4 ms·

ATMs are actually a pretty fruitful point of comparison since people have a good idea of how ATMs work in their heads already. Some differences in the threat mo

by zurn 11y ago

ATMs are actually a pretty fruitful point of comparison since people have a good idea of how ATMs work in their heads already. Some differences in the threat model come to mind: - ATMs and their backend systems invest heavily into making complete transaction records, voting systems must be anonymous. - ATM transactions can be undone. - ATM operators can better afford to take a reactive approach, monitoring fraud levels and first taking a liability hit, until they can fixing the systems or must do a temporary network shutdown to stop the losses. - ATMs get by with fewer controls for insider fraud due to above controls - ATMs don't worry about nation state level adversaries - Amount of damage from ATM compromise is clearly bounded, unlike legislation/election

nightcracker 11y ago
You're missing the most crucial point: ATMs provide instant tangible demonstrable feedback to the user that it has done exactly what it said it would do. The machine spits out money, and the money is not only the result of the interaction, but also the perfect witness. With voting machines, so far, there has been absolutely no provable feedback whatsoever that allows you to assure your vote has been counted. Even worse, there is no system that allows you to verify no votes have been counted that did not exist. I'm not saying these problems can't be solved with cryptography, all I'm saying is that so far, they haven't been solved/implemented yet. Voting ballots don't have the same problem.
- TeMPOraL 11y ago
  > Voting ballots don't have the same problem. How so? How do you know if your vote was really counted? How do you know someone didn't slip in a bunch of votes while you weren't looking? How do you know numbers aren't doctored as they're aggregated?
  - jimcsharp 11y ago
    Devil you know? I'm sure I'm completely wrong for some reason, but I think it's in the same line as self-driving cars and their detractors.
  - slasaus 11y ago
    > while you weren't looking Well then you don't, and another requirement is that the voting stations may be accessed by the public from start till end. In that case each individual can verify for themselves that ballot boxes are empty at the start. That no one tampers with the ballot boxes during the day, and at night when the boxes are opened and the votes are being tallied.
  - nmrm2 11y ago
    All of these questions can be answered by "you have to trust the election officials, and the election officials have to do their due diligence." Which is true of paper voting as well.
    - huxley 11y ago
      Doesn't have to be. You can have a system with multiple levels of verification. For example in Canada, each party is allowed to appoint an on-site representative for each ballot box to observe the voting process, the count (and ensure it matches the number of voters and ballot stubs) and the paperwork (a copy of which is sealed in the ballot box which can be unsealed in the event of a judicial recount). Trusting election officials doesn't have to be a passive process like it would be in an electronic voting system.
      - nmrm2 11y ago
        The US also has this; we call them poll watchers. My point was just that at some point, you have to trust that someone is paying attention. Paper doesn't magically solve that problem.
  - fluidcruft 11y ago
    With optical scanning at least, ballot stubs are linked directly to the signature book (once the stubs are separated from the ballot, matching the ballot back to the stub is extremely difficult if at all possible--perhaps by looking at fiber patterns at the perforation). At the end of the election day each site's poll workers manually count the number of signatures, the number of stubs, the number of ballots within the scanner's tub, the number of soiled or defaced ballots, the number of provisional ballots etc and numbers reported by the scanner. (whenever actual ballots are handled, at least one Democrat and Republican poll worker must be present). Tracking the number of ballots read in this situation doesn't concern me much. We also sign and post the end of day tapes printed by the scanner on the doors for the public to see. The biggest questions left really is whether the optical scanner actually reports the tally correctly. The board of elections also rescans all the ballots centrally with different machines in the weeks after the election before it is certified. I don't know the procedures for evaluating the scanners, but in theory the scanner can't tell the difference between real ballots and control ballots so some sort of randomized batch testing where the real ballots are run with control batches should be pretty straightforward. It's also true with the electronic voting booths that you can match the number of tallied votes at the end of the day against the number of signatures on the books. But I don't think there's any mechanism I'm aware of for performing an actual recount. (Yes, you can re-sum the individual machine totals, but that doesn't go back to raw responses). I personally don't trust the purely electronic voting at all yet because there's no way I know of to verify or test the accuracy of the machine. I recently moved to a different State and don't do election work anymore. Here we vote using some bullshit touchscreen using some PCMCIA card that the poll worker hands me and that I stick into the computer. Not even a paper receipt is printed. WTF. No, thanks. I think I'll just vote absentee.
pdabbadabba 11y ago
Excellent points. A few more things: 1. Voting machines are subject to the fairly unique design objective that, ideally, votes have to be verifiable while still preventing voters from proving who they voted for in order to avoid vote-buying. An ATM can just give you a receipt showing a record of the transaction. But a voting machine can't do anything so straightforward. 2. Using an ATM is part of an ongoing course of dealings between a customer and a bank, where verification is straightforward (and largely inevitable). This allows the customer to evaluate the performance and integrity of the system over time. Voting, on the other hand, tends to be an isolated event where there is no opportunity to evaluate the voting system over the long-term.

