Hacker Newsnew | past | comments | ask | show | jobs | submit | raron's commentslogin

This. A voting system and it security must be understandable to the average people. You can not do that with electronic voting. (Even if electronic voting can be done securely.)

Okay, average person uses a special key picked up from the DMV one time that allows them to login to vote.com and cast their vote. This is a totally normal experience and understandable by anyone who has done online banking.

It doesn't provide anonymity, which is a critical requirement for any (public) election system. It also doesn't provide security, as someone who can control the servers behind vote.com, can change anyone's vote.

Why?

One of the main goals of an electoral system is to ensure that the population trusts that their views are fairly represented.

The reason that paper voting is so good in this regard is that everybody can fully understand the entire process. It is so very, very simple. And if you need proof, you can go see the counting for yourself.

The issue with electronic voting is that there is far greater complexity. There are many valid reasons that someone could distrust it, for example:

- You might not trust the cryptography experts that claim the algorithms are secure.

- You might not trust the algorithms to be implemented correctly.

- You might not trust the computer manufacturer to have designed a secure machine.

- You might not trust the computer manufacturer to have built a defect-free machine.

- You might not trust the machine hasn't been compromised by some bad actor.

- You might not trust that there hasn't been some random bit-flips.

- You might just not understand how computers work.

- ect. ect.

Note that it is not important whether it can be proved to be correct and secure. The unique goal here is that everyone can prove to themselves that it is correct and secure. It must be obvious to everyone that they can trust it.

In my opinion, this is not possible to achieve with an electronic system.


Some counter-arguments:

- We already trust computers to run our markets, banks, cars, energy infrastructure, etc. Is a computer popularly untrustworthy?

- Do low-tech physical ballot systems offer good guarantees? See 2024 Russian elections [0], for an extreme counter-example.

I'd say cryptography or smart algorithms can go a long way in upholding certain invariants, but you need some infrastructure for that: e.g. key pairs per voter and a trustless counting system. If you can't get that, then you're relying on the good will of others: in some cases it's the volunteer counters, in others it's whoever deploys and operates the trust-based black box e-voting system. I think that cryptocurrencies alone should be proof to anyone observant that a trustless voting system is doable, though I'm honestly surprised by this thread, because it alludes to the opposite.

[0] https://www.lemonde.fr/en/international/article/2024/03/20/t...


> The reason that paper voting is so good in this regard is that everybody can fully understand the entire process. It is so very, very simple. And if you need proof, you can go see the counting for yourself.

I volunteered as a scrutineer for a major Canadian political party as a teenager. You show up and watch the electionworkers open the ballot box and count the ballots. The ballots were counted fairly although some people couldn't tick the boxes correctly.

It's unclear how such a system would work in the United States, though, because you've merged all elections into a single voting day. If people struggle with ticking a single box from 5 options I can't imagine what a multipage ballot binder would be.


>One of the main goals of an electoral system is to ensure that the population trusts that their views are fairly represented.

Do you trust the system now enough to say your views are fairly represented (looking at the war and ... all the other things) ?


Those exceptions are so vague that you can interpret anything into them.

How "free" is your freedom of speech or expression if everything can be an exception?


The age verification proposal of the EU tries to do that, the government knows you used age verification (and I think the rough number of times you used it), but they don't know when or where you used it.

https://ageverification.dev/av-doc-technical-specification/d...


I can't imagine countries with such strict speech laws, for example, would be willing to build a system that is technically incapable of linking the person visiting a sire and the site requesting verification.

This proposal may have been updated since I read it previously, so I could be wrong now, but it didn't read as a true zero-knowledge proof as key steps in the flow still required a level of trusting the government as the central authority to do the right thing and not track requests, both today and in the future.


Seems like anywhere in the EU, something draconian only needs to be popular for like 5 years for it to get implemented, for better or for worse. They don't have robust constitutions like the US.

I wish the US constitution was robust, or at least could be held to such robustness today. As it stands congress has ceded much of their power to the executive branch and the public is barely represented when rules/regulations/laws are passed.

Have you heard of the PATRIOT Act?

It's a proposal, so you can check out how it would work.

Anonymous age verification is technically possible, but it is as pointless as any other age verification system, it could easily be circumvented if someone older willing to help.

