<br><br><div class="gmail_quote">2012/2/23 Jameson Quinn <span dir="ltr"><<a href="mailto:jameson.quinn@gmail.com">jameson.quinn@gmail.com</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<font color="#222222" face="arial, sans-serif"><br></font><br><div class="gmail_quote"><div class="im">2012/2/22 Kathy Dopp <span dir="ltr"><<a href="mailto:kathy.dopp@gmail.com" target="_blank">kathy.dopp@gmail.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Below is a quote from Ben Adida, creator of Helios.<br>
<br>
We now have documented evidence ...that viruses like Stuxnet that<br>
corrupt nuclear power plants by spreading from one Windows machine to<br>
the other have been built. And so if you run a very large scale<br>
election for a president of a G8 country, why wouldn’t we see a<br>
similar scenario? Certainly, it’s worth just as much money; it’s worth<br>
just as much strategically. . . . All the verifiability doesn’t change<br>
the fact that a client side corruption in my browser can flip my vote<br>
even before it’s encrypted, and if we . . . must have a lot of voters<br>
verify their process, I think we’re going to lose, because most voters<br>
don’t quite do that yet.<br>
<br>
- Adida, Ben. 2011. Panelist remarks – Internet voting panel.<br>
EVT/WOTE’11, the Electronic Voting Tech. Workshop / Workshop on<br>
Trustworthy Elections. Aug. 9, 2011. URL <a href="http://www.usenix" target="_blank">http://www.usenix</a>.<br>
org/events/evtwote11/stream/benaloh_panel/index.html.<br>
<br>
The above quote on Helios was sent to me from Barbara Simons,<br>
coauthor, with another computer scientists Doug Jones of an upcoming<br>
very well-researched and well-written book: "Broken Ballots: Will Your<br>
Vote Count?" The book will be published by April 15th approx.<br>
<br>
<br><br></blockquote></div>Yes, I said that: "<span>It is insecure against trojans on the voter's machine at the time of the initial vote, ... </span><span>not something I'd trust for public elections....</span><span>"</span></div>
<div class="gmail_quote"><div><font color="#222222" face="arial, sans-serif"><br></font></div><div><font color="#222222" face="arial, sans-serif">This actually is not an insurmountable difficulty. There are two ways you could face it:</font></div>
<div><font color="#222222" face="arial, sans-serif"><br></font></div><div><font color="#222222" face="arial, sans-serif">1. Still using the voter's home machine, you could combine the cryptography with captchas: the voter would have to match a picture next to the candidate with a list of pictures in different order in order to rate/rank that candidate. However, this is inconvenient, and to make it secure you would need time limits. It also does nothing to address the digital divide. This latter issue, not security, is the reason I find this solution unacceptable for political elections.</font></div>
<div><font color="#222222" face="arial, sans-serif"><br></font></div><div><font color="#222222" face="arial, sans-serif">2. You could use secure machines, booted from CD with no hard drive, at polling stations.</font></div>
</div></blockquote><div><br></div><div>Of course, if you're using polling stations anyway, you should be printing hand-marked or at least voter-verified paper ballots and giving cryptographically-verifiable receipts. That is to say, even if you can build a context where Helios is 100% secure (less than one flaw expected in the age of the known universe), there is no good reason not to add other reasons for people to trust the result. The goal of an election is not just to BE secure, but to APPEAR secure, even to people who don't understand or trust mathematical and computational security measures.</div>
<div><br></div><div>Jameson</div><div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="gmail_quote">
<div><font color="#222222" face="arial, sans-serif"><br></font></div><div><font color="#222222" face="arial, sans-serif">But yes, I explicitly stated that helios as-is is NOT secure enough to use for a high-stakes election with more than around 10K voters.</font></div>
<span class="HOEnZb"><font color="#888888">
<div><font color="#222222" face="arial, sans-serif"><br></font></div><div><span style="color:rgb(34,34,34);font-family:arial,sans-serif">Jameson</span> </div></font></span></div>
</blockquote></div><br>