Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Estonian E-Voting Source Code Made Public

news.err.ee

Post reply on HN
Print view View original

111–120 of 144 posts

Re: Estonian E-Voting Source Code Made Public

#111

Post by ReidZB »

dchest wrote: post #62
josephlord wrote: post #25

Earlier quoted context omitted.

That in itself is a problem because the ability for the voter to prove who they voted for opens them to coercion or bribery. Although doing it online (or by post) opens that risk anyway.

Can verify != can prove to a third party

This is a critical distinction. As a concrete example, here's how voting worked in a scheme I once read about. On any one ballot, the order of candidates was randomized. Then the way the scheme worked was that after voting, the voter tore off the candidate positions (but not their vote) and threw it away in a huge pile of them, burned it, or whatever. (Made it so that someone couldn't come behind them and figure out their position list, essentially.)

Later, after the votes were tallied, the voter could verify that their ballot was (1) counted and (2) counted towards their chosen candidate. But crucially, all they could verify was that the vote counted towards position 1, or position 2, or position 3, ...

The point is that since the voter couldn't prove to a coercing party that the position they voted for was (or was not) the candidate the coercer wanted them to vote for, they were immune to coercion. They could prove that they voted for position 2, sure. But which candidate was at position 2?

The voter knows the truth because they saw the position list. However, until we have mind-reading technology, a coercing party could only take the voter's word.

Re: Estonian E-Voting Source Code Made Public

#112

Post by abecedarius »

josephlord wrote: post #2

How does a voter or independent voter know that the code that has been verified is actually running on the machine that they connect to? You have to trust the sys admins. And as we all know: something is trusted if it can break your security policy.

You can do a lot better than the usual practice: http://zesty.ca/pubs/yee-phd.pdf

"I examine the question of how to design election-related software, with particular attention to the threat of insider attacks, and propose the goal of simplifying the software in electronic voting machines. I apply a technique called prerendering to reduce the security-critical, voting-specific software by a factor of 10 to 100 while supporting similar or better usability and accessibility, compared to today’s voting machines. Smaller and simpler software generally contributes to easier verification and higher confidence.

"I demonstrate and validate the prerendering approach by presenting Pvote, a vote-entry program that allows a high degree of freedom in the design of the user interface and supports synchronized audio and video, touchscreen input, and input devices for people with disabilities. Despite all its capabilities, Pvote is just 460 lines of Python code; thus, it directly addresses the conflict between flexibility and reliability that underlies much of the current controversy over electronic voting. A security review of Pvote found no bugs in the Pvote code and yielded lessons on the practice of adversarial code review. The analysis and design methods I used, including the prerendering technique, are also applicable to other high-assurance software."

(No, it doesn't solve all of your problem.)

Re: Estonian E-Voting Source Code Made Public

#113

Post by thinkmoore »

There has been significant work in the academic community about electronic voting schemes. For example, Civitas (http://www.cs.cornell.edu/Projects/civitas/) is a voting system developed by researches at Cornell that provides universal verifiability, voter verifiability, anonymity, and coercion resistance. It is also implemented in a security-typed programming language, which provides additional guarantees about the correctness of its implementation.

Re: Estonian E-Voting Source Code Made Public

#114

Post by betterunix »

josephlord wrote: post #2

How does a voter or independent voter know that the code that has been verified is actually running on the machine that they connect to? You have to trust the sys admins. And as we all know: something is trusted if it can break your security policy.

"How does a voter or independent voter know that the code that has been verified is actually running on the machine that they connect to?"

You know, there is a technical solution to that problem:

https://en.wikipedia.org/wiki/Verifiable_computing

Re: Estonian E-Voting Source Code Made Public

#115

Post by skrebbel »

glesica wrote: post #99
skrebbel wrote: post #81

Earlier quoted context omitted.

Indeed, and so it's uncool and crappier than Python? How is that related? The OP clearly used the term "enterprise" with a negative connotation. I doubt he was referring to a brand name.

I suspect the implication was that being written in Python makes the code more accessible to "normal" people, both to read and (perhaps to an even greater extent) to run. If it were written on .NET one would likely (because Mono is incomplete) need a Windows server to run the code. If it was written using Java there is a decent chance it would require some pretty complex configuration and possibly a license of some s…

Thanks for taking a guess.

