Re: [belenios-discuss] Revisiting voter authentication

["HOUART Gerald" <Gerald.Houart AT ulb.be>]

Hi Stephane

We are using CAS for authentication in most of our elections but your 
suggestion seems fine.
Another useful advantage will be that the e-mail with validation code will be 
sent only to real voters and not to everyone.

Best
Gerald 

Le 20/04/21 11:44, « belenios-discuss-request AT inria.fr au nom de Stéphane 
Glondu » <belenios-discuss-request AT inria.fr au nom de 
stephane.glondu AT inria.fr> a écrit :

    Hello,

    Currently, when one selects passwords for voter authentication (which is
    most of the time), each voter receives two similar-looking e-mails: one
    with the credential and one with a password. This has been reported as
    confusing. Moreover, it is difficult to explain that the password can be
    regenerated, but not the credential (which play different roles in the
    protocol).

    Therefore, I've been thinking on a new system that would confuse people
    less while retaining interesting security properties. What I came up
    with is a radical change in user experience, so I'm writing this message
    to gather feedback from the community.

    In this new system, the voter receives a single e-mail prior to the
    election, the one with the credential. This e-mail is sent by the
    credential authority. When the election is open, the voter enters
    his/her credential, and votes as usual... but when it is time to
    authenticate, he/she would just enter his/her username, and wait for an
    e-mail sent by our server with a validation code that the voter would
    enter in the web interface in order to continue.

    The new system has been implemented in the development branch. You can
    test it on the beta instance:

      
https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fbelenios.loria.fr%2Fbeta%2Fadmin&amp;data=04%7C01%7Cgerald.houart%40ulb.be%7C8853f615b951434ec0f508d903e0e539%7C30a5145e75bd4212bb028ff9c0ea4ae9%7C0%7C0%7C637545086716899183%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&amp;sdata=XTxB52pVYxRSt%2BdCT3PHk4dvSZjhKkhS6qFJ02YWxZI%3D&amp;reserved=0

    When creating an election, in the first screen, select "email (imported
    from server)" as authentication mechanism. Be aware that this instance
    is... beta! (i.e. do not use it for actual elections!)

    We are considering removing altogether the password-based authentication
    for voters, because we do not see any more benefit in it. It would
    survive a few more releases, and still be activable with configuration
    but not enabled on our main instance... unless someone has a compelling
    reason for keeping it.

    By the way, this plan does not remove the possibility to authenticate
    voters with CAS (or OpenID Connect in the development branch), in which
    case no e-mail is sent in the authentication phase.


    Cheers,

    -- 
    Stéphane