3 ms·

Yes, but even if some bounties are paid out, what guarantee do we have that this one honest white hat did his work? And remember this is not an usual bug bounty

Yes, but even if some bounties are paid out, what guarantee do we have that this one honest white hat did his work? And remember this is not an usual bug bounty for some company, where the failure mode is some lost revenue due to hacking. This could become ultra critical infrastructure, since in Switzerland we do not only elect the politician but we decide on any policy and law if it is of sufficient interest. In the absolute worst case a rigged electronic vote could enable laws bordering human rights violations or even laws to abolish some people's right to vote. So the failure mode here is complete loss of democratic control.

mal-2k 8y ago
That's not a particular problem for e-voting. I don't see a concrete reason why there should be an enhanced risk for manipulation just because you transmit your vote via the internet instead of sending it by letter or visiting the polling station. I rather see an opportunity for the voter to verify that the vote has been correctly carried depending on the implementation of the e-voting system. But for that I still need a closer look into the details of this system (which I will do as it concern myself). At the moment I see the project quite positive. For example in Germany they used a closed sourced software called "PC Wahl" and the ccc had quite some difficulties to get the source code. And when they got it the catastrophe just began. The software included such funny things like a 1 byte (sic!) hash as checksum. Then it had a weird encryption created by the guy who coded the software, which wouldn't even met 80's standards. Also the software was distributed via a cheap, hosted web server with the login credentials "test" "test" (sic!) and there wasn't any signatures for the updates nor for the transmitted results. To see the hole catastrophe you can watch "PC Wahl Hack" with Linus Neumann. It's quite funny especially when you hear that the software company (from that one guy who coded it since the 90s) was sold for about 1 Mio. €.

mal-2k 8y ago

That's not a particular problem for e-voting. I don't see a concrete reason why there should be an enhanced risk for manipulation just because you transmit your vote via the internet instead of sending it by letter or visiting the polling station. I rather see an opportunity for the voter to verify that the vote has been correctly carried depending on the implementation of the e-voting system. But for that I still need a closer look into the details of this system (which I will do as it concern myself). At the moment I see the project quite positive. For example in Germany they used a closed sourced software called "PC Wahl" and the ccc had quite some difficulties to get the source code. And when they got it the catastrophe just began. The software included such funny things like a 1 byte (sic!) hash as checksum. Then it had a weird encryption created by the guy who coded the software, which wouldn't even met 80's standards. Also the software was distributed via a cheap, hosted web server with the login credentials "test" "test" (sic!) and there wasn't any signatures for the updates nor for the transmitted results. To see the hole catastrophe you can watch "PC Wahl Hack" with Linus Neumann. It's quite funny especially when you hear that the software company (from that one guy who coded it since the 90s) was sold for about 1 Mio. €.