21–30 of 307 posts
The goal of a voting system is not verifiability, but trust. Without trust elections have no legitimacy.
Earlier quoted context omitted.
I think these are technically interesting systems, but "trust" really is the goal. "Verifiability" doesn't necessarily imply "trust," especially if it's shrowded behind inscruable crypto mumbo-jumbo. A voting system should be something voters and poll workers (i.e., local volunteers) can understand.
Correct. The system must be something a bottom 15 percentile person can understand and doesn’t think is magic. https://youtu.be/DUZa7qIGAdo?si=RDsgH2uIKb8k7ueG
Voting is a deeply flawed decision making process compared to deliberation. If there are too many stakeholders for direct deliberation to scale, it is better to just pick a random sample of them and have them deliberate. You can have the sample vote afterwards to get the final result if they can't come to an agreement, but then you don't need fancy tech to check or tally the votes, you just need a room.
Obviously not something that seems reasonable for government implementation, but this seems like it would be great for soliciting a specific kind of feedback about a project or business. Board elections, or product reviews from third party stakeholders, or stuff like that.
Truly auditable voting is definitely a tough enough problem that I'd never want to tackle it myself, so I'm glad this is available should I ever find a use for it!
The goal of a voting system is not verifiability, but trust. Without trust elections have no legitimacy.
Trust is a social challenge, not a technological one. It is effectively impossible to stuff ballot boxes at scale in the US, but a large number of people still believe the last presidential election was stolen.
Voting is a deeply flawed decision making process compared to deliberation. If there are too many stakeholders for direct deliberation to scale, it is better to just pick a random sample of them and have them deliberate. You can have the sample vote afterwards to get the final result if they can't come to an agreement, but then you don't need fancy tech to check or tally the votes, you just need a room.
Sure as long as I get to pick the sample.
The Belenios voting system is one of the E2E verifiable ones that allows the voter to ensure that their vote is correctly counted without submitting trust to a third party, which is necessary to prevent a corrupt election authority from deceiving and manipulating election results. However, it is also one of the underperforming ones in terms of usability. Like most of the existing E2E verifiable systems, deployability is a logistical nightmare if one wants to safeguard both privacy and resistance against sabotage.
In particular, if I understand correctly, individual verifiability is ensured through a challenge where the voter, after casting a vote to the server, has a chance to test the voting client by challenging it with revelling encryption exponent to the server, which then can decrypt the vote and show it on the screen. This one is a bit concerning in itself, as the voting client can decide to manipulate only votes cast for one candidate. Whereas checking and casting the same vote again would reveal the vote to potentially corrupt authority. Imagine explaining to ordinary voters such verifiability guarantees. There are better systems where one can get a tracking number at the end of the vote and check it with all cast votes when they are decrypted (one can look up Selene).
Another issue with the system and all existing E2E verifiable voting systems is the deployment of a threshold decryption ceremony. To recap for everyone. Before the elections, the authority manages the creation of a shared public key between multiple parties, which voters use to encrypt their votes during the vote. After the vote, all encrypted votes go through reencryption mixes or are homomorphically tallied and then finally, the votes are threshold decrypted. The challenge here is choosing the redundancy threshold of a number of all parties that need to come together to decrypt the election result. If too few come together, the election result can remain undecrypted, whereas if the hold is set too low, a small minority could collude and see how everyone has voted. Hence, securing both privacy and robustness is an expensive activity.
The website offers the service for those who don’t want to deploy the system themselves. The issue is that the voters’ privacy is handed over to the running service. There is no way to verify to what extent the parties used by the organisation are truly independent and would safeguard their vote privacy.
My biggest gripe is that theese arguments don’t land well to thoose who are acustomed to mathematical formalism of security definitions and proofs. The E2E verifiability with strong privacy guarantees can also be achieved in expoinentiation mix setting wihtout the need to threshold decryption ceremony [1, 2]. Receipt freeness is still an unresolved challenge here, but I see a path to resolve it with ideas similar to those used in Selene. Whereas if you are concerned about fairness not being distributed between multiple parties, please explain to me an attack vector there that can’t be accounted for!
[1]: https://www.usenix.org/legacy/events/evtwote11/tech/final_fi...
Voting is a deeply flawed decision making process compared to deliberation. If there are too many stakeholders for direct deliberation to scale, it is better to just pick a random sample of them and have them deliberate. You can have the sample vote afterwards to get the final result if they can't come to an agreement, but then you don't need fancy tech to check or tally the votes, you just need a room.
I know Switzerland is small but still to big to put us all in a room, also who decides who the "random sample" is? People from Cities, Land? French speaking or German? Voting is the the only provable and fair decision making, however the pre-vote-training of the voters (aka marketing, media and money) is the big problem for me.