Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How would you design an secure online voting system?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 30 posts

Re: Ask HN: How would you design an secure online voting system?

#21

Post by mattbrewsbytes »

BjoernKW wrote: post #16
lovegoblin wrote: post #7

"Online voting" is a solution in search of a problem. A pencil and paper does the job better, cheaper, and more securely.

Except when it doesn't. Take the current elections in the US as an example. Yes, the system's working and it has proven to be quite resilient but those shenanigans involving mail-in ballots and the uncertainty that came with that for example could've been avoided with a properly designed digital system. Most of those problems could of course be solved with a properly designed non-digital system, too.

Even a properly designed digital system will have flaws and if it is on a network it can be hacked at scale. Hacking paper ballots cannot be achieved at the scale necessary to sway a national election.

Its similar to a story I read a while ago about flooding a lottery system with enough combinations of numbers to near guarantee some level of profit. The scale needed to fill out, submit, track, etc. 10's of thousands of tickets was ridiculous.

There is no need to speed up the election process. If any human effort is to be spent, it should go towards rolling back the perceived need for constant updates. Its unhealthy.

Re: Ask HN: How would you design an secure online voting system?

#22

Post by rawgabbit »

alexmingoia wrote: post #20
alexmingoia wrote: post #6

The process is actually quite straightforward: - Every citizen is issued ID that includes a hardware embedded public/private key pair. A YubiKey essentially. This step is optional, but allows ballots to be assigned remotely. - Election commission creates and maintains their own key pair. - Ballots are assigned remotely to eligible voters by encrypting with citizens public key, or assigned in person. Ballots themselve…

A simpler variation on this system is for the ballot keypair to be generated by the voter, and then the public key given to the registrar to "register" for the election. The registrar publishes all the registered ballots signed by their key. All the registrar does is ensure eligible voters submit a public key to register. This would require a voter to register in person or a national ID card that could be used to sig…

If I understand correctly, you are saying when the voter goes to the DMV or US post office - a registrar can instruct the voter to download a voting app on his phone. The registrar activates the app and generates the key pair. The registrar records the voter’s public key. The voter can now use the app to vote and his votes are encrypted using his private key which can be read using the recorded public key. Every election cycle or if he loses his phone the voter needs to go back to the registrar. Is there anything I am missing?

Re: Ask HN: How would you design an secure online voting system?

#23

Post by alexmingoia »

rawgabbit wrote: post #22
alexmingoia wrote: post #20

Earlier quoted context omitted.

A simpler variation on this system is for the ballot keypair to be generated by the voter, and then the public key given to the registrar to "register" for the election. The registrar publishes all the registered ballots signed by their key. All the registrar does is ensure eligible voters submit a public key to register. This would require a voter to register in person or a national ID card that could be used to sig…

If I understand correctly, you are saying when the voter goes to the DMV or US post office - a registrar can instruct the voter to download a voting app on his phone. The registrar activates the app and generates the key pair. The registrar records the voter’s public key. The voter can now use the app to vote and his votes are encrypted using his private key which can be read using the recorded public key. Every elec…

Yup. Or if a national ID system was put in place they wouldn’t need to go to the registrar, since the ID would have a key pair to prove eligibility remotely.

Re: Ask HN: How would you design an secure online voting system?

#24

Post by JoeAltmaier »

alexmingoia wrote: post #23
rawgabbit wrote: post #22

Earlier quoted context omitted.

If I understand correctly, you are saying when the voter goes to the DMV or US post office - a registrar can instruct the voter to download a voting app on his phone. The registrar activates the app and generates the key pair. The registrar records the voter’s public key. The voter can now use the app to vote and his votes are encrypted using his private key which can be read using the recorded public key. Every elec…

Yup. Or if a national ID system was put in place they wouldn’t need to go to the registrar, since the ID would have a key pair to prove eligibility remotely.

There have been dystopian stories written about such schemes. The ID card essentially becomes a 'voting voucher'. You have to possess it to vote. Employers then demand your ID card as a term of employment. The voting system becomes a corporate power grab, and the resulting disenfranchising of everybody becomes a new form of society.

Re: Ask HN: How would you design an secure online voting system?

#25

Post by lasereyes136 »

BjoernKW wrote: post #15
pwg wrote: post #3

> How would you design an secure online voting system? You don't. Anything done "online" simply verifies that "some human at a keyboard" has the requisite "secret" -- but cannot verify that the correct human who should legally have the secret is indeed the one entering the secret. I.e. Bob gives Joe his "voting secret" and now Joe can log in as "Joe" and vote his legal vote, and also log in as "Bob" and cast a second…

Those statements apply to in-person voting, too, don't they? How do you verify the identity of a person at the polling station? I'm not sure how it's done in the US specifically but in general it boils down to the voter handing over a piece of paper that's been mailed to them by some government agency and optionally, in places where such provisions exist, producing an ID card or social security ID. That's nothing mor…

Where I live in the USA, you verify the voter to get a ballot, go to a private area to fill out the ballot, go to a new area to scan the ballot, and leave the paper ballot that is filled out in the scanning machine to have a paper trail of votes. Unless you are the only person voting in a long stretch of time it would be hard to determine which vote was your vote. That doesn't mean it is impossible just highly unlikely.

