How The Swiss Post E-Voting System Addresses Client-Side Vulnerabilities

There has been a lot of talk about E-voting. But the trouble with most such systems proposed is that they tend to have weaknesses allowing the voting system to be subverted. Switzerland is one of those places that has implemented a system that seems to address the most common weaknesses. This article <https://freedom-to-tinker.com/2022/06/29/how-the-swiss-post-e-voting-system-addresses-client-side-vulnerabilities/>, part of a series on E-voting systems, gives an overview of how it works. Each voter is sent a piece of paper through the mail. This has a unique code on it that they use to initiate the online voting process. It also contains a series of codes associated with each possible response from the voting system (calculated from the voter-specific code). So as the voter enters their choice, they can verify that the code shown is the correct one for that choice. So even if the voting app, or the browser, or the user’s PC has been compromised, the attacker still cannot know what the codes are -- those are only known to the central voting system, and disclosed only to that voter. Any attempt to fake the voter’s selection will cause a code mismatch that should raise alarm bells. So the voting system is not entirely paperless: basically, nobody knows how to create a secure, yet completely paperless, voting system. Which is not to say the system is completely foolproof: the next instalment promises to reveal some issues with the scheme.
participants (1)
-
Lawrence D'Oliveiro