[IFWP] Voter authentication

1999-07-19 Thread Joop Teernstra
Kent Krispin wrote: More concretely: The auditors come, examine the code, certify it, and leave. A *different* program starts up the minute they walk out the door, a program derived from the certified one, and that as far as the external network connection to the rest of the world behaves

Re: [IFWP] Voter authentication

1999-07-19 Thread Kent Crispin
On Mon, Jul 19, 1999 at 09:40:04PM +1200, Joop Teernstra wrote: [...] Kent, expertise in Network security does not translate in expertise in political manipulations with real human beings, ballot stuffing, vote buying and other forms of electoral cheating that generally comes from the top

Re: [IFWP] Voter authentication

1999-07-19 Thread Weisberg
Kent Crispin wrote: Assuming that there is no question about the authenticity of the voters, the voting website could be duplicated , or even triplicated at several trusted third-party locations. That's a good idea. Right now the IDNO voting software is *not* being run by a trusted

Re: [IFWP] Voter authentication

1999-07-19 Thread Mark C. Langston
On 19 July 1999, Weisberg [EMAIL PROTECTED] wrote: Kent Crispin wrote: Assuming that there is no question about the authenticity of the voters, the voting website could be duplicated , or even triplicated at several trusted third-party locations. That's a good idea. Right now the

RE: [IFWP] Voter authentication

1999-07-19 Thread R . Gaetano
Mark Langston wrote: On 19 July 1999, Weisberg [EMAIL PROTECTED] wrote: Kent Crispin wrote: That's a good idea. Right now the IDNO voting software is *not* being run by a trusted third party at all -- it is being run by a partisan to the debates. Please expand upon these two

Re: [IFWP] Voter authentication

1999-07-19 Thread Mark C. Langston
On 19 July 1999, [EMAIL PROTECTED] wrote: The problem is that we were talking of the vote at IDNO as an example for the electronic vote for the elections of the ICANN Board. Maybe I should not, but I personally tend to care less about how an election in a working group is held, and more on how

Re: [IFWP] Voter authentication

1999-07-19 Thread Kent Crispin
On Mon, Jul 19, 1999 at 10:33:50AM -0500, Weisberg wrote: Kent Crispin wrote: Assuming that there is no question about the authenticity of the voters, the voting website could be duplicated , or even triplicated at several trusted third-party locations. That's a good idea. Right

Re: [IFWP] Voter authentication

1999-07-19 Thread Michael Froomkin - U.Miami School of Law
Kent Crispin suggests that (1) he doesn't know/trust the groups I am likely to know/trust; (2) many fourth and fifth parties have trust metrics that have no overlap with either of us, and implies (3) that only a group with total or at least enormously wide pre-existing trust can be a TTP in this

Re: [IFWP] Voter authentication

1999-07-19 Thread Eric Weisberg
Please let me join this exchange. [EMAIL PROTECTED] wrote: The problem is that we were talking of the vote at IDNO as an example for the electronic vote for the elections of the ICANN Board. Maybe I should not, but I personally tend to care less about how an election in a working group is

Re: [IFWP] Voter authentication

1999-07-19 Thread Kent Crispin
On Sun, Jul 18, 1999 at 07:16:28PM -0700, Mark C. Langston wrote: [...] So forget it. The election operator can run any code whatsoever, and you have no way of preventing it unless you watch him all the time, and even there you can't *really* prevent it. Crypto is basically irrelevant to

Re: [IFWP] Voter authentication

1999-07-19 Thread Mark C. Langston
On 19 July 1999, Kent Crispin [EMAIL PROTECTED] wrote: On Sun, Jul 18, 1999 at 07:16:28PM -0700, Mark C. Langston wrote: [...] This is a little far-fetched Kent. First of all, it does NOT happen "ALL THE TIME, IN THE REAL WORLD." And if you'd like to debate this particular point, feel

Re: [IFWP] Voter authentication

1999-07-19 Thread Kent Crispin
On Mon, Jul 19, 1999 at 12:28:17PM -0700, Mark C. Langston wrote: I'm sure you are. But I don't want to waste *your* time. C'mon, Kent. Waste some of my time. That was my polite way of saying that I don't want to waste *my* time. Clearly, I have already wasted too much. :-) -- Kent

Re: [IFWP] Voter authentication

1999-07-19 Thread Kent Crispin
On Mon, Jul 19, 1999 at 01:39:54PM -0400, Michael Froomkin - U.Miami School of Law wrote: Kent Crispin suggests that (1) he doesn't know/trust the groups I am likely to know/trust; (2) many fourth and fifth parties have trust metrics that have no overlap with either of us, and implies (3)

Re: [IFWP] Voter authentication

1999-07-19 Thread Weisberg
K. Crispen wrote: ...I vastly prefer solutions that don't depend on trusted third parties to begin with. How do you think we should do it?

Re: [IFWP] Voter authentication

1999-07-19 Thread Kent Crispin
On Mon, Jul 19, 1999 at 10:42:15PM -0500, Weisberg wrote: K. Crispen wrote: ...I vastly prefer solutions that don't depend on trusted third parties to begin with. How do you think we should do it? We should use open roll-call voting, as I have described several times. -- Kent Crispin

Re: [IFWP] Voter authentication

1999-07-19 Thread Weisberg
Kent Crispin wrote: We should use open roll-call voting, as I have described several times. Please elaborate.

Re: [IFWP] Voter authentication

1999-07-19 Thread Kent Crispin
On Mon, Jul 19, 1999 at 01:39:54PM -0400, Michael Froomkin - U.Miami School of Law wrote: Kent Crispin suggests that (1) he doesn't know/trust the groups I am likely to know/trust; (2) many fourth and fifth parties have trust metrics that have no overlap with either of us, and implies (3)

Re: [IFWP] Voter authentication

1999-07-18 Thread Kent Crispin
On Sun, Jul 18, 1999 at 02:23:50PM -0400, Michael Froomkin - U.Miami School of Law wrote: Now, crypto happens to be something I know a little about ( http://www.law.miami.edu/~froomkin/#crypto ) Very impressive. However, crypto and network security are two very different, though related

Re: [IFWP] Voter authentication

1999-07-18 Thread Michael Froomkin - U.Miami School of Law
To make a long story short: 1) I did indeed understand you to be worried about something other than what you describe below. 2) If one were to decide to be worried about the problem you describe below, the simplest solution, as you note, is to have the code running on the trusted third party's

Re: [IFWP] Voter authentication

1999-07-18 Thread Mark C. Langston
On 18 July 1999, Kent Crispin [EMAIL PROTECTED] wrote: In any case, proving that the code offered to the referee is the same as the running code is trivially easy: you compile it, and hash the two programs, and bit-compare them, or compare hashes. (Of course you have to use the exact same