watch?v=ZDnShu5V99s https://www.youtube.com/watch?v=ZDnShu5V99s

Buetol 12y ago
Thanks, I looked a bit at the Helios voting system and thought it was a complicated mess but this video explains everything really well!

coretx 12y ago

The Estonian E-voting system is incredibly broken by design as you can see in this CCC lecture: https://www.youtube.com/watch?v=JY_pHvhE4os https://www.youtube.com/watch?v=JY_pHvhE4os ( by J. Alex Halderman )

polymatter 12y ago
That was a very interesting video but I think you misrepresent it slightly. Its clear the Estonian E-voting system was designed very very well in comparison to the ridiculously bad Diabold machines of yesteryear. The problem was that the current state-of-the-art hasn't advanced enough to make major fraud at least as hard as the paper ballot. And that means that e-voting makes it plausible for state actors to dictate election results, which in a democracy is a very bad thing. In other words, there was no way Estonia could make it perfect and anything less than perfect is broken. The important point for me was that getting e-voting right is so incredibly important to a democracy that it should be treated as a national security issue. The Estonian E-voting system was clearly treated as a government IT project as procedures like "don't plug in a personal USB stick into the master counting server" are violated if its more convenient than replacing the broken DVD drive. Worse, politics gets mixed in which means that security concerns are dismissed with complacent and technically questionable statements like "nice people who care about computer hygiene have no viruses".
- salvadors 12y ago
  > anything less than perfect is broken Why? Even without getting into complex election fraud, parties in many countries already know how to buy votes in a paper-ballot system: you simply offer a bottle of vodka for a cell-phone photo of the ballot marked the way you want. And even without that, there's a much simpler calculation in play in Estonia. Keskerakond (the party closely allied with Putin's party), only got 7.7% of the e-votes in the most recent election: the demographics of online voters has very little overlap with their supporters. If only the paper-based votes were counted, Keskerakond would have won the election. Sure, they'd still have the complication of actually forming a government; but it's much more likely they'd be able to do that with a first-place showing (and possibly without Savisaar). With those sorts of numbers, if I were a Keskerakond strategist, I'd be doing everything I possibly could to discredit e-voting too. And the more "useful idiots" I could find, who'll merrily interfere in the elections a country they know very little about because it suits their own ideals, the better.
  - 12y ago

salvadors 12y ago

The Estonian voting system already allows you to verify your vote from a second device for a short time period. This certainly doesn't protect against all attacks (and it's only one part of the security system) — but it _does_ help against the threat of a virus that invisibly intercepts your vote to turn it into something different. If people started reporting that their phone showed a different vote to what they thought they'd cast via their laptop, then the election would be in trouble. The fact that it only shows you this for a short time period also gets around the problem of you being able to show to a third party how you voted (in cases of vote-buying or coercion), because under the Estonian system you can also vote as many times as you like (with only the final vote being counted). So you could use this verification to 'prove' to someone that you voted the way they wanted you to — and then log in again an hour later and vote for someone different.

polymatter 12y ago
But it also means that a virus that intercepts your PIN and your ID card can log in an hour later and vote for someone different. You then would have no way of knowing.
- salvadors 12y ago
  As I said, this particular approach isn't a solution to every potential problem. However, I'm much less concerned with this threat than with the much simpler virus that simply changes your vote in real time. Most people I know don't leave their ID card connected at all time; so the virus would need to wait for the next opportune moment, rather than silently casting this vote whilst you're not at my computer — thus significantly increasing the chances that at least some people would notice it. If it also had to load the voting software again to send the vote (I don't know enough about the protocols around this to know if it would have to or not), then it would be even more likely that some people would notice. And on top of that, don't forget that the ID-card software shows on launch how many times you've digitally signed things. Most people almost certainly don't pay much attention to that number, but I'm sure some people would notice it rising unexpectedly from the virus, and an investigation could happen.