Hacker News Reader

Comment by germinalphrase | Hacker News Reader

It likely speaks to my ignorance, but my gut reaction to using electronic voting machines has always been that they are inherently insecure and can't/shouldn't be trusted to provide an accurate tally. There is so much money (available) and motive to cheat an election count that I have a hard time believing large and significant races haven't already been victims of tampering in the US (even if we haven't seen hard evidence of such).

Is this cynicism misplaced?

View on HN

I am from Brazil, our machines are made by Diebold and a venezuelan company.

I personally think that the 2014 elections were faked, also the machines had been proven to be easy to cheat with, and there are evidence that cheating did happen. (example: in one state election here, the number of votes was higher than the number of voters, one of the candidates complained, and got fined for complaining...)

There is even a video on youtube showing how to cheat elections in a "impossible to trace" manner using diebold machines.

Also the Dutch banned voting machines that don't print a paper copy of the vote (that you then use to put on a normal ballot).

Could you please provide some links?

About the dutch campaign in 2006: http://wijvertrouwenstemcomputersniet.nl/English

And about a follow up campaign in India with some of the same people: https://indiaevm.org/

Also see some recent research done with the Estonian e-voting system: https://www.youtube.com/watch?v=JY_pHvhE4os

Sure http://programacaobr.com/elections2014/

It entirely depends if it's using cryptography or not [1]. For example, using zero knowledge proofs you can be given a receipt that lets you verify your vote was included in the total (without allowing you to prove to an attacker which party you voted for).

Using the computers as glorified counters is a security nightmare. Using them for what they're good at (crypto) would be a security boon, with the main downside being how hard it would be for non-computer-scientists to understand the nature of the security.

1: https://www.youtube.com/watch?v=ZDnShu5V99s

I don't think the non expert voters not understanding the security is that big of a concern. Assuming that the security undisputed amongts experts, the media could convey this to the general population (absent some well supported opposition like climate science faces). At this point, the security points that need to be conveyed to the voters are relatively simple:

1) The receipt you are given may be used to confirm that your vote was correctly counted. Here is a list of websites/programs that you can use to verify your receipt.

2) It is impossible to use your receipt to prove to a third party how you voted.

If we could get major news source (New York Times, CNN, Fox News, etc) to publish their own tools for (1), then I suspect that should give a fair amount of credibility for the general public.

The problem I see is that any technical system of plausible deniability I can think of, would require that a voter is able to forge a receipt that would correctly validate as the incorrect vote. Otherwise, if an attacker wanted to verify that Alice voted Democrat, he could assume she voted Republican and attempt to verify the receipt.

How could it prove to you that your vote was included in the correct total without also being able to transfer that knowledge to a third party that is right there with you?

Say A and B were the options. Anywhere you take the receipt to verify it has to then display if it counted towards A or towards B. Someone there with you could then see which it confirms.

Inside the voting booth you pick an identified ballot and are given a zero knowledge proof that it corresponds to the candidate you want. The fact that it's a zero knowledge proof prevents you from using it to convince other people.

The video I linked has a good example where you get 1000 envelopes all claiming to contain "Obama", so you open and verify 999 of them at random and use that as evidence that the one you didn't unseal is good. You can't then use that to convince a third party, because they didn't get to pick the envelope to not open. The video also addresses lots of other security issues; you should watch it.

My concern would be in proving that the envelope you didn't open is the same one that made it into the final count. If you have no more connection with it after you leave the booth, you can not verify that the letter wasn't tampered with (and also no one can coerce you into showing who you voted for). Any way that lets you verify that the last envelope wasn't tampered with would also let some third party see who you voted for.

Anything the machine electronically presents you with can be modified on a compromised machine, while physical printout that can be used later to verify will either be unable to prove that your vote wasn't switched (though it can prove that your vote was counted) or it will be able to prove you did vote for who you choose, the latter case meaning that a third party can then use this to know who you voted for.

You're attacking the parts of the analogy that don't apply to the actual cryptography. Best way to see how they get around the issue you're talking about is to watch the video.

At the very minimum, I would expect a voting machine to create two paper receipts after each vote: one provided to the voter and another stored internally. These would hopefully be on something more durable than thermal paper, though that might suffice. The receipt would contain the machine ID, timestamp and vote recorded.

Administrators could get a quick count from the machine memory, then perform a verification by pulling a sample of votes from the printed receipt and comparing them to the electronic values with the same timestamp. And any voter can compare their receipt with publicly-available voting records.

Of course, then you have to worry about exploits that can cause the machine to print votes on demand, because those would appear legitimate, especially if the voter's receipt printout can be suppressed - there'd be no incriminating receipt trail hanging out of an unattended machine.

You can't print out a person's vote on a receipt an admin could see; that's not a secret ballot. And, using that receipt, the voter can do little to verify his vote was counted.

Edit: the timestamp gives the voter away

No identifying info needs to be printed. Just a GUID. Use a dot matrix printer with triplicate ("biplicate"?), let the voter take their receipt, and keep the other one on the spool.

Yeah, there's still might be some issue with external coercion on the voter to produce their receipt and prove they voted the way they were paid to. I suppose that could be solved by making the voter's copy an XOR of the audit tape, and by only having both copies together, can the vote be verified. Presumably the forces doing the coercion wouldn't have access to the audit tape. If they did, then we're already screwed no matter what system we implement.

Just a thought. Not sure if there's some fundamental contradiction between secrecy in voting and voter-auditability.

The machine may not print a log in order.

i.e. the attack scenario is a small town, where you record each person as they come in. Then later you can look at the vote in order and know who voted what.

> Presumably the forces doing the coercion wouldn't have access to the audit tape.

That is not a valid assumption. Your machine must be resistant even to that attack.

> If they did, then we're already screwed no matter what system we implement.

No. The audit must not be able to be correlated with the person, the order, or the time.

So basically the response to my last sentence:

> Not sure if there's some fundamental contradiction between secrecy in voting and voter-auditability.

Is, "yes, there is"? By "voter-auditability" I mean the ability for any single person to verify that their ballot was cast the same way they intended.

"zero knowledge proofs" is a textbook solved problem. Your local college library has books that explain how to do secure voting. It is how AWS and HTTPS works.

> biplicate

We just say 'duplicate'.

I..., uh, this is embarrassing. :)

Why not print out N copies of the receipt, where N = number of parties (usually 2 in the US, Republicans and Democrats). Then, each receipt is placed in a box dedicated to each party. Then, representatives from each party get a box, and count receipts. All count should match (or be within a certain margin), right?

That might work in the US, but elsewhere it's not uncommon for 10+ parties to contest an election.

You give the voter a paper ballot that they can visually confirm and deposit, themselves, in a ballot box, that can then be consulted to verify the electronic tallies in the event of a challenge. Honestly though, as an Oregon resident, I don't see why all states don't have vote by mail like we do.

Or you could just use a pencil and a piece of paper.

We use this here in Australia and I think it's worth the $197m[0] each Federal election costs. In some State elections, the upper house ballot paper is 100cm metre wide,[1] and if someone numbers all the boxes, their preferential vote has to be tallied manually.

[0]http://www.aec.gov.au/Elections/australian_electoral_history... [1]http://www.northerndailyleader.com.au/story/2970592/upper-ho...

> Is this cynicism misplaced?

I'd call it caution rather than cynicism, and I'd say it's entirely justified.

Your cynicism can be easily mistaken for just being a Luddite, but it doesn't seem too off the mark.

I'm not suggesting we go back to voting with shards in a pot; I am just skeptical that voting machine have been/are secure from tampering. Seems like the kind of question that matters a lot.

Reply on news.ycombinator.com