News for hackers. Stuff that matters.
Re:In Estonian parliamentary election, 44% of the votes were... by Mirioron on Monday March 11, 2019 @05:50AM (#19357745)
Considering Estonia's history, paper voting isn't exactly amazing either. The Soviet era showed that election fraud happens anyway. The problem with paper voting is that mistakes in counting happen very often. During the election that just happened in Estonia officials wrote the candidate number into the box that said how many votes they got.[1]

In the 2016 US presidential election officials basically typod the election results in the town of Hazelhurst in Wisconsin, where almost half the votes went missing until a citizen volunteer noticed the mistake. The party officials nor election officials caught the mistake.[2]

If mistakes like that can happen then how often do they go unnoticed? How often are these mistakes deliberate?

[1] https://news.err.ee/916525/vote-miscount-in-narva-may-cost-e...

[2] https://www.votingjustice.us/tags/election_integrity

Re:In Estonian parliamentary election, 44% of the votes were... by zAy0LfpBZLC8mAC on Monday March 11, 2019 @09:36AM (#19358829)
> Considering Estonia's history, paper voting isn't exactly amazing either.

So, could you point to any one election in Estonia's history where electronic voting would have been any better?

> The Soviet era showed that election fraud happens anyway.

That's just bullshit. Just because a solution for a problem is not perfect, does not mean it's useless and that every non-perfect approach is equally bad.

> The problem with paper voting is that mistakes in counting happen very often.

Which is irrelevant to the discussion of security. Mistakes are a very different thing from intentional manipulation, both in how you can prevent them and in the effects. In particular, mistakes tend to average out, which is why they usually don't matter for elections as long as they happen at a reasonably low rate.

> In the 2016 US presidential election officials basically typod the election results in the town of Hazelhurst in Wisconsin, where almost half the votes went missing until a citizen volunteer noticed the mistake. The party officials nor election officials caught the mistake.

... which is why we should employ a voting process where only the election officials have any insight into what is going on, so we minimize the chance that a citizen discovers any errors?

> If mistakes like that can happen then how often do they go unnoticed? How often are these mistakes deliberate?

... and how would an election process that is completely opaque to the public possibly help with any of that?

Re:In Estonian parliamentary election, 44% of the votes were... by codedokode on Monday March 11, 2019 @06:59AM (#19357999)
Paper voting is hundred times more secure than electronic. With paper voting observers can see all the ballots and verify the results; these results are usually published so if you have observers at all polling stations you can verify that all votes have been counted correctly.

With electronic voting nothing stops sysadmin from doing UPDATE votes SET vote = 'Good Candidate' WHERE vote = 'Bad Candidate'.

Re:In Estonian parliamentary election, 44% of the votes were... by lagadu on Monday March 11, 2019 @09:01AM (#19358611)
Except the sysadmin's inability to generate valid signatures for those votes.
Re:In Estonian parliamentary election, 44% of the votes were... by codedokode on Monday March 11, 2019 @10:23AM (#19359168)
The signatures are generated by government-issued cards. Doesn't it mