Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Estonia's e-residency program expands abroad

e-estonia.com

Post reply on HN
Print view View original

51–59 of 59 posts

Re: Estonia's e-residency program expands abroad

#51

Post by salvadors »

polymatter wrote: post #43
salvadors wrote: post #32

Earlier quoted context omitted.

The Estonian voting system already allows you to verify your vote from a second device for a short time period. This certainly doesn't protect against all attacks (and it's only one part of the security system) — but it _does_ help against the threat of a virus that invisibly intercepts your vote to turn it into something different. If people started reporting that their phone showed a different vote to what they tho…

But it also means that a virus that intercepts your PIN and your ID card can log in an hour later and vote for someone different. You then would have no way of knowing.

As I said, this particular approach isn't a solution to every potential problem.

However, I'm much less concerned with this threat than with the much simpler virus that simply changes your vote in real time.

Most people I know don't leave their ID card connected at all time; so the virus would need to wait for the next opportune moment, rather than silently casting this vote whilst you're not at my computer — thus significantly increasing the chances that at least some people would notice it. If it also had to load the voting software again to send the vote (I don't know enough about the protocols around this to know if it would have to or not), then it would be even more likely that some people would notice.

And on top of that, don't forget that the ID-card software shows on launch how many times you've digitally signed things. Most people almost certainly don't pay much attention to that number, but I'm sure some people would notice it rising unexpectedly from the virus, and an investigation could happen.

Re: Estonia's e-residency program expands abroad

#52

Post by salvadors »

polymatter wrote: post #42
coretx wrote: post #21

Earlier quoted context omitted.

The Estonian E-voting system is incredibly broken by design as you can see in this CCC lecture: https://www.youtube.com/watch?v=JY_pHvhE4os ( by J. Alex Halderman )

That was a very interesting video but I think you misrepresent it slightly. Its clear the Estonian E-voting system was designed very very well in comparison to the ridiculously bad Diabold machines of yesteryear. The problem was that the current state-of-the-art hasn't advanced enough to make major fraud at least as hard as the paper ballot. And that means that e-voting makes it plausible for state actors to dictate…

> anything less than perfect is broken

Why?

Even without getting into complex election fraud, parties in many countries already know how to buy votes in a paper-ballot system: you simply offer a bottle of vodka for a cell-phone photo of the ballot marked the way you want.

And even without that, there's a much simpler calculation in play in Estonia. Keskerakond (the party closely allied with Putin's party), only got 7.7% of the e-votes in the most recent election: the demographics of online voters has very little overlap with their supporters. If only the paper-based votes were counted, Keskerakond would have won the election.

Sure, they'd still have the complication of actually forming a government; but it's much more likely they'd be able to do that with a first-place showing (and possibly without Savisaar).

With those sorts of numbers, if I were a Keskerakond strategist, I'd be doing everything I possibly could to discredit e-voting too. And the more "useful idiots" I could find, who'll merrily interfere in the elections a country they know very little about because it suits their own ideals, the better.

Re: Estonia's e-residency program expands abroad

#53

Post by ptaipale »

krick wrote: post #46
ptaipale wrote: post #24

Earlier quoted context omitted.

People in Baltics disagree with that. "Russian President Vladimir Putin was a "real and present danger" to Estonia, Latvia and Lithuania and NATO was getting ready to repel any aggression, British Defence Secretary Michael Fallon said." [0] "Michael Fallon, the British defense secretary, warned that there is a real and present danger that Russian President Vladimir Putin will launch a campaign of undercover attacks t…

You mean "some mass-media claims people in Baltics disagree with that". I don't really want to interfere with all that information war of yours, but as a Baltic citizen I feel almost offended by generalizations like that. Most people I know (including myself) would strongly claim this is bullshit, and have ironically-scornful attitude towards journalists and politicians spreading all that hysteria you are referring t…

There are at least enough Estonians who agree to elect a president who clearly does see a potential Russian threat.

Of course there are Baltic citizens who are not worried by Russia. There are hundreds of thousands of Baltic citizens who are ethnic Russians and do not want to be anything else, after all. And most people they know will be similar to themselves of course, because people on both sides of this ethnic divide live in ethnic bubbles. (Yes, again a generalization that does not apply to each and every person.)

But I would claim that a majority of Baltic citizens, particularly people of ethnically Baltic origin, are worried about Russia (and ethnic Russian minorities are not). At least that's what the election results look like.

Re: Estonia's e-residency program expands abroad

#54

Post by krick »

ptaipale wrote: post #53
krick wrote: post #46

Earlier quoted context omitted.

You mean "some mass-media claims people in Baltics disagree with that". I don't really want to interfere with all that information war of yours, but as a Baltic citizen I feel almost offended by generalizations like that. Most people I know (including myself) would strongly claim this is bullshit, and have ironically-scornful attitude towards journalists and politicians spreading all that hysteria you are referring t…

There are at least enough Estonians who agree to elect a president who clearly does see a potential Russian threat. Of course there are Baltic citizens who are not worried by Russia. There are hundreds of thousands of Baltic citizens who are ethnic Russians and do not want to be anything else, after all. And most people they know will be similar to themselves of course, because people on both sides of this ethnic div…

What I'm gonna say is pretty harsh, but, you see, for a long time (almost as long, as I remember myself at all) I have a feeling that election results don't matter. Not because "majority makes a wrong choice", no. There's just no choice. Either you go in politics yourself or you say "fuck them" and try to make living being affected by all these guys on TV as less as possible. No difference what they say. What they will do when elected is of no use anyway. Where I live (Latvia) I remember 1 somewhat useful president and 0 useful premier ministers. For me they are just like weather or something: they are just there, I don't really pray God to protect me from bad weather, I build a house that will.