Re: Ask HN: How would you design an secure online voting system?

#26

Post by BjoernKW »

lasereyes136 wrote: post #25
BjoernKW wrote: post #15

Earlier quoted context omitted.

Those statements apply to in-person voting, too, don't they? How do you verify the identity of a person at the polling station? I'm not sure how it's done in the US specifically but in general it boils down to the voter handing over a piece of paper that's been mailed to them by some government agency and optionally, in places where such provisions exist, producing an ID card or social security ID. That's nothing mor…

Where I live in the USA, you verify the voter to get a ballot, go to a private area to fill out the ballot, go to a new area to scan the ballot, and leave the paper ballot that is filled out in the scanning machine to have a paper trail of votes. Unless you are the only person voting in a long stretch of time it would be hard to determine which vote was your vote. That doesn't mean it is impossible just highly unlike…

Possibly being able to identify a voter and their vote after the fact certainly is another issue, one that admittedly is more pronounced with a digital system (albeit still solvable).

However, verifying that a voter is the person they claim to be is a problem that equally exists in both online and offline settings.

Re: Ask HN: How would you design an secure online voting system?

#27

Post by alexmingoia »

JoeAltmaier wrote: post #24
alexmingoia wrote: post #23

Earlier quoted context omitted.

Yup. Or if a national ID system was put in place they wouldn’t need to go to the registrar, since the ID would have a key pair to prove eligibility remotely.

There have been dystopian stories written about such schemes. The ID card essentially becomes a 'voting voucher'. You have to possess it to vote. Employers then demand your ID card as a term of employment. The voting system becomes a corporate power grab, and the resulting disenfranchising of everybody becomes a new form of society.

That would be illegal, and quite difficult to hide, since presumably you need the ID card for other things. The larger the company is the more difficult it is to keep this a secret.

A company can already compel you to vote, because all states allow mail-in ballots. It would be pretty hard to announce this to everyone while simultaneously keeping it a secret.

Re: Ask HN: How would you design an secure online voting system?

#28

Post by JoeAltmaier »

alexmingoia wrote: post #27
JoeAltmaier wrote: post #24

Earlier quoted context omitted.

There have been dystopian stories written about such schemes. The ID card essentially becomes a 'voting voucher'. You have to possess it to vote. Employers then demand your ID card as a term of employment. The voting system becomes a corporate power grab, and the resulting disenfranchising of everybody becomes a new form of society.

That would be illegal, and quite difficult to hide, since presumably you need the ID card for other things. The larger the company is the more difficult it is to keep this a secret. A company can already compel you to vote, because all states allow mail-in ballots. It would be pretty hard to announce this to everyone while simultaneously keeping it a secret.

Illegal? What makes us think that unrestricted corporate power isn't going to continue?

In the story, its become an ordinary fact of life. In fact, once you have somebody's card you have their life. They can kill employees if its convenient.

But its just a story.

Re: Ask HN: How would you design an secure online voting system?

#29

Post by auganov »

The biggest problem with voting systems (online or otherwise) is absolute secrecy. If you give up on this requirement, which I believe is antiquated [0], you can easily come up with a system where most fraud could be fixed and punished. You can have reasonable privacy, but you have to have the ability to audit votes if need be.

A system in which all votes are fungible after a certain point only encourages fraud. As long as you execute it well you can have a high degree of certainty that you won't be punished.

[0] First, behind this requirement is the premise that political repression is to be expected. I'm sure that's true in some places, but you want to fix this in other ways. Second, you already don't have perfect secrecy in many systems and people don't seem to mind.

Re: Ask HN: How would you design an secure online voting system?

#30

Post by imheretolearn »

BjoernKW wrote: post #15
pwg wrote: post #3

> How would you design an secure online voting system? You don't. Anything done "online" simply verifies that "some human at a keyboard" has the requisite "secret" -- but cannot verify that the correct human who should legally have the secret is indeed the one entering the secret. I.e. Bob gives Joe his "voting secret" and now Joe can log in as "Joe" and vote his legal vote, and also log in as "Bob" and cast a second…

Those statements apply to in-person voting, too, don't they? How do you verify the identity of a person at the polling station? I'm not sure how it's done in the US specifically but in general it boils down to the voter handing over a piece of paper that's been mailed to them by some government agency and optionally, in places where such provisions exist, producing an ID card or social security ID. That's nothing mor…

It is exponentially more difficult to pull off in person identity theft on scale whereas getting secrets online on scale is a lot more feasible.
Post reply on HN