News for hackers. Stuff that matters.
Re:Hacking Voting Machines at Defcon by Klathmon on Monday July 31, 2017 @09:18AM (#14891624)
Electronic voting is dangerous and is a very bad idea. Voting should be done on paper, using pencils, put into ballot boxes, and counted by people.

Paper works, and it works well. It's a system that has worked well enough for thousands of years, and we have figured out most of the issues with it during that time. Anyone that can count can validate a single precinct. You can have one person, or 100 people all standing there watching a ballot box all day for tampering. You can have a whole group of people count the results, or just a few.

In a traditional paper system, swaying a single precinct with "blackhat" methods takes a lot of physical resources, a lot of time, and in most cases a lot of people. Then multiply that by every precinct in the country, and it quickly becomes pretty much impossible to do and get away with. Plus it leaves a physical "paper trail" (in the form of payment for people, communications, and physical materials or the receipts for those materials).

Electronic voting gives us very few benefits, and a significant amount of downsides. And it doesn't matter if it's FOSS, it doesn't matter if it's vetted, it doesn't matter what safeguards are put in place, all it takes is one mistake. One fuckup, and someone can now choose the leader of a nation, and in some cases that leader can change the rules of the next election, meaning it only takes one single mistake to ruin it for many many generations in the future.

And replacing a system where literally everyone can validate a system on voting day if they want to with a system where only a fraction of a fraction of people can even read and understand the code, let alone validate the code (and can't actually validate the hardware, or make sure what is running on the hardware is actually that code, or make sure that the hardware is even what it says it is), and it takes a magnitude more time to do so, just isn't a good idea.

Re:Hacking Voting Machines at Defcon by Fej on Monday July 31, 2017 @10:34AM (#14892335)
The obligatory video from Computerphile and Tom Scott is obligatory.

Describes all the problems with electronic voting and why it's an awful idea. It's short for what it is, a fantastic eight minutes.

https://youtu.be/w3_0x6oaDmI

Re:Hacking Voting Machines at Defcon by TeMPOraL on Monday July 31, 2017 @09:48AM (#14891897)
I know it's tangential to the point you're making, but I have to ask:

> using pencils

Why pencils? Aren't pens more secure (more difficult to erase / alter without leaving a visible mark on paper)?

Re:Hacking Voting Machines at Defcon by ajanuary on Monday July 31, 2017 @01:10PM (#14893859)
According to the UK Electoral Commission [0]

  > The use of pencils does not in itself increase the likelihood of electoral 
fraud: while pencil marks can be rubbed out, similarly, pen marks can be crossed out. What is key is that the integrity of the process from the point that a voter marks their ballot paper to the declaration of the result is maintained.

Anecdotally, I've head people make the argument that pencils are more reliable than pens (mechanical failure etc.), that pens can be liable to smudging (especially if folded immediately after marking), and that the pencils they use are difficult (though not impossible) to rub out.

[0] https://www.whatdotheyknow.com/request/pencil

Re:Hacking Voting Machines at Defcon by Klathmon on Monday July 31, 2017 @09:54AM (#14891955)
No reason why it needs to be pencils specifically, just that they are the simplest, and simple is better. I was more trying to speak to the idea that a person is making the mark themselves without any other "machinery" or anything.

I've seen complicated mechanical hole punching machines that can break down, or machines that generate a cast ballot that is placed in a box that you can't be sure cast the vote correctly. That's the kind of stuff I'm talking about avoiding when I say "using pencils".

Plus once your vote is put in the box, it doesn't matter if the ballot itself can be tampered with, as there should be multiple people watching that box until counted. So pen or pencil makes no difference. Erasable or otherwise doesn't matter. It can even just be a hole you poke in a box using the pencil. The important part is that nobody can touch it till it's counted in front of a bunch of people who all don't trust one another.

Re:Hacking Voting Machines at Defcon by simias on Monday July 31, 2017 @09:55AM (#14891959)
You could just have pre-printed ballots with the name of the person you're voting for on them. That's how we do it in France, no pen or pencil required.

I think in the USA there tends to be several issues on the ballots however, so I guess it's not very practical in that case. It probably makes the counting harder however.

Re:Hacking Voting Machines at Defcon by cr0sh on Monday July 31, 2017 @02:11PM (#14894521)
> You could just have pre-printed ballots with the name of the person you're voting for on them.

Imagine a ballot (or something) that had the pre-printed names on them something like those paper "call me for xyz" things you see on bulletin boards everywhere (or well you used to)?

Basically the names would be on pieces of paper (maybe with a QR code?) about the size of what you get in a fortune cookie, that can be tore off the "ballot" and dropped in a box for later counting. With a QR code (or something similar), the counting could even be done with a machine.

Such a paper ballot could arguably have many names attached (here in the US we have so many positions and votes to cast on so many things it's mind boggling, especially during certain election times). I'm not sure if or how well it would work, but I think it might be doable - at least enough to attempt.

Re:Hacking Voting Machines at Defcon by dx034 on Monday July 31, 2017 @09:59AM (#14892003)
Ballots are usually pre-printed. But you still need a pen or pencil to check the right box.
Re:Hacking Voting Machines at Defcon by simias on Monday July 31, 2017 @11:46AM (#14893020)
Right, but it's still probably slightly harder to fill and count. Not massively so of course but maybe enough to slow things down.

Compare https://upload.wikimedia.org/wikipedia/commons/d/dc/France_%... with http://etc.usf.edu/clippix/pix/2012-presidential-election-ba...

Re:Hacking Voting Machines at Defcon by kalleboo on Monday July 31, 2017 @11:44AM (#14893005)
In the Swedish voting system, there is one ballot per party, and you put the ballot for the party you are voting for into an envelope and put that envelope into the ballot box.

You only need a pen/pencil if you want to change the parties default ranking of their candidates (e.g. who in the party you want to see as prime minister) or you want to vote for a minor party which doesn't have ballots (write-in votes)

[I'm not endorsing the Swedish system just explaining how it works]

Re:Hacking Voting Machines at Defcon by Thlom on Monday July 31, 2017 @01:43PM (#14894268)
Same in norway. One ballot per party. In local elections we vote for both council and municipality, so there's two sets of ballots. Council ballot goes in one box and municipality ballot goes in another box. No reason why we couldn't have 20 boxes if we also voted for issues directly.

Also in local elections we can write in other people and give people on the ballot an "extra" vote for which we use a pen (but this is voluntary and I assume most don't bother).

Re:Hacking Voting Machines at Defcon by graphitezepp on Monday July 31, 2017 @09:56AM (#14891969)
I mean your not wrong. But the attack you are suggesting in mentioning the possibility of erasing and rewriting submitted votes is still avoided by general prevention of any ballot box tampering.
Re:Hacking Voting Machines at Defcon by creaghpatr on Monday July 31, 2017 @11:12AM (#14892721)
Not to mention lack of scalability, tampering would be pretty localized and not very effective for a state-wide electoral college vote.
Re:Hacking Voting Machines at Defcon by mattdoughty on Monday July 31, 2017 @10:16AM (#14892166)
With a pen mark you can just cross out the mark and put your X in another box. That would be accepted here in the UK at least.
Re:Hacking Voting Machines at Defcon by ArchReaper on Monday July 31, 2017 @10:23AM (#14892225)
And pencil marks can't be erased?
Re:Hacking Voting Machines at Defcon by jandrese on Monday July 31, 2017 @10:08AM (#14892095)
At my voting location they use paper ballots and only supply pens.
Re:Hacking Voting Machines at Defcon by cr0sh on Monday July 31, 2017 @02:07PM (#14894486)
> Voting should be done on paper, using pencils, put into ballot boxes, and counted by people.

I'd go further and say that for such a manual system, the counting should be done as speedily as humanly possible, but that if it takes a few days to do it - then so be it.

I don't think this is one area that should be rushed, and I don't understand why so many people - including people who should know better - thinks it should be.