> We have cryptographic protocols for honest, verifiable, anonymous elections, which we don't bother implementing
We do?
We do?
Techniques like Zero-knowledge proofs, homomorphic encryption and multiparty computation exists, but none of them are sufficient for elections. The security requirements are simply too complex, and we can't require that every voter manages a private keypair to issue their votes from an electronic device they can't audit.
Paper voting is safer.
* You have a list of votes. That's public (and not correlated with the above) by anonymous tokens.
* You have an anonymous token, which lets you verify your own vote.
If the list of people who voted doesn't match up to real people, that's detectable. If I go into Massachusetts and find 10% of the people claimed to have voted don't exist, I can confirm fraud. If someone who didn't voted has there vote counted, that also confirms fraud.
Anyone can count up and add up the votes. That's public too.
And anyone can confirm their own vote was counted.
- Everyone can verify who voted (so number of votes equals number of voters)
- Everyone can verify their individual vote was correctly and uniquely counted
- All votes are released under unique, anonymous identifiers, so anyone can recount all votes
- However, no one can verify anyone else's vote individually
It's pretty awesome! I've watched with gradual shock and horror as voting machines came out and seemed almost designed for riggable elections.
The question I've had with this is whether you can prove who you voted for. If you can, you can sell your vote and prove tongue buyer that you voted correctly.
That's also my concern with mail in voting.
If you're trying to buy my vote, and I'm trying to sell it, I could give you my unique anonymous number, and you could verify my votes. But I could also vote a different way, lie, and give you someone else's unique number, and you'd have no way to know.
You could ask for a special ballot too, where, for example, I vote a particular pattern (yes/no/no/yes/yes/no), to encode things, ideally picking ones that aren't likely to come up in practice, or other complex schemes, but these generally have work-arounds.
At the end of the day, though, it'd be cheaper and easier for you to require me to wear a pinhole camera to vote, do a mail-in, or otherwise. Plus, we had open voting for much of history, and it worked okay. If we went back to the risk of illegal vote selling versus the risk of wholesale election fraud, I'd take the former which seems like the lesser of two evils (and much easier to police too).
This violates the secrecy of the vote. I can threaten you to vote for someone then force you to prove you voted according to my orders.
> If we could do away with anonymity — if everyone could check that their vote was counted correctly — then it would be easy to secure the vote. But that would lead to other problems. Before the US had the secret ballot, voter coercion and vote-buying were widespread.
https://www.schneier.com/blog/archives/2018/04/securing_elec...
of course every fix creates another problem
The problem is closed, proprietary, secretive, touchscreen voting machines. For all we know, Biden won Texas. Or perhaps everyone wrote in Putin as a joke write-in. We just don't know.
For how this works in practice, Applied Cryptography has a nice, readable explanation.