Hacker News
points by theluketaylor 3 days ago | 0 comments
There is absolutely no way to guarantee the process of detaching the outer ballot from the inner one doesn't retain a link to the voter. There are problems on 2 levels: the math proofs behind cryptography involved (which is being worked on, but not currently solved) and the building a verifiable implementation that honours all the requirements in a provable way. That's currently easier, but fails hard on the public trust front due to the overwhelming complexity.

Moving mail ballots to email is not currently possible or even very viable.

[–] Spivak 2 days ago
Well yeah the poll worker could just write the voter's name on the inner envelope but that isn't a deal breaker. There's no need for math proofs or whatever nonsense. The cryptography is just to provide a light barrier to the poll worker who's being observed detaching the two things just the same as mail in ballots like the glue on the inner envelope. It doesn't need to be verifiable or perfectly secure because again mail in ballots aren't. Someone could steam the glue off, look at the ballot, and reseal it (or replace it entirely) but that doesn't happen because they're being observed.

The point of this exercise isn't to say we actually do email in voting but to demonstrate that you can absolutely build a system that's exactly as understandable and trustworthy as the mail in ballot system but digital because it is the mail in ballot system just s/USPS/a series of tubes.

[–] theluketaylor 2 days ago
The poll worker executing mail in ballots can be completely observed without any special skills or tools.

Even a fully trustworthy poll worker executing an email workflow can’t be fully observed. The code they are running can betray the vote.

XKCD 2030 remains fully accurate. Electric voting: run away.

[–] Spivak 2 days ago
I get wanting to be wary of bespoke voting software but in this hypothetical it's a human watching the screen of a boring Windows workstation provided by the state's IT department as the poll worker uses Microsoft Outlook and puts ballots in a folder. At what point is the threat vector remote enough with these devices we're fine trusting literally everything else in our lives to that it's paranoia rather than a legitimate threat? I mean even if you are that paranoid let anyone who cares analyze the machine afterward I guess. And in this system recounts are trivial, you still have all the original data.
[–] theluketaylor 1 day ago
No where else needs the level of anonymity that voting does, in fact in nearly all other cases we want strong identity authentication, authorization, and accountability throughout when conducting official business.

If you can tie people to their vote you can intimidate them or purchase votes, both very bad outcomes for a democratic process. A secret ballot is a core element of a strong, stable democracy. That's a rare attribute to value to the same extent, so no technology platform has really been built with that in mind. There is plenty of active research underway to make it possible, but as it stands old fashioned paper ballots, whether done in person or by mail, have some unbeatable properties.