by zurn 11y ago

nightcracker 11y ago

You're missing the most crucial point: ATMs provide instant tangible demonstrable feedback to the user that it has done exactly what it said it would do. The machine spits out money, and the money is not only the result of the interaction, but also the perfect witness. With voting machines, so far, there has been absolutely no provable feedback whatsoever that allows you to assure your vote has been counted. Even worse, there is no system that allows you to verify no votes have been counted that did not exist. I'm not saying these problems can't be solved with cryptography, all I'm saying is that so far, they haven't been solved/implemented yet. Voting ballots don't have the same problem.

TeMPOraL 11y ago
> Voting ballots don't have the same problem. How so? How do you know if your vote was really counted? How do you know someone didn't slip in a bunch of votes while you weren't looking? How do you know numbers aren't doctored as they're aggregated?
- jimcsharp 11y ago
  Devil you know? I'm sure I'm completely wrong for some reason, but I think it's in the same line as self-driving cars and their detractors.
- slasaus 11y ago
  > while you weren't looking Well then you don't, and another requirement is that the voting stations may be accessed by the public from start till end. In that case each individual can verify for themselves that ballot boxes are empty at the start. That no one tampers with the ballot boxes during the day, and at night when the boxes are opened and the votes are being tallied.
- nmrm2 11y ago
  All of these questions can be answered by "you have to trust the election officials, and the election officials have to do their due diligence." Which is true of paper voting as well.
  - huxley 11y ago
    Doesn't have to be. You can have a system with multiple levels of verification. For example in Canada, each party is allowed to appoint an on-site representative for each ballot box to observe the voting process, the count (and ensure it matches the number of voters and ballot stubs) and the paperwork (a copy of which is sealed in the ballot box which can be unsealed in the event of a judicial recount). Trusting election officials doesn't have to be a passive process like it would be in an electronic voting system.
    - nmrm2 11y ago
      The US also has this; we call them poll watchers. My point was just that at some point, you have to trust that someone is paying attention. Paper doesn't magically solve that problem.
- fluidcruft 11y ago
  With optical scanning at least, ballot stubs are linked directly to the signature book (once the stubs are separated from the ballot, matching the ballot back to the stub is extremely difficult if at all possible--perhaps by looking at fiber patterns at the perforation). At the end of the election day each site's poll workers manually count the number of signatures, the number of stubs, the number of ballots within the scanner's tub, the number of soiled or defaced ballots, the number of provisional ballots etc and numbers reported by the scanner. (whenever actual ballots are handled, at least one Democrat and Republican poll worker must be present). Tracking the number of ballots read in this situation doesn't concern me much. We also sign and post the end of day tapes printed by the scanner on the doors for the public to see. The biggest questions left really is whether the optical scanner actually reports the tally correctly. The board of elections also rescans all the ballots centrally with different machines in the weeks after the election before it is certified. I don't know the procedures for evaluating the scanners, but in theory the scanner can't tell the difference between real ballots and control ballots so some sort of randomized batch testing where the real ballots are run with control batches should be pretty straightforward. It's also true with the electronic voting booths that you can match the number of tallied votes at the end of the day against the number of signatures on the books. But I don't think there's any mechanism I'm aware of for performing an actual recount. (Yes, you can re-sum the individual machine totals, but that doesn't go back to raw responses). I personally don't trust the purely electronic voting at all yet because there's no way I know of to verify or test the accuracy of the machine. I recently moved to a different State and don't do election work anymore. Here we vote using some bullshit touchscreen using some PCMCIA card that the poll worker hands me and that I stick into the computer. Not even a paper receipt is printed. WTF. No, thanks. I think I'll just vote absentee.

pdabbadabba 11y ago

Excellent points. A few more things: 1. Voting machines are subject to the fairly unique design objective that, ideally, votes have to be verifiable while still preventing voters from proving who they voted for in order to avoid vote-buying. An ATM can just give you a receipt showing a record of the transaction. But a voting machine can't do anything so straightforward. 2. Using an ATM is part of an ongoing course of dealings between a customer and a bank, where verification is straightforward (and largely inevitable). This allows the customer to evaluate the performance and integrity of the system over time. Voting, on the other hand, tends to be an isolated event where there is no opportunity to evaluate the voting system over the long-term.