So I'm halfway through the report, it's a very beautiful document, great work from the team that wrote, and if I understood correctly, a VOTING application: -

So I'm halfway through the report, it's a very beautiful document, great work from the team that wrote, and if I understood correctly, a VOTING application: - Uses ad-hoc cryptography as the main cryptography - Does not use the recommended security facilities on the target platforms (iOS and Android) - Is deployed manually, with hardcoded secrets (AWS account with name "admin" had its credentials hardcoded in a scala file named "AmazonOtpUtility.scala") - Has provably de-anonimizablity as a property (All is needed is apparently access to the databases, and might I remind you of the Twitter / UAE/Saudi Arabia recent story) - (And this is the biggest, most annoying thing) Is not end-to-end verifiable. - The actual threat model is almost childish, as showed by the testing team. I do apologize for the wording in the following paragraphs, but this a fucking dumpster fire of a project for a voting platform. Who the fuck authorized this to go forward as a voting platform for any state in the United States ? Who the fuck is selling this as a "secure" platform ? Can they sleep well at night ? When will the government intervene and stop people from compromising democracy with stunts like these ?