Comment by beautiful_apple | Hacker News Reader

Comment by beautiful_apple | Hacker News Reader

Parent Full thread

beautiful_apple

You can have e-voting systems that protect ballot secrecy and are verifiable.

You can use homomorphic encryption or mixnets to prove that:

1) all valid votes were counted

2) no invalid votes were added

3) the totals for each candidate is correct

And you can do that without providing proof of who any particular voter voted for. A few such systems:

https://en.wikipedia.org/wiki/Helios_Voting

https://www.belenios.org/

Authentication to these systems is another issue - there are problems with mailing people credentials (what if they discard them in the trash?).

https://www.cbc.ca/news/canada/ontario-municipal-elections-o...

Estonia (a major adopter of online voting) solves this with the national identity card, which essentially is government issued public/private keys.

https://en.wikipedia.org/wiki/Estonian_identity_card

Lots of cyber risks with the use of online voting though, especially in jurisdictions without standards/certification. I outline many in my thesis which explores the risks to online elections in Ontario, Canada (one of the largest and longest-running users of online voting in the world)

https://uwo.scholaris.ca/items/705a25de-f5df-4f2d-a2c1-a07e9...

> You can have e-voting systems that protect ballot secrecy and are verifiable.

In these systems the voter cannot verify that their vote was secret as they cannot understand, and much less verify the voting machine.

> And you can do that without providing proof of who any particular voter voted for.

Which is good for preventing the sale of votes, but keeps things obscure in a magical and correct box.

How can I tell the machine didn't alter my vote if it cannot tell me, and just me, who I voted for? The global sanity checks are worthless if the machine changed my vote as I entered it.

And if it could tell you that then a third party could force you to reveal that you voted "right" as agreed before.

Paper ballots with mutually suspicious representatives of all parties watching themselves during handling and counting is the only way to go for big things like parliament/presidential elections and national referendums where, in the worst case, the greatest of all matters are at stake. And foolproof method for voting is most needed when the levels of trust are at the lowest.

> How can I tell the machine didn't alter my vote if it cannot tell me, and just me, who I voted for?

Isn't that the whole point of having ballot secrecy ? Even with paper vote you cannot tell which ballot is yours (or at least, a recognisable ballot is voided during the counting).

you don’t need to be an aviation expert to trust the plane will fly.

likewise e-voting systems pass through cryptography experts auditing to verify it does what it says it does.

said that the voting solution can also provide cryptographic proof that your vote was unaltered, and accounted for, without need to expose your actual vote.

the claims about database altering, are also false as the vote is cryptographically signed and unalterable.

also there is another feature where you can recast vote on top of your previous one and the last vote will be the valid one. This is crucial for countries where the bad guys can come at your place and under distress (gun) force your vote. you can then recast safely invalidating the forced vote.

e-voting solutions is really interesting and in an alternate reality I think we could have had a mainstream e-voting and more even direct-democracy vs our current democracy by proxy (elected officials)

>you don’t need to be an aviation expert to trust the plane will fly.

...because when I get on the plane, I can look out the window and see that it's in the air.

With paper ballots, the systems are very interpretable - you can sign up to audit the ballot counting process and watch it happen, etc.

But you can't do that with electrons in a computer - it's really just pure trust. That's what you lose.

I've worked on some research in this area as well (the experience of people with verifiability systems in real-world elections)

https://link.springer.com/chapter/10.1007/978-3-031-43756-4_...

Beyond this paper, based on my experience working with election officials, political candidates, and voters, I would agree that verifiability is not well understood.

If it's a completely binary choice of "election was valid" and "election was invalid" without any partial verifications of results, I think it's still a massive step back.

By which I mean: paper ballots have problems. But a fault in a handful of ballots doesn't mean the rest of the ballots need to get tossed out.

I do not believe that a system managed by humans can be faultless.

You would still be getting partial counts by district right? Isn't that a partial result? Make the validation algorithms open source. And I imagine there's some kind of independent auditing of the voting systems. I think it would be neat to have multiple competing implementers of the voting system, where ballots are sent to each, and results are compared. And hey, why not, maybe after voting you get an anonymized receipt, that could then be human-counted as well

Why are you lying?

from https://en.wikipedia.org/wiki/Helios_Voting

> The centralized server must be trusted not to violate ballot secrecy,[7] this limitation can be mitigated against by distributing trust amongst several stakeholders.

> The ballot auditing/reconstruction device must be trusted to ensure successful ballot auditing (also known as cast-as-intended verifiability),[7][16] this limitation can be mitigated against by distributing auditing checks amongst several devices, only one of which must be trusted.

So neither secure nor anonymous...

Reply on news.ycombinator.com