5 ms·

This is an established ID verification process that is used by banks, financial institutions, etc... (assuming they integrated with a vendor, look at someone li

This is an established ID verification process that is used by banks, financial institutions, etc... (assuming they integrated with a vendor, look at someone like Jumio). Not speaking to anything else related to this at all, it does sound like they are quite a fly by night operation based on everything that is being dug up. However, the technology mentioned above is not something they came up with themselves, and in fact see wide spread use for purposes of fraud prevention for financial systems (which sees active attacks against verification tools). Its not as easy to fool as you are making it seem.

bduerst 8y ago
I don't think photo ID is really the worst attack vector for Voatz. It appears they're storing credentials in the code and are lying about their security audits. This tweet chain is pretty interesting: https://twitter.com/GossiTheDog/status/1026868106528993280 https://twitter.com/GossiTheDog/status/1026868106528993280
- deleted 8y ago
  [deleted]
- ypzhang2 8y ago
  yeah, i'm not speaking to their other claims or security practices, which by all accounts appear terrifying. Given apparently whats happening, who even knows if they have actually integrated with a vendor or not. I'm just speaking about the technology as described. Its not a novel id verification method, plenty of other companies use it and there are multiple vendors / providers of the service.
forapurpose 8y ago
> technology mentioned above is ... in fact see wide spread use for purposes of fraud prevention for financial systems Different organizations have different security needs Financial systems can use the relative cost of a security measure compared to the cost of a breach to decide whether to implement the security; they consciously accept a certain level of failures. Also, they can use insurance to mitigate exploits after they happen. Voting systems cannot tolerate failures, at least in theory. Every vote must count. Also, at least for some elections, the value to the attacker is much higher than what can be gained from financial institutions; a foreign intelligence service has much more to gain than money from controlling a US presidential election, for example, and an investor could make billions by knowing the outcome ahead of time. Finally, there is no mitigation after a breach: Insurance won't save a fraudulent election.
- ypzhang2 8y ago
  Sure, whether the ID verification tool in question is appropriate or enough of a mitigation for election purposes is arguable. In fact it could very well be that no electronic verification process would be enough, since as you say, every vote can potentially be crucial and therefore ANY margin of risk might be unacceptable. The point I am making is that its not as simple as described to "spoof" this tool, and to give some background on its usage since it seemed to be a novel verification tool for the OP
  - forapurpose 8y ago
    I meant to add to your point, not disagree with it. Sorry if I gave the wrong impression. > every vote can potentially be crucial I'll also add that every vote is important because the number of votes is important. Winning 70-30 will get much different behavior than winning 50.01-49.99; the latter representative had better pay attention to the 49.99's needs. And that can matter down to the smallest geographical levels - if everyone in your neighborhood votes, politicians will pay much more attention.

bduerst 8y ago

I don't think photo ID is really the worst attack vector for Voatz. It appears they're storing credentials in the code and are lying about their security audits. This tweet chain is pretty interesting: https://twitter.com/GossiTheDog/status/1026868106528993280 https://twitter.com/GossiTheDog/status/1026868106528993280

deleted 8y ago
[deleted]
ypzhang2 8y ago
yeah, i'm not speaking to their other claims or security practices, which by all accounts appear terrifying. Given apparently whats happening, who even knows if they have actually integrated with a vendor or not. I'm just speaking about the technology as described. Its not a novel id verification method, plenty of other companies use it and there are multiple vendors / providers of the service.

forapurpose 8y ago

> technology mentioned above is ... in fact see wide spread use for purposes of fraud prevention for financial systems Different organizations have different security needs Financial systems can use the relative cost of a security measure compared to the cost of a breach to decide whether to implement the security; they consciously accept a certain level of failures. Also, they can use insurance to mitigate exploits after they happen. Voting systems cannot tolerate failures, at least in theory. Every vote must count. Also, at least for some elections, the value to the attacker is much higher than what can be gained from financial institutions; a foreign intelligence service has much more to gain than money from controlling a US presidential election, for example, and an investor could make billions by knowing the outcome ahead of time. Finally, there is no mitigation after a breach: Insurance won't save a fraudulent election.

ypzhang2 8y ago
Sure, whether the ID verification tool in question is appropriate or enough of a mitigation for election purposes is arguable. In fact it could very well be that no electronic verification process would be enough, since as you say, every vote can potentially be crucial and therefore ANY margin of risk might be unacceptable. The point I am making is that its not as simple as described to "spoof" this tool, and to give some background on its usage since it seemed to be a novel verification tool for the OP
- forapurpose 8y ago
  I meant to add to your point, not disagree with it. Sorry if I gave the wrong impression. > every vote can potentially be crucial I'll also add that every vote is important because the number of votes is important. Winning 70-30 will get much different behavior than winning 50.01-49.99; the latter representative had better pay attention to the 49.99's needs. And that can matter down to the smallest geographical levels - if everyone in your neighborhood votes, politicians will pay much more attention.