Hacker News Reader

Why do you need a blockchain if you trust the local election operation? And if you don't trust the local election operation, I have terrible news for you; they are still the legal authority. Citizens are already able to verify their mail/absentee ballot online, today, without a blockchain [1].

I do agree with you that the US needs to adopt something like Estonia's national ID system [2], with cryptographic signing capabilities for official purposes, but this should only (for elections) be used to digitally sign your paper ballot (with similar weight that your hand signature on a paper ballot would carry). We should also encourage mail/absentee ballots for everyone in every state.

[1] https://www.pcmag.com/how-to/how-to-track-your-absentee-ball... (How to Track Your Absentee Ballot by State)

[2] https://en.wikipedia.org/wiki/Estonian_identity_card

Not every state has tracking... at a glimpse Florida doesn't.

I think the best option is everyone has an issued id, don't remember it? You can use your SSN or state id (drivers license), the # is mailed to you when you register/re-register or get your ballot.

You can vote as you normally would, you can setup 2-factor methods on your id's. If you have a phone 2-factor set, the minute your vote is tallied you get notified of the result, if it's not what you chose, you can contest it.

Easy one-click-at-all-times access to voting trail, also uniformity, we need a system like this to be uniform, we need to end 50 states with different rules per county on how things are run.

> (How to Track Your Absentee Ballot by State)

I went to look at this. It operates on the honor system; what purpose is it supposed to serve?

An actual ballot-tracking system would need to provide me some evidence that they knew something about my ballot. This doesn't.

Well, blockchain, mostly because it is simply a cryptographic way to confirm that data has not been tampered with and easily validate against other copies. If you simply make a database public, then it requires a bit more energy to validate copies. It would also require that anyone who wants to validate it has a complete copy of their own. Whereas with blockchain, you can merely take down a single hash at a certain timestamp and easily verify that hash later.

>After voting, you could also give every voter a "receipt" where they could go online and check in the public blockchain to confirm that their vote was counted successfully.

The problem with verifiable voting has always been that it opens the market to vote-selling. If you can prove how you voted, your vote can be sold for a significant amount of money -- or worse, your employer insisting you vote a certain way, and asking for your receipt after. This won't work until there's a mechanism where you can confirm your vote while also having plausible deniability.

Or, more likely, vote blackmail.

I think you mean extortion. Blackmail is more specific, and implies a threat to reveal a secret.

For example, an employer who threatens to fire employees who "vote wrong" would not be blackmail.

You simply wouldn't identify the person making the vote. You are assigned a random identifier that is actually publicly available. So if I vote and give you my identifier to prove how I voted, you have no way of verifying if I am giving you my actual receipt or just some other receipt from the publicly accessible register of voters. The only way to truly validate the vote would be to match the receipt id with the internally held ballot that has your pii on it.

Then how do you prove x% of the voters for candidate A weren't just given the same identifier? This'd defeat the purpose of being able to verify your vote in the first place, something unique to you has to be in the record too.

Point is, you can verify your -own- vote only because you have the identifier that was given you. You can also see all the other votes and their identifiers, you just can't tell which people made which vote. Only the individual voter knows.

i.e. I can go look online and knowing that I am voter abc123, I can confirm my vote was counted correctly. I can also see vote def456 but I don't know who it belongs to.

Say we have 5 people voting. I know that 4/5 are going to vote for candidate A, but I don't like that, so I publish:

    abc - A
    def - A
    ghi - B
    jkl - B
    mno - B

Then I simply give all the people who voted for A either abc or def. They all think they're identifying themselves, when really they're sharing identifiers.

I think coercion is the biggest issue with online electronic voting. In paper ballot format it's illegal to have someone else in the booth with you, but if everyone votes from home, there's no way to guarantee that the person voting doesn't do it some obligation.

I think you're missing a few things: Votes should never be identifiable and the count should be verifiable.

First of all: using somewhat public things like SSN, "numbers in your street address" and a credit card number is a terrible idea. All of those have been leaked and are present on things you present to identify yourself or pay. Also requiring a credit card or home to vote would almost certainly be unconstitutional.

Getting a "receipt" is also problematic: You should never be able to prove you voted A over B or vice versa since that opens up ways to intimidate people to vote one way and coerce them to prove it.

I'm not saying it's impossible but there are so many problems with electronic voting that I don't even know where to start. At least with physical ballots we can manually recount if we need.

And that's before we even start talking about how current systems are basically swiss cheese for hacks, just look at the voting village for the last couple of defcons.

Related (and amusing) links:

https://www.youtube.com/watch?v=w3_0x6oaDmI

https://www.youtube.com/watch?v=LkH2r-sNjQs

https://xkcd.com/2030/

The ballot itself could be a zk-SNARK written to a blockchain signed with a private key owned by the voter.

