Polls where nobody can tell who voted for what #26

New Issue

2026-09-12T00:45:27Z

paulhitt commented

2026-09-12 00:45:27 +00:00

(Migrated from gitlab.com)

A poll where nobody can tell who voted for what. Not hidden in the interface the way WhatsApp does it, where the server and the poll's creator still know. Anonymous because individual votes exist nowhere.

Why this is hard here, stated up front

Group messages are encrypted to each member separately, so the recipient of any envelope knows who sent it. Simply sending "I voted B" to the group is not anonymous, and neither is sending it to the poll's creator.

The approach that does work is secure aggregation. Each voter splits their vote into random shares, one per member, so that the shares sum to the vote and no single share reveals anything. Every member adds up the shares they received and publishes only that sum. Adding the published sums gives the tally. No individual vote was ever sent to anybody.

Rules this encodes

Never claim anonymity the maths does not provide. Every member other than the voter would have to collude to recover one vote. That is the actual guarantee and it is what the interface should say.
Members who are offline break the sum. The poll either waits for everyone, or falls back to a poll that is hidden rather than anonymous, and the interface says plainly which of the two it is. A fallback that quietly keeps the word "anonymous" is the one outcome that must not ship.
Group size limits are worth setting deliberately: the share traffic grows with the square of the membership.

Worth deciding before building

Whether the first version requires every member present, which is honest and simple, or supports dropouts with a quorum and a restated guarantee.
Whether the creator can close a poll early, and what the tally means when they do.

Pairs with flamenet-messenger-ios#76.

A poll where nobody can tell who voted for what. Not hidden in the interface the way WhatsApp does it, where the server and the poll's creator still know. Anonymous because individual votes exist nowhere. ## Why this is hard here, stated up front Group messages are encrypted to each member separately, so the recipient of any envelope knows who sent it. Simply sending "I voted B" to the group is not anonymous, and neither is sending it to the poll's creator. The approach that does work is secure aggregation. Each voter splits their vote into random shares, one per member, so that the shares sum to the vote and no single share reveals anything. Every member adds up the shares they received and publishes only that sum. Adding the published sums gives the tally. No individual vote was ever sent to anybody. ## Rules this encodes - **Never claim anonymity the maths does not provide.** Every member other than the voter would have to collude to recover one vote. That is the actual guarantee and it is what the interface should say. - Members who are offline break the sum. The poll either waits for everyone, or falls back to a poll that is hidden rather than anonymous, and the interface says plainly which of the two it is. A fallback that quietly keeps the word "anonymous" is the one outcome that must not ship. - Group size limits are worth setting deliberately: the share traffic grows with the square of the membership. ## Worth deciding before building - Whether the first version requires every member present, which is honest and simple, or supports dropouts with a quorum and a restated guarantee. - Whether the creator can close a poll early, and what the tally means when they do. Pairs with flamenet-messenger-ios#76.

paulhitt commented

2026-09-12 00:45:28 +00:00

(Migrated from gitlab.com)

changed the description

paulhitt commented

2026-09-12 02:11:52 +00:00

(Migrated from gitlab.com)

Chosen as the next feature, 2026-09-11. Notes before it is built.

The guarantee, stated first. Every member other than the voter would have to collude to recover one vote. That is what secure aggregation gives, it is not the same as "nobody can ever know", and the interface must say the true thing rather than the shorter one.

Why the obvious approaches do not work here. Group messages are encrypted to each member separately, so whoever receives an envelope knows who sent it. Sending "I voted B" to the group is not anonymous, and neither is sending it to whoever created the poll.

The shape that does work. Each voter splits a vote into random shares, one per member, summing to the vote. Every member adds up the shares they received and publishes only that sum. Adding the published sums gives the tally, and no individual vote was ever sent to anybody.

What breaks it, and what to do about it. A member who is offline leaves a share missing and the sums do not add up. Two honest options: wait for everyone, or fall back to a poll that is hidden rather than anonymous. Whichever ships, the interface says which of the two it is. A fallback that keeps the word "anonymous" is the one outcome that must not ship.

Worth deciding before building: whether the first version requires every member present, which is simple and honest, and what the tally means if the creator closes a poll early. Share traffic grows with the square of the membership, so a group-size limit is a deliberate choice rather than an oversight.

Chosen as the next feature, 2026-09-11. Notes before it is built. **The guarantee, stated first.** Every member other than the voter would have to collude to recover one vote. That is what secure aggregation gives, it is not the same as "nobody can ever know", and the interface must say the true thing rather than the shorter one. **Why the obvious approaches do not work here.** Group messages are encrypted to each member separately, so whoever receives an envelope knows who sent it. Sending "I voted B" to the group is not anonymous, and neither is sending it to whoever created the poll. **The shape that does work.** Each voter splits a vote into random shares, one per member, summing to the vote. Every member adds up the shares they received and publishes only that sum. Adding the published sums gives the tally, and no individual vote was ever sent to anybody. **What breaks it, and what to do about it.** A member who is offline leaves a share missing and the sums do not add up. Two honest options: wait for everyone, or fall back to a poll that is hidden rather than anonymous. Whichever ships, the interface says which of the two it is. A fallback that keeps the word "anonymous" is the one outcome that must not ship. **Worth deciding before building:** whether the first version requires every member present, which is simple and honest, and what the tally means if the creator closes a poll early. Share traffic grows with the square of the membership, so a group-size limit is a deliberate choice rather than an oversight.

paulhitt commented

2026-09-12 02:16:55 +00:00

(Migrated from gitlab.com)

mentioned in merge request !131

paulhitt commented

2026-09-12 02:21:14 +00:00

(Migrated from gitlab.com)

mentioned in merge request !132

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: extant2000/flamenet-messenger-android#26