Actually though, it's rather difficult to run into Mono incompleteness when making a web app these days. Mono's mostly lacking Windows-specific stuff like WPF (UI-framework). Used to lack Entity Framework but that's solved since MS open sourced that. You can take an existing ASP.NET app and there's a very high chance you can just build it with xbuild and host it with Mono's xsp server.

More generally, I do see your point but I believe it's a little outdated; the time that Java apps just had to be built on 200k lines of XML is long gone as well.

It's obviously a matter of taste, but I find it difficult to accept that well-written Python would be easier to read than well-written C#. C# is more verbose in places and less verbose in others. Writing crap code is about as easy in both.

Re: Estonian E-Voting Source Code Made Public

#116

Post by josephlord »

dchest wrote: post #62
josephlord wrote: post #25

Earlier quoted context omitted.

That in itself is a problem because the ability for the voter to prove who they voted for opens them to coercion or bribery. Although doing it online (or by post) opens that risk anyway.

Can verify != can prove to a third party

Then if it isn't recorded properly how can you show that an election has been rigged?

Re: Estonian E-Voting Source Code Made Public

#117

Post by ams6110 »

oellegaard wrote: post #36

This seems like a good contract to the typical (american-inspired) secrecy around governmental systems. I would also like to believe open source makes software more secure, but I'm not sure if there is any research that confirms it. Oh, and cool its made in python and not some enterprise java or .NET :)

I would also like to believe open source makes software more secure

I would think in general that it does, but you also would have to be certain that the software actually running on the official voting system is the same as the "open source" version. I think that's a tough one.

Re: Estonian E-Voting Source Code Made Public

#118

Post by ams6110 »

ReidZB wrote: post #111
dchest wrote: post #62

Earlier quoted context omitted.

Can verify != can prove to a third party

This is a critical distinction. As a concrete example, here's how voting worked in a scheme I once read about. On any one ballot, the order of candidates was randomized. Then the way the scheme worked was that after voting, the voter tore off the candidate positions (but not their vote) and threw it away in a huge pile of them, burned it, or whatever. (Made it so that someone couldn't come behind them and figure out…

I'm not following how the counting is done. If all the counter has is a ballot with position 2 checked and the corresponding candidate name torn off, how does that vote get tallied to the proper candidate?

Re: Estonian E-Voting Source Code Made Public

#119

Post by ams6110 »

orf wrote: post #60
oneandoneis2 wrote: post #56

Earlier quoted context omitted.

Actually, E-voting could revolutionalize politics. Right now, we have to have presidents, prime ministers, even kings; making all the big decisions for us because that was the only practical way. E-voting makes it possible for the population to be consulted on any major decision. This, IMHO, is the reason it's so unpopular amongst politicians. Right now in the UK, for instance, MPs get to vote on their own salary inc…

Consulting everyone on every major decision isn't the best way to make decisions (who says the majority is right?). Most people wouldn't understand the issues they are voting on and would be heavily swayed by the media.

Most politicians don't understand the issues they are voting on and are heavily swayed by the media (and other high-power organizations).

Re: Estonian E-Voting Source Code Made Public

#120

Post by sirclueless »

skrebbel wrote: post #115
glesica wrote: post #99

Earlier quoted context omitted.

I suspect the implication was that being written in Python makes the code more accessible to "normal" people, both to read and (perhaps to an even greater extent) to run. If it were written on .NET one would likely (because Mono is incomplete) need a Windows server to run the code. If it was written using Java there is a decent chance it would require some pretty complex configuration and possibly a license of some s…

Thanks for taking a guess. Actually though, it's rather difficult to run into Mono incompleteness when making a web app these days. Mono's mostly lacking Windows-specific stuff like WPF (UI-framework). Used to lack Entity Framework but that's solved since MS open sourced that. You can take an existing ASP.NET app and there's a very high chance you can just build it with xbuild and host it with Mono's xsp server. More…

Are there really places where C# is less verbose by any significant margin? The only thing I can think of is that a well-written LINQ library lets you abstract away a tremendous amount of heavy lifting into a clean and declarative query, but other than that pretty much everything requires more keywords, punctuation and declaration in C#.

Don't get me wrong, C# is relatively explicit and regular, which does wonders for its readability especially in large projects with many collaborators. But brevity is not one of its strong suits, nor should it be.

Post reply on HN