News for hackers. Stuff that matters.
Re:Hackers at convention to ferret out election system bugs by irrelative on Friday August 10, 2018 @11:16AM (#17734046)
Re:Hackers at convention to ferret out election system bugs by bcaa7f3a8bbc on Friday August 10, 2018 @11:17AM (#17734055)
Re:Hackers at convention to ferret out election system bugs by js2 on Friday August 10, 2018 @11:53AM (#17734441)
I'd like to call attention to what I consider the most informative comment in either of those discussions:

https://news.ycombinator.com/item?id=17730681

Re:Hackers at convention to ferret out election system bugs by benchaney on Friday August 10, 2018 @01:47PM (#17735346)
Interesting that you think that, because I was actually fairly unimpressed with that comment. He leads of by saying the algorithms to do it have already been created without actually mentioning what algorithms he is talking about. He also claims that they somehow don't require that they run on trusted hardware which is pretty hard to believe (of course this assertion is completely unsupported in the rest of his comment).

The rest of his comment falls back to a fairly common computer security fallacy: We used it once and nothing terrible happened, so it is probably secure.

Re:Hackers at convention to ferret out election system bugs by jessaustin on Friday August 10, 2018 @02:13PM (#17735589)
Linked arXiv seems pretty straightforward?
Re:Hackers at convention to ferret out election system bugs by benchaney on Friday August 10, 2018 @03:32PM (#17736142)
It is straightforward yes, but it doesn't allay any of my concerns. I doesn't describe the algorithms used, and it doesn't have a threat model or anything resembling security analysis. It is more about gauging the reactions and social implications of the work, than a hard technical paper.

This is a very important part of the process, but it doesn't address the issues I raised.

Re:Hackers at convention to ferret out election system bugs by jessaustin on Friday August 10, 2018 @03:47PM (#17736236)
Yeah I agree they should release their source, but it's silly to hold that against the comment that didn't impress you.
Re:Hackers at convention to ferret out election system bugs by benchaney on Friday August 10, 2018 @03:54PM (#17736276)
> but it's silly to hold that against the comment that didn't impress you.

I don't see why. I am still convinced there are security issues. The comment under discussion made all sorts of grandiose yet completely unsupported claims. If the paper he linked had backed up his assertions, I'd be inclined to give him the benefit of the doubt, but it doesn't. Therefore I don't believe him.

Re:Hackers at convention to ferret out election system bugs by rbanffy on Friday August 10, 2018 @12:19PM (#17734666)
That's a pretty good comment.

I helped write the software for the Brazilian voting machines (state issued, standardized, made to spec by competing companies) and we had a long list of scenarios we had to guard against. The people who wrote the spec were field experts who studied attempted and successful (but caught) voting fraud every election. The resulting combination of hardware, software (the application itself is ridiculously simple), analysis and (and this is most important) procedures surrounding the physical devices (never left alone unguarded, clear chain of custody, created layers of protection and, in the end, a reasonably secure device. It's possible to make it absolutely secure? I'm not sure. Would that be usable? I doubt it.

It's foolish to make a flawless voting system when we can't guard against propaganda and other forms of manipulation through social media or even the most traditional paying voters (either explicitly or through promises) to vote a certain way.

Re:Hackers at convention to ferret out election system bugs by jdietrich on Friday August 10, 2018 @05:10PM (#17736760)
I must offer my congratulations to you and your colleagues. I am broadly opposed to electronic voting, but the Brazilian implementation seems to be the most sophisticated, elegant and well-engineered.
Re:Hackers at convention to ferret out election system bugs by rbanffy on Sunday August 12, 2018 @05:15PM (#17746450)
Thank you. It was an interesting experience and I'm proud of what we accomplished.
Re:Hackers at convention to ferret out election system bugs by deleteme12345 on Friday August 10, 2018 @01:30PM (#17735220)
The degree of complexity and amount of unknown variables (eg. Backdoored CPUs, 0-day exploits) make digital mass voting a not-so-good option.

Paper, on the other hand, is fairly easy to comprehend and secure by all participants.

Re:Hackers at convention to ferret out election system bugs by rbanffy on Friday August 10, 2018 @02:01PM (#17735485)
I agree. The main advantage of electronic voting (if properly secured) is speed and logistics.