Probably there is a reason why nobody uses it.

https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...


> I can't imagine

That's admirably honest, but the contents of your mind don't necessarily correspond to the world outside it.


How so?

Though not quite the EU anymore, the UK arrests people based only on speech in a social media post. Why should I expect they would be interested in building a truly private, zero knowledge age verification system?

Maybe for a more direct example I could point to the discussions related to the EU wanting direct access to all private messages, pushing Signal to leave the EU if that were to pass?


I think they arrested (or just fined?) someone for calling to burn down a hotel with migrants. For you this is an oppressive dictatorship, but it doesn’t match reality.

It also has no bearing on willingness to implement proof of age without additional disclosure.

But yeah not EU, one country in Europe is unlike another, etc.


I don't know the specific case you're referring to, though that's far from the only fine or arrest in the UK related to social media posts.

https://www.thetimes.com/uk/crime/article/police-make-30-arr...


This is paywalled. What were the posts?

They are arguably over policing because of vague laws and proactive enforcement. Most cases don’t lead to convictions. But all cases I’ve ever seen were for something bad like calling for violence, making fun of someone’s death. For free speech absolutists this is unacceptable, but it’s not arbitrary tyranny.

The EU has more freedom of speech than the US, the US has just a different way of punishment.

It’s much easier in the US to lose your job for what you say as in the EU and in the US the consequences of losing your job are more severe if you don’t have enough money so you can afford to lose it.

US freedom of speech comes with a price tag that puts the censor inside your brain.


This is really an example of "formal rights and material conditions."

You make a case that EU has better social safety nets and employee protection not that the US has weaker free speech laws. While you can't ignore the effect having wealth can insulate you from consequences, it still doesn't support your statement as written.

Is it true that someone who is retired on a pension in US can say more hateful things without government action vs a similar retiree in EU?


And in the eu you go to jail for criticing politicians. I guess it's really all the same, eh?

You surely can provide a source.

But even prisoners get healthcare in the EU, so I guess some US citizens would even prefer a EU jail over dying in the US.

Given the recent deaths of two actors and their GoFundMes I can’t imagine the hassle of less fortunate people when they get hit by US medical bills.

The US are one step away from a show like the Running Man shows


In which countries?


The EU passing a law about the internet? What could possibly go wrong?

Please drink verification can to verify that you have verified your cookie preferences

Wero doesn't add any value over standard SEPA transfers, I don't see why does it even exists. PayPal at least has some customer protection scheme.


It's instant and much simpler than logging into your bank. Many EU countries already have their own alternatives like swish and vipps. Can pay with just knowing the phone number, scan qr code, even quite common in stores. No fee at all for private use, small merchants just need an app, no additional hardware.


This is true for the official SEPA Instant Transfer and the standard EPC QR code format, too.

https://en.wikipedia.org/wiki/EPC_QR_code


Jolla mishandled the funds they got for the tablets, it went bankrupt and bought up by a company connected to the Russian state. Jolla lied a lot during these events and tried to hide what happened, and I don't think that's an acceptable thing to do when the main selling point of your product is privacy and trust. AFAIK they recently got bankrupted again and bought by the original owners, but it's hard to rebuild trust.



> well, a concerted attack could easily subvert the baseband

In theory Pixel phones have IOMMU and GrapheneOS is using them, so even a compromised baseband doesn't result unrestricted access to the system.


I don't think this is about the current situation in the US.

Big US tech companies are infamous for not following the EU's data protection rules, and they wouldn't even able to, because some US regulations (I think PRISM, FISA and others) are incompatible with the requirements of EU GDPR. This dates back at lest to Snowden leaks and the invalidation of EU-US data protection agreements by Schrems judgments.

https://en.wikipedia.org/wiki/Max_Schrems#Complaints_with_th...


> The major advantage is now that the expensive and time-consuming part of provisioning a new mobile service (sending out a physical SIM card)

I don't know, choosing service package, signing paperwork, identifying and other KYC stuff (tens of minutes) for me was always much more time-consuming than the few seconds of reading the barcode(?) from a new SIM card and giving it to the customer (or putting it into an automatically addressed envelope).

I can't see any advantage of eSIMs except that it makes harder to change providers what they of course really like.

(Anyways the security of the whole PTSN is a joke and publications about cracking cell networks, why SIM cards are even a thing? I would suspect an customer-id@service-provider.country and a password would work, too. Maybe with a zero-knowledge password proof.)


> I can't see any advantage of eSIMs

They are incredibly handy when you are traveling abroad, you don't speak the local language fluently, you want cheap data, you don't want to study 100 different prepaid plans from 10 different local primary and MVNO carriers to figure out the best offer, you don't want to wait for the shops to open because your flight landed late at night, and you don't want to scan your passport and send it to the carrier for verification and wait for hours for approval (yes, in many countries, KYC is required even for prepaid SIMs). I've lived that experience and I can't say I miss it.


Yeah, basically people here think that their experience is the only experience there is with phones. I wager not that many people are actually physically going to stores in many markets anymore like this commenter, and definitely next to nobody is switching their SIM cards literally every month like a sibling commenter is doing, but for people like me who live and travel abroad, eSIMs have been great.


shoutout to airalo for the esim experience on travelling. A great marketplace. Great choices. I can book an esim from home country and activate the esim on arrival at the destination when over wifi.


Really? I live in Japan, eSIMs made it very easy for me to switch carriers 3 times when I was shopping. Just had to click the “agree” checkbox in the ts and cs for each carrier when I switched, provide the transfer code (which is always in an easy to find place in their management dashboards), and then plug that into the form when signing up for the new carrier. Then my butt did not have to budge from my couch as the eSIM was provisioned and my old service was cancelled automatically. Definitely beat schlepping it to the physical stores of each carrier in ye olde times.


> atomic clock time signal that (was/is?) broadcast nationwide

Probably DCF77 or WWVB.

> I think the actual antenna and hardware were relatively large since it's a long wave signal

Casio has some normal sized wristwatches that synchronizes to DCF77, it would definitely fit into a stove, microwave, or basically anything.


I believe it was a longwave broadcast so probably WWVB which would apparently imply a 60mm antenna, but it was a standard old school "GE digital clock radio" form factor so size wasn't at a premium.


> clock sync for civilians has never been easier

I don't think civilian clock synchronization was an issue since a long time ago.

DCF77 and WWVB has been around for more than 50 years. You could use some cheap electronics and get well below millisecond accuracy. GPS has been fully operational for 30 years, but it needs more expensive device.

I suspect you could even get below 1 sec accuracy using a watch with a hacking movement and listening to radio broadcast of time beeps / pips.


Both of the WWVB clocks I've owned have been very fickle about how they're placed because RF be that way sometimes, and Colorado isn't exactly nearby to my location in Ohio.

The first manufactured GPS clock I owned (as in: switch it on and time is shown on a dedicated display) was in a 2007 Honda.

But a firmware bug ruined that clock: https://didhondafixtheclocks.com/

And even after it began displaying the right time again, it had the wrong date. It was offset by years and years, which was OK-ish, but also by several months.

Having the date offset by months caused the HVAC to behave in strange incurable ways because it expected the sun to be in positions where it was not.

But NTP? NTP has never been fickle for me, even in the intermittently-connected dialup days I experienced ~30 years ago: If I can get to the network occasionally, then I can connect to a few NTP servers and keep a local clock reasonably-accurate.

NTP has been resolutely awesome for me.


The WWVB clocks are around the AM band, which means they carry a great distance despite their lower transmission power, but only at nighttime. Ohio is nothing; the signal needs to make it to the southern reaches of Florida.


Yeah, I "know" how it is supposed to work. I "knew" that back then when I bought my first WWVB-receiving clock, too.

And the placement was still fickle.

It's simple to observe:

A) Purchase and install clock. Wait (days). Observe failure to chooch.

B) Move clock. Wait (hours). Observe correct operation.

My world is ultimately bounded by reality, not theory: When it works in one position but not another, then that's the only reality I have to work with.


On the one hand, some sloppy GPS units fail on a 20 year schedule. On the other hand, a bunch of things using NTP are going to fail in about ten years. (2036 rather than 2038 because reasons)


Yeah, good point.

If I ever get the chance, I'll try to remember to tell the 1995 version of me to watch out for that pesky overflow bug that they might experience with NTP -- two score and 1 year in their future.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: