Public SourceMage Discussion List

["Sergey A. Lipnevich" <sergey AT sourcemage.org>]

Jeremy Blosser (emrys) wrote:
> And if someone didn't sign their vote, and verification is requested, what
> does that mean?  They have to vote again, and sign it the second time?
> And what would then be the time limitation on people being able to ask for
> verification?  We would be unable to verify votes on request if the person
> who cast an unsigned vote couldn't be located to verify it.
>   
And what is the likelihood of these things happening? Don't forget that 
the email has a header and if need be, we can look at the complete trace 
to see where it's coming from and if other emails from the same person 
follow this pattern. Essentially, I'm saying "there are ways to do basic 
verification without signatures if it is necessary, but the necessity of 
this is quite unlikely."
> This would definitely require SSL protection on at least that part of the
> drupal site.  Since we can't afford a verisign cert, that also means all
> developers would need to allow a 3rd party cert or CA on their browsers,
> with appropriate verification.
>
>   
I don't trust Verisign much anyway after their recent stunts, although I 
have to kind of trust them every time I buy something online, because I 
have no choice. Self-signed certificates are appropriate for a voting 
application I think. Eric can sign the certificate so we know it can be 
trusted, and that's it. I hope he charges less than Verisign for this :-).

Authentication on the site has to be protected regardless of the voting 
issue, so it's only for the best that we do it.

Sergey.