4 ms·

Open source, open hardware? What a joke. Neither are resistant to chip/compiler level attacks such as https://www.schneier.com/blog/archives/2018/03/adding_back

by deogeo 8y ago

Open source, open hardware? What a joke. Neither are resistant to chip/compiler level attacks such as https://www.schneier.com/blog/archives/2018/03/adding_backdoor.html https://www.schneier.com/blog/archives/2018/03/adding_backdo... and https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html https://www.win.tue.nl/~aeb/linux/hh/thompson/trust.html That's all assuming the voting machine is actually running the software/hardware they tell you - how would a voter check? The article briefly mentions "That receipt does not permit you to prove anything about how you voted, but does permit you to prove that the system accurately captured your intent and your vote is in the final tally,". But if that receipt doesn't let you prove anything about how you voted, how can you tell from it that your vote was captured 'correctly'? The machine can print anything on the receipt! Then there is the question - what problem is e-voting trying to solve? Hand-counting scales perfectly and is extremely difficult to covertly tamper with. So the only 'problem' e-voting solves is that of being unable to covertly and fully subvert elections.

deleted 8y ago
[deleted]
kevin_thibedeau 8y ago
> That's all assuming the voting machine is actually running the software/hardware they tell you - how would a voter check? Have dedicated hardware compute a hash from the content of program ROM on demand with a button press and present it on an auxilliary 7-segment display. Compare against the hash of the vetted image. No software need be involved. At some point in the process, machines will be used for tabulation. You have to trust the hardware to some extent. Just keep it as simple as possible to minimize confounding complexity that an attacker can hide in.
- deogeo 8y ago
  If the compiler was compromised, how do you know the vetted image is correct? If the hardware was compromised, then the software will still hash to the correct value. And once the attacker knows where you're getting the dedicated hardware for the hash, he can compromise that as well. And the entire system relies on the people implementing it to not have been compromised. Because if they were, if the government itself compromised the machines, the voters could never tell. How good is a voting system that only works if your government is honest?
- zAy0LfpBZLC8mAC 8y ago
  > Have dedicated hardware compute a hash from the content of program ROM How do you check the circuit of that hardware? How do you know the ROM you are reading is the ROM the CPU is executing from? How do you know the CPU is the architecture you think it is and the program means what you think it means? > You have to trust the hardware to some extent. No, you don't, and you shouldn't. You can do all of that calculation by hand. And at the very least you can check a random selection by hand. > Just keep it as simple as possible to minimize confounding complexity that an attacker can hide in. In other words: Don't use electronics. You can't get simpler than pen and paper.
unethical_ban 8y ago
I think it's unfair to say there is no point in e-voting besides malice. e-Voting could make it easier / cheaper to deploy polling stations, collect ballots faster, and potentially to use more complex (but more fair and accurate) voting methods like Ranked Choice or others. As for the "We won't tell you how you voted but you can validate it", my first guess would be some kind of PKI where you are given the equivalent of a private key, and your results are signed. There are issues trusting hardware vs. trusting the sight of paper and two humans, I get that. But it's worth researching.
- cyphar 8y ago
  > e-Voting could make it easier / cheaper to deploy polling stations, collect ballots faster, and potentially to use more complex (but more fair and accurate) voting methods like Ranked Choice or others. In Australia we use IRV (what you call ranked-choice) and we don't have any forms of electronic voting for federal elections, and the overwhelming majority of votes cast in state elections are paper ballots (which are hand-filled). You don't need e-Voting to solve that problem.
  - unethical_ban 8y ago
    Maybe not for IRV specifically, though it would arguably be easier anyway. There are more esoteric (see, mathematically dependent) voting systems that meet the Condorcet criterion.
    - cyphar 8y ago
      Sure, but computer vote tallying and e-Voting are not the same thing.
  - jonahhorowitz 8y ago
    Your votes are still probably counted by a computer. In San Francisco, we use optical scan ballots. This system is very similar. It prints out a ballot that you validate and feed into an optical scan machine. Marking the ballot is electronic, which allows for more language choices, assistance for hearing impaired people, etc.

by deogeo 8y ago

deleted 8y ago

[deleted]

kevin_thibedeau 8y ago

> That's all assuming the voting machine is actually running the software/hardware they tell you - how would a voter check? Have dedicated hardware compute a hash from the content of program ROM on demand with a button press and present it on an auxilliary 7-segment display. Compare against the hash of the vetted image. No software need be involved. At some point in the process, machines will be used for tabulation. You have to trust the hardware to some extent. Just keep it as simple as possible to minimize confounding complexity that an attacker can hide in.

deogeo 8y ago
If the compiler was compromised, how do you know the vetted image is correct? If the hardware was compromised, then the software will still hash to the correct value. And once the attacker knows where you're getting the dedicated hardware for the hash, he can compromise that as well. And the entire system relies on the people implementing it to not have been compromised. Because if they were, if the government itself compromised the machines, the voters could never tell. How good is a voting system that only works if your government is honest?
zAy0LfpBZLC8mAC 8y ago
> Have dedicated hardware compute a hash from the content of program ROM How do you check the circuit of that hardware? How do you know the ROM you are reading is the ROM the CPU is executing from? How do you know the CPU is the architecture you think it is and the program means what you think it means? > You have to trust the hardware to some extent. No, you don't, and you shouldn't. You can do all of that calculation by hand. And at the very least you can check a random selection by hand. > Just keep it as simple as possible to minimize confounding complexity that an attacker can hide in. In other words: Don't use electronics. You can't get simpler than pen and paper.

unethical_ban 8y ago

I think it's unfair to say there is no point in e-voting besides malice. e-Voting could make it easier / cheaper to deploy polling stations, collect ballots faster, and potentially to use more complex (but more fair and accurate) voting methods like Ranked Choice or others. As for the "We won't tell you how you voted but you can validate it", my first guess would be some kind of PKI where you are given the equivalent of a private key, and your results are signed. There are issues trusting hardware vs. trusting the sight of paper and two humans, I get that. But it's worth researching.

cyphar 8y ago
> e-Voting could make it easier / cheaper to deploy polling stations, collect ballots faster, and potentially to use more complex (but more fair and accurate) voting methods like Ranked Choice or others. In Australia we use IRV (what you call ranked-choice) and we don't have any forms of electronic voting for federal elections, and the overwhelming majority of votes cast in state elections are paper ballots (which are hand-filled). You don't need e-Voting to solve that problem.
- unethical_ban 8y ago
  Maybe not for IRV specifically, though it would arguably be easier anyway. There are more esoteric (see, mathematically dependent) voting systems that meet the Condorcet criterion.
  - cyphar 8y ago
    Sure, but computer vote tallying and e-Voting are not the same thing.
- jonahhorowitz 8y ago
  Your votes are still probably counted by a computer. In San Francisco, we use optical scan ballots. This system is very similar. It prints out a ballot that you validate and feed into an optical scan machine. Marking the ballot is electronic, which allows for more language choices, assistance for hearing impaired people, etc.