Sorry, I'm not well versed enough in zk-SNARK, can you explain how it solves the problems above?

If it does do you think that you can make the general public trust/understand it enough to run a election?

Sorry can't reply to your reply but... Making the ballot a zk-SNARK[0] would allow it to be queried for validity of certain assertions like "Did this ballot contain a vote for Candidate A or Proposition B" without leaking the identity of the voter. The voter's private key could decrypt the entire ballot perhaps for the voter's verification or even as another verifiable assertion that the ballot was signed with the specific key. Perhaps there would be a key provided by the voting authority body as another verifiable assertion that would allow the voting authority body to verify the user for their purposes if required.

I agree that the more difficult part of this would be encouraging adoption and supporting use. There are hardware keys like yubikeys or hardware crypto wallets that can be populated with voter-generated keys to be used in the voting process, and these hardware keys could be populated in a process similar to getting a driver's license perhaps, except not waiting for it to arrive in the mail. Perhaps you go into your local clerk's office and they have a one-time key generator that populates your hardware key. I definitely haven't fleshed this idea out beyond some basic musings.

[0]https://z.cash/technology/zksnarks/

Doesn't that still allow for vote-selling and vote extortion? Like if my employer threatens to fire me unless I vote a certain way, they'll accept me giving them my receipt saying I voted the way they wanted. Now, they can't prove that the receipt actually belonged to me, but it's certainly harder to procure someone else's receipt (from someone who voted the way the employer wanted).

Watching these links is really recommended if you don't yet see the issue with e-voting.

PS: Well at least the first two, third one being the mandatory xkcd meta-reference :D

>Getting a "receipt" is also problematic: You should never be able to prove you voted A over B or vice versa since that opens up ways to intimidate people to vote one way and coerce them to prove it.

Your receipt does not have to mention who you voted for in a way that's verifiable by a third party. But this problem is also a problem for mail-in ballots.

>using somewhat public things like SSN, "numbers in your street address" and a credit card number is a terrible idea.

Agreed, this does not mean that it is not feasible. You could use some zero-knowledge based proof that ensure that the person is allowed to vote and has voted only once without knowing his identity. Mail-in ballots are also problematic in that regard.

I dislike that people say evoting is a bad idea when we already have things like mail in ballots which are analogous to a poor e voting system.

>Also requiring a credit card or home to vote would almost certainly be unconstitutional.

But don't you need a registered address to vote?

> But don't you need a registered address to vote?

I'm not 100% sure here but I thought homeless could vote?

> mail in ballots which are analogous to a poor e voting system.

I think it is mostly about scale. It is hard to impersonate 10000 people it requires physical objects, it is easier if it is digital. One of the videos deals with this, timecode here: https://youtu.be/LkH2r-sNjQs?t=140

That timestamp is talking about physical voting. I'd posit it's easier to impersonate 10k mail in ballots of the same state than (let's say) crack 10k private keys or whatever is used for that system. I agree though that a new system will bring about exploits vectors that are unknown, but I'm not convinced they are as bad as what is implied in that video and this thread.

I'm not talking about using SSN or other identifiers to validate voter identity, that would already be done at the polls or however we currently validate mail in ballots (should be something better than forensic signature comparison, though).

The identifiers would simply be used so that the individual could check and validate that their vote was counted and counted correctly. But perhaps those identifiers wouldn't be necessary since you could simply assign a random uuid after the person votes that they can then use to look up.

Electronic voting changes the threat model which opens the door for large scale voting fraud which is impossible with the current system.

Also in the US you don’t have a single election, you have 50 individual elections all with different ballots and different rules, the federal government doesn’t run the elections in each state. This means that you’ll have 50 different systems. There is little that technology can do with a system that already provides transparency by having a physical hard copy of each vote cast and allowing essentially any citizen to become an observer.

Can’t blockchains be manipulated by whoever has more computers?

Yes, but only if you are relying on a distributed system. You can still have a centrally controlled blockchain. And the blockchain would simply allow anyone to easily verify data integrity.

The usual response to this is that it enables vote buying.

However, vote buying literally stopped being an issue the day it started being prosecuted seriously and never came back. You simply can't do it at meaningful scale without getting caught.

>You simply can't do it at meaningful scale without getting caught.

Why not? Just run a Tor site, where users can submit their receipt/verification and get crypto. "Free money" will spread fast with barely any marketing, and as we've seen from voter turnouts, lots of people don't give a shit and will happily sell their vote to the highest bidder.

And what's to stop the feds setting up 10 competing sites and then fining everybody who sold their votes 10x the amount they were hoping to get?

Which of the 11 tor sites will you submit your receipt to now?