Colorado scrambles to change voting-system passwords after accidental leak

In the case of Ukraine -- OSS training of partisan forces against the Wehrmacht would be an infinitely closer analogy.

The thing is, you seem to assume axiomatically that the CIA's training of stay-behind forces (a.k.a. "paramilitaries") in Ukraine after 2014 was intrinsically offensive, i.e. was done just to get up Russia's backside, for whatever nefarious purpose.

Well, I don't buy that axiom, the simple reason that after 2014 Ukraine had every right to defend itself, and creating stay-behind forces is just a standard way of doing that. Just as France, Italy, Poland, Yugoslavia, Greece and all the other countries in Europe had a perfect right to resist occupation by Nazi Germany via whatever means necessary and available to them, including the development of partisan forces.

as US CIA did with far-right paramilitaries in Ukraine.

Which "far-right paramilitaries" are you referring to? You seem to be confusing the stay-behind forces described in the article with quasi-independent militias like Azov. The two are entirely different, sharing nothing in common other than the slightly scary-sounding keyword "paramilitary" you keep latching onto.

Yet in your mind, they've fused into one and the same entity. Why is that?

It's also a war in which Russia invades a country in an attempt to bring it to the negotiating table to agree to permanently stop shelling two breakaway republics

Again, the Ukrainian regions on Putin's smash-and-grab list were never "breakaway republics" in the mold of Ossetia and Abkhazia, as has already been pointed out. There was no violent "conflict" of any kind in those regions until Putin's little green men began arriving in March 2014. There's just no analogy here. Doesn't matter how often you attempt to simply repeat it.

Nor did the 2022 invasion have anything to do with "stopping the shelling" in those regions -- that's just another talking point that people read somewhere and keep repeating and repeating, with no idea of what they're talking about, because there's simply no substance to it. In any case, it's definitely not why Putin launched the full-scale invasion.

Rather than invent fantasy scenarios that Russian orcs want to genocide all Ukrainians,

It's a fantasy scenario in your own head, because no one has ever suggested that Russia intends to "genocide all Ukrainians". That's just a straw man, with simply no substance behind it.

With that, I'm going to have to bow out, and let you figure this stuff out on your own. It's one thing to have different viewpoints about what these big awful governments and their respective agencies are up to. But we're nowhere near that kind of discussion. I just have the sense that you're extremely careless in your research, or are reading from very propagandized sources, or just not pausing to think critically about whatever stuff it is that you do read.

Not to mention, elections are the only situation where trust in my government is not fully possible: the current government has too much incentive to steal votes secretly. So, unlike the electrical grid, roads, financial infra and so on, I can't rely on implicit trust in the government to trust elections.

> If someone was able to record a signature that their voting gateway signed vote for X as vote for X, but then later that same service claimed they voted for Y, they are caught red-handed cryptographically signing with the private key two conflicting votes.

If. What if instead my voting app is showing me that my vote was correctly registered, and that key verification succeeded while the polls are still open, but once the polls close, it shows me that in reality the server registered the opposite vote? How do I prove to anyone else that I voted for X and the app was showing me I voted for X, but now the system shows I voted for Y, and that is what is recorded in the official counted results?

This doesn't even require anyone breaking the encryption: the app can just show me a lie, or some malware can intercept the display info and show a different result, etc. To not leave any trace, the malware even deletes itself from the system as soon as the election timeout expires. Or maybe I am just lying and nothing wrong happened: I voted for Y, the system recorded I voted for Y, and now I'm just trying to cast doubt. Same as a paper based election, anyone can claim anything, and it's exactly as impossible to prove one way or the other.

Plus, again, only a very very very small group of people can actually confirm for themselves that all of these complicated crypto algorithms actually do what they promise to do. Especially when looking at the end to end system. I for one am certain I couldn't verify for myself that all steps of such a system is secure. I would bet you can't either. If, say, Ron Rivest (of RSA fame) came out and said the cryptography used in the election is broken, while Adi Shamir (same) said it isn't, I would have no way to be certain which is right, and even if I tried to verify the math myself, I wouldn't trust myself as much as either of them.

With my remote voting, I can generate as many ballots as I want. If I want to make a dummy ballot that says I voted for any given candidate in order to fool someone it is easier than ever. Now instead of 1 physical ballot, I can generate multiple ballots, and do as I please with them.

In the first scenario, to answer your question, if service 1 kept being faulty (saying you vote for Bob when you voted for Alice) then you'd simply increment your nonce and try another VoteChain that starts with service 52. The VoteChain determines which 3-4 services out of the 100 are consulted, and in what order. You have a few nonces, up to 10. If you claim ALL random services you've tried are faulty, then yeah, go ahead and sit out the vote, you're probably just a liar and complainer. They don't know who you are, so the chances of them being good for 100 other people and specifically not good for you, 10 times in a row, are very small. And even if it was true, that's 1 vote out of many. Now if this happens more frequently, then these services could be dropped from the 100, pending investigation -- which is easy since the services don't know who is voting, could be the police. So why would the services risk being on the hook for this?

In all your examples, you're begging the question.