In fact, I've seen politicians who are making their image as pro-russian and ultra-anti-russian perfectly hanging out "after work" together, so I don't believe in their play a tiniest bit. Nor do all the rational people I know, of both russian and latvian origin. It's kinda obvious that this theater is oriented towards not-so-educated aggressive minorities in order to gather votes. Normal people just don't care. In fact, we don't care so much that jokes about "wish these effing russians would leave Latvia already!" are perfectly fine amongst our russian friends (which actually surprised me at first, because some 15 years ago people were a bit more radical here). I'm just tired of all this "latvian/russian" thing, I don't really understand what "nationality" or "origin" is anyways. The only "international matter"-thing that bothers me where I live is NATO-soldiers playing war on one of our polygons: you cannot imagine how much noise these bastards make!

Of course I don't really know how things are in Estonia as I don't live there all the time, but impression I've got from visiting and communicating with people who do live there isn't really much worse.

Re: Estonia's e-residency program expands abroad

#55

Post by ottodv »

jkaljundi wrote: post #38
coretx wrote: post #10

The Estonian system is incredibly insecure. Not only because of legal and procedural errors, but also because of technical issues. Some references: https://jhalderm.com/pub/papers/ivoting-ccs14.pdf ( Lookup the ID-card part. ) http://www.wassenaar.org/ ( Crypto is defined as a "dual use" weapon. ) The worst aspect of the estonian ID-card is simply the fact that your private key is not private, and stored in the card…

Rather read http://estonianworld.com/security/attacks-estonias-e-voting-... and https://www.ria.ee/e-voting-is-too-secure/

Two sources with absolutely no pro-Estonian bias.

Re: Estonia's e-residency program expands abroad

#56

Post by polymatter »

salvadors wrote: post #52
polymatter wrote: post #42

Earlier quoted context omitted.

That was a very interesting video but I think you misrepresent it slightly. Its clear the Estonian E-voting system was designed very very well in comparison to the ridiculously bad Diabold machines of yesteryear. The problem was that the current state-of-the-art hasn't advanced enough to make major fraud at least as hard as the paper ballot. And that means that e-voting makes it plausible for state actors to dictate…

> anything less than perfect is broken Why? Even without getting into complex election fraud, parties in many countries already know how to buy votes in a paper-ballot system: you simply offer a bottle of vodka for a cell-phone photo of the ballot marked the way you want. And even without that, there's a much simpler calculation in play in Estonia. Keskerakond (the party closely allied with Putin's party), only got 7…

> you simply offer a bottle of vodka for a cell-phone photo of the ballot marked the way you want

you have to keep tens of thousands of people quiet for that to work without any suspicion at all. with e-voting you can commit major fraud without anyone noticing and with much much less evidence trail.

Re: Estonia's e-residency program expands abroad

#57

Post by salvadors »

polymatter wrote: post #56
salvadors wrote: post #52

Earlier quoted context omitted.

> anything less than perfect is broken Why? Even without getting into complex election fraud, parties in many countries already know how to buy votes in a paper-ballot system: you simply offer a bottle of vodka for a cell-phone photo of the ballot marked the way you want. And even without that, there's a much simpler calculation in play in Estonia. Keskerakond (the party closely allied with Putin's party), only got 7…

> you simply offer a bottle of vodka for a cell-phone photo of the ballot marked the way you want you have to keep tens of thousands of people quiet for that to work without any suspicion at all. with e-voting you can commit major fraud without anyone noticing and with much much less evidence trail.

Who said anything about keeping it quiet? Are you doubting that this already happens?

Re: Estonia's e-residency program expands abroad

#58

Post by kaspa130 »

fyi, how to apply: 1.april Estonia opened foreign embassies where you can give paper application. But from May Estonia opens online application where you can pay by credit card. And once you got accepted then you need to physically go and collect the card from your chosen foreign embassy. everything here https://e-estonia.com/e-residents/about/

Why one should? yes, access to EU market, access to good services (google, paypal, soon stripe etc), access to e-banking, and generally digital signature gives hassle-free business environment (signing contracts with partners, filling e-tax declarations, administrating business on a business portal).

Why Estonia is doing it - to increase its economic reach / gain more customers / PR

Re: Estonia's e-residency program expands abroad

#59

Post by Buetol »

aianus wrote: post #20
Buetol wrote: post #15

I thought of a simple solution to the verifiability problem, what do you think ? - When voting, each voter receive a receipt with a random number assigned to his vote - All the votes are published with the random numbers alongside them - Each voter can verify that his vote was correctly saved by looking at his assigned number in the list It's not perfect but relying on a central server is far worse I think (like the…

Unfortunately this enables someone to coerce or bribe you into voting for a certain candidate, since the coercer would be able to demand to see your receipt and verify you complied. Here's a rather long but very interesting tech talk about electronic voting schemes which maintain the secret ballot property: https://www.youtube.com/watch?v=ZDnShu5V99s

Thanks, I looked a bit at the Helios voting system and thought it was a complicated mess but this video explains everything really well!
Post reply on HN