Colorado scrambles to change voting-system passwords after accidental leak

> accompanied by competent, autonomous civil services. That’s not something America has.

That's a bold claim. The federal system can be incompetent and isn't autonomous. But lower level local ones tend to be especially if far away from politically contentious topics until you get to counties that are really small. Representative elections are both about accountability and about representation so I don't have to worry about minutia. As long as rules are followed and you have systems that remove influence peddling (not so much appointments as above-board job interviews with many candidates), then you can let failing to follow such rules be a scandal that takes out the politician that tried to corrupt the system.

Just to be clear - even though I say “Merkle Tree”, I am not saying the unhashed votes themselves would not be stored in it. The hashes are just to quickly verify integrity of the underlying data leaves (the actual votes people cast).

The anonymity is done between registration and voting. There is a cryptographic mixer like Tornado Cash that is responsible for the unlinkability, by “tumbling” the tokens to anonymize them while still making sure that each person voting legitimately had registered. (Never mind for a moment that the IP address of the voter can be tied to their address, that can be fixed too.)

So yes, ALL the votes are stored and published in the Merkle tree, and ANYONE can challenge the election, not by hearsay allegations but actual PROOF that anyone can verify. Because the public keys of the UX vendors are published along with the Merkle Tree and are caught red-handed signing conflicting votes. Either the corrupt districts or the UX vendors would have to risk literally ANYONE producing a smoking gun. It is that chilling effect that keeps them all honest, and why we have checksums for things in general. Having everyone in the world see proof of fraud is very different than a bunch of villagers claiming to a journalist locally that they hadn’t even voted.

So given this description, tell me directly — doesn’t it ADD a lot of security and reduce the attack surface and make elections standardized, cheaper and far more trustworthy - don’t you see the value in that?

Think about it — this scheme alone allows some great integrity features for elections. The “election Luddites” are essentially claiming that this has ZERO VALUE and shouldn’t even be tried, shouldn’t even be ADDED TO the existing paper systems even if you lost nothing, because it adds NO SECURITY. That is quite a claim given the properties I listed!

More generally, this is how Smart Contracts work and why they are valuable. Thousands of independently run nodes get to check the data and operations, which are public. The entire community benefits, and in fact the results of voting (eg how much UBI to give out) can be used on-chain. By lowering the cost of collective decision-making, blockchain technology enables a whole new level of efficiency (much like red lights enable better traffic flow), making things like elections or large marketplaces available to everyone without “offchain” corruption-peone mechanisms like surety bonds and reliability ratings (remember Lehman Brothers?)

Check out https://intercoin.org/applications — I would love to hear your thoughts on the other applications too.

There's far less incentive to actually pay bribes or hurt specific people if there's no reliable proof of the vote. Even with people taking a photo of a ballot, one can still just strike that ballot and vote again after taking a photo. It's an immense risk that will likely not do you any good, because there's no way to actually know those people voted. The people you're paying and who voted for you would have likely voted for you anyways and you're just otherwise paying people to not bother voting at all or voting against you, while you face immense risk.

If the gangster is just going to hurt a random sampling of people anyways, you might as well just vote however you want to vote. They may or may not commit violence against you regardless of how you vote, its completely disconnected. If you know they can validate it, you're probably going to be less brave.

Just put yourself in those two situations. One where the ballot is absolutely secret, and one where it can be trivially looked up. Someone says you better vote for X or I'll hurt you. You really don't want to vote for X. In the first instance, do you vote for X? In the second, do you still vote for X knowing the thug will be able to know for sure how you voted?

I'm not suggesting nobody would do an illegal thing, obviously I acknowledge people would do illegal things. I'm just pointing to that as why taking a photo of a ballot is illegal in many areas.

> There is a cryptographic mixer like Tornado Cash that is responsible for the unlinkability, by “tumbling” the tokens to anonymize them while still making sure that each person voting legitimately had registered.

This is not anonymity, it is pseudonimity, if the system then records "person in control of key K voted for X". Sure, it may be impossible to tell who is that person, unless they come out. But that person can prove to anyone they want that they voted for X (assuming the system were trusted, see more on that below), so they can be forced to show someone who they voted for, either through direct coercion or as a condition for receiving money for their vote. In contrast, once you put a paper ballot in the urn, it is impossible for anyone to tell who you voted for.

> So given this description, tell me directly — doesn’t it ADD a lot of security and reduce the attack surface and make elections standardized, cheaper and far more trustworthy - don’t you see the value in that?

No, it only gives a false sense of security, which is worse. Everything you are describing relies on trust in the people that build these systems, trust in the people that invent the algorithms, trust in the people that invent the maths, trust in the chosen parameters of the cryptographic systems, and so on. Literally none of what you are describing works if you don't trust in all of these people to be (a) honest, and (b) really really good at what they're doing.

It's infamously easy to screw up an encryption implementation, even given a well known and accepted algorithm. It's even easier to screw up a market system and end up with perverse incentives which were not apparent when the system was put in place (like the infamous, though possibly apocryphal, cobra farms).

I asked you before as well: would you be happy to issue your vote from a PC that you know is infested with malware the CIA/FSB/etc controls? If not, then you must admit that the cryptographic guarantees are only a small part of the security of the process, and the whole thing, from client to network to server, needs to be perfectly secure or the election can be stolen.

And you are proposing to add this to a paper based ballot system that is (a) dead simple; (b) almost universally used; (c) proven secure enough in many thousands of elections.

I'll also note that, as always, the blockchain part is not adding anything to all of this. You can just as well have the encryption guarantees and an open protocol with government-run servers, WWW style; that would have all the same problems, but at least it wouldn't also require some bizarre proof-of-stake (what would even be the stake here???) or wasteful proof-of-work scheme to depend on for security.

Finally, I'll come back to this point:

> not by hearsay allegations but actual PROOF that anyone can verify

Nothing you are describing can prove anything. It all still relies on your claim that you were trying to vote X, but the system registered you as voting Y. It's your word against the system. You can be convinced yourself, but you can't 100% convince anyone else.

Edit: note, I am the same person as tsimiones, just posting from a different account from my work computer; not trying to make it seem like multiple people are taking my position or anything like that.

Look, I don't know who you are or what has led you to this position, but it's worth I think giving an appeal a chance. You are being tricked and manipulated for someone else's political gain. I know it sucks to hear and every human's response to shut down the thoughts, because admitting to yourself that you've been had is an uncomfortable thought. But I'm asking you to at least entertain the possibility.

We talk a lot on HN about people's beliefs being a reflection of the systems they're placed under— you show me the incentives I'll show you the outcome— and the incentives are clear as day. Democratic voters have two nice properties that are being exploited, Democrats are generally concentrated in major metro areas, and Democrats vote early and by mail. Being concentrated makes those counties easy targets for lawsuits hoping to tie up the process with vague nothingness and rule-lawyering to try and turn away voters. Attacking mail in voting very cleanly affects almost entirely Democrats. And pre-undermining the election results act as a hedge to explain away a loss. Because this is a must-win election for Trump's GOP, two losses in a two risks pushing the "MAGA" faction of the party into irrelevancy.

And so that's what you see, it's a narrative that has been pushed hard designed specifically to carry out the exploit. It's genuinely clever and once it reaches critical mass the people who are tricked into actually believing it outnumber the original concern-trolls so it's naturally self-perpetuating.

So look, I have no expectation that you'll change your stance, I just hope at least that if you really bought into it that going forward you'll at least do it on purpose and be in on the game.