In 1 and 2 in the second scenario, you assume that your own phone AND your own laptop AND all the servers all have malware and are undetectably malicious. In that case, you have much bigger problems -- they can, for example, steal money from many people, send messages to ruin relationships and reputations, and much more. In your example, large swaths of people can't trust any of your devices. In that case, society as a whole is cooked. It's not quite as paranoid as "not trusting the cryptographic algorithms and math", but it's close.

Let's assume that the Trusted Computing Base isn't compromised. Because if it is, then you may as well also distrust all the poll workers as being corrupt, and the media as reporting the wrong result, etc. After all, this system is being added ON TOP of the existing system, so it can only ADD security.

Regarding giving out private keys without revealing them to a third party, I have already said that's a strawman. They'd be giving out tokens that are used to prove that you have 1 vote, and they are put through a mixer by the people, like pulling numbers out of a hat. On the other hand, the public/private key pairs are generated by the person on their own devices (e.g. in the secure enclave). You can't steal these keys so easily, unless you steal the person's phone AND coerce them to enter biometrics when voting. But then you could just make them do a wire transfer or anything else.

Look, about this constant refrain about "coersion, defrauding, etc" this happens already. Voter intimidation can happen already, preventing you from going to a polling place, or simply disenfranchising you making it too inconvenient or far to go. It's a much BIGGER problem now, that would be REDUCED if you could vote from your phone, and on net you'd have an improvement.

Also, since in the USA you don't need to present ID while voting, a person could tie you up in your basement and go vote as you. Since in your hypopthetical world, illegal coersion and force and defrauding has no consequences apparently, then that would mean in CURRENT voting schemes, people could just vote as others.

Heck, in Australia, I could even get someone in trouble by voting AS THEM. Their name would appear twice. In Australia, they fine you if you didn't show up to vote. So without IDs, you can get in trouble either way (if you don't show up, or if you supposedly voted twice).

I'm telling you, the same people who claim IDs are totally unnecessary for voting, are the same people trying to find attacks on cryptographically secure voting. But many of these "rubber hose attacks" are already doubly possible in today's "physical" voting schemes, along with all the other downsides (the cost, the speed, the scandals, as you can see with uncertainty in elections around the world).

30% of the USA thinks that the 2020 election results were illegitimate. You can't wave that away as "well, our paper elections are great, they're just partisan hacks/deluded". I bet you with cryptographic elections, that 30% would be far less, and elections / referendums would also be cheaper and easier to do all the time. You wouldn't need to do it once every 4 years and spend billions AND it would be more reliable.

https://www.umass.edu/political-science/

In 2, I explicitly said that it is only my devices that are infected, not the servers. My devices communicate to the servers exactly as if I had voted for Bob, but they show me that I'm voting for Alice.

In scenario 1, it could be either one. If it's my own devices that are compromised and refusing to let me vote for who I want is to add, then it doesn't matter which of the many vote services I connect to, the result will be the same. It's just a simpler variant of 2, in this case.

Also, this is all not "added on top of" the existing system, because poll workers today only need to know how to count votes. To handle this enormously complex system, they have to know a HELL of a lot more, even to help voters. So, you need entirely new people in all of this, replacing the dead simple system that even an illiterate person can successfully volunteer for, with a system that requires IT people and others.

And if you'll say "but you can always fall back to the paper polling system", that means we're adding a bunch of cost, so it makes the bar even higher to prove so much extra effectiveness for this. Plus all the insecurity now compounds - the security of a system is equal to the security of its weakest component, so adding a strong security component on a weak system has no effect. And if I'm right and the e-voting system is more easily attackable, then we've actively worsened the security of the whole vote by adding it on top of the old system.

For the "tokens" that you're giving: those are either private keys (in which case, whoever gave you the token might be holding on to a copy), or they're not (in which case, they don't play a part in the cryptography). I can generate a private key all I want, but someone needs to take the corresponding public key if I am to participate in the system. With Bitcoin, this is not an issue as we're not trying to enforce one man - one wallet, quite the opposite.

In all the talk about the intimidation issues with the current system, you've ignored the core difference: in the current system, I may be able to dissuade you from voting, but I can't vote in your stead. Even if I try to, I am generating video evidence at every polling station that I do it. And it doesn't scale: the more places I go to, the bigger a chance that I'll end up being caught.

But with home voting, I can collect private keys (and tokens, whatever those are) from 100k people and vote through all of them however I like. I am not going anywhere official, so at worse I have to hide my IP so it's not like too many votes are coming from a single place.

I'll be fair and note that this is also a problem for mail-in voting. It's a big reason why I'm not a supporter of mail-in voting either, and am happy that my country doesn't do it. By the way, the fact that the USA doesn't require ID to vote also seems crazy to me. I understand the reasons for it, but the fixes are so simple (but take a lot of time) that it's amazing to me that they are not even discussing implementing them.

And related to distrust in the current voting system, particularly in regards to the 2020 and the 2000 elections: most of the distrust was actually focused on (a) voting machines [hanging chads in 2000, "Venezuelan" voting machines in 2020], or (b) voter registration issues. Moving to an entirely electronic system as you describe makes (a) MUCH worse, and doesn't improve (b) in the slightest (as you still need to register just the same).