News for hackers. Stuff that matters.
Re:Estonia sues Gemalto for €152M over ID card flaws by hkai on Sunday September 30, 2018 @10:47AM (#18106372)
Everyone told them you can't have secure electronic voting.
Re:Estonia sues Gemalto for €152M over ID card flaws by Strom on Sunday September 30, 2018 @12:21PM (#18106792)
That's a statement that applies to everything, including classic paper voting. It's never a question of whether there's absolute security, because nothing has it. It's about comparing the security and other benefits of different systems.
Re:Estonia sues Gemalto for €152M over ID card flaws by gsich on Sunday September 30, 2018 @03:25PM (#18107867)
The main problem with electronic voting is that you can't understand what the machine is doing. Source code won't help, because you don't know what is running on the machine. Source code won't help because you don't know what the compiler will do (maybe insert some extra stuff?).

Paper voting is comprehensible by everyone.

Re:Estonia sues Gemalto for €152M over ID card flaws by Strom on Thursday October 04, 2018 @06:55AM (#18138740)
That's an illusion. People can comprehend paper voting on a source code level, in that they know what should happen in theory. No single person can even fully observe a single counting station, much less a whole election. You still end up having to trust the system.
Re:Estonia sues Gemalto for €152M over ID card flaws by gsich on Thursday October 04, 2018 @11:08PM (#18145443)
It's not. People can comprehend paper voting on "source code level" aswell as the "compiled" version.

>No single person can even fully observe a single counting station, much less a whole election.

First is possible (just observe the person whos counting), second not, for obvious reasons that you can't be at two places at once.

Re:Estonia sues Gemalto for €152M over ID card flaws by Strom on Tuesday October 09, 2018 @09:57AM (#18175991)
> just observe the person whos counting

.. and trust the votes to all be real?

A person voting could put two votes instead of one. (It can still look like one, using the same method that's used for card tricks.) Even if you introduce extra steps, like every paper needing a stamp or something, you're still going to need to trust this stamper person. They could be in on it, and either stamp multiple or leak the stamp design.

The staff could be inserting fake votes into the ballot box before it gets counted, even without actual voters.

The counters could add votes from their sleeves, again classic card trick mechanics.

The counters can remove votes from the pile by stacking two or just sliding one off the table while also performing a distraction. Once again, classic magic trick mechanics that are used for vanishing jewelry etc.

Basically my point is that if the counting station is being staffed by magicians from Vegas, they can produce any result they want without an average person that's observing understanding anything.

Besides, at the end of the day it doesn't even matter, because one counting station is within the margin of error for the whole election.

Re:Estonia sues Gemalto for €152M over ID card flaws by 3K7m7bUZyWA1KCD on Sunday September 30, 2018 @02:18PM (#18107451)
It's really hard to fake paper voting IMO.

I'm a Greek citizen. At the voting place of the city where I was born and am registered since, there are many rooms. Depending on the initial letters of your last name, you have to go and vote in a specific one. Each room has at least two randomly conscripted citizens, responsible to strike out your name from the list they have, once you drop your single vote envelope. Reminds me of the jury duty of USA citizens. Every few rooms have police officers (very possibly also randomly chosen) inspecting and protecting the procedure.

Re:Estonia sues Gemalto for €152M over ID card flaws by fpoling on Sunday September 30, 2018 @04:53PM (#18108359)
My father worked few times in voting stations in Belarus in the beginning of nineties. He was amazed how easy it would be to subvert the voting results. His observation was that especially late into counting everybody was tired and focused on the counts to the point that a person can walk to the table, grab some ballot papers and put some fake ones. I guess nowadays with video recording etc. it will be harder, but still.

What really makes the paper ballots secure is that counting fraud does not scale. It is impossible to do it on substantial number of voting stations with nobody noticing even in semifunctional democracy. With electronic voting scaling an exploit to all voting machines is straightforward.

Re:Estonia sues Gemalto for €152M over ID card flaws by specialist on Sunday September 30, 2018 @01:12PM (#18107080)
Not quite.

The Australian Ballot works pretty good. Private voting, public counting.

https://en.wikipedia.org/wiki/Secret_ballot

Like all systems, requires funding and attention, of course.

Comparatively...

There is no electronically mediated equivalent of the one-way hash of dropping your ballot into the box suitable for elections in the USA.

Because our ballots are complicated and our units of administration (precincts) are small. Meaning any end-to-end auditable system for hashing ballots won't generate the necessary hash collisions to hide one's ballot within the herd of ballots.

Re:Estonia sues Gemalto for €152M over ID card flaws by bozho on Sunday September 30, 2018 @11:19AM (#18106522)
And yet, they do have it ;)
Re:Estonia sues Gemalto for €152M over ID card flaws by TazeTSchnitzel on Sunday September 30, 2018 @11:29AM (#18106559)
Not according to experts in electronic voting system security.
Re:Estonia sues Gemalto for €152M over ID card flaws by kristerv on Sunday September 30, 2018 @11:52AM (#18106663)
source please. So far I've only seen "experts" hack some old 20 US voting stations that are a joke in comparison.
Re:Estonia sues Gemalto for €152M over ID card flaws by mnyary on Sunday September 30, 2018 @12:06PM (#18106719)
Independent Report on E-voting in Estonia https://estoniaevoting.org/press-release/ This is from 2014.
Re:Estonia sues Gemalto for €152M over ID card flaws by rstuart4133 on Wednesday October 03, 2018 @03:52AM (#18128323)
There are too many concepts covered by the term e-voting.

I'm sure the OP wasn't claiming the concept discussed in your link is a universally accepted as secure. That's because someone who thinks any voting method that allows a votes to be bought and sold is of course in a state of sin. Internet voting is one of those methods.

Who knows, the OP may have also not been claiming purely electronic voting is a solved problem. Opinions may vary on that one, depending on how secure you think end-to-end audited voting is in practice. If all voters took the time to do the 60 second audit procedure it would of course be perfectly secure, but that's an unrealistic assumption.

Which leaves a hybrid system - were the voting is done electronically using an end-to-end auditable system and the initial count is done electronically, but each vote is also printed and manually placed in the ballot box by the voter in the normal manner so if something goes wrong they can be manually re-counted.

If that is what the OP is talking about then they are right - such a system is faster to use, gets the counting done near instantaneously, easier to use (particularly for voters with disabilities), is more accurate (because it can point out mistakes in the vote), is less wasteful (because how to vote cards and information on candidates can be presented electronically) and of course is more secure than the existing manual system. And yes, on that the experts agree pretty much universally.

The sad thing is I only know of one electronic voting system that did it that way, and it was only a trial. All other deployed e-voting systems I've seen were mostly windows desktop's enclosed in an impressive looking box.

Some things in this world are very hard to explain.

Re:Estonia sues Gemalto for €152M over ID card flaws by TazeTSchnitzel on Sunday September 30, 2018 @12:06PM (#18106722)
Re:Estonia sues Gemalto for €152M over ID card flaws by Avamander on Sunday September 30, 2018 @11:48AM (#18106642)
Could you provide sources for your claims?
Re:Estonia sues Gemalto for €152M over ID card flaws by spuz on Sunday September 30, 2018 @05:54PM (#18108643)
The article doesn't mention voting. Not sure why it's relevant to Estonia's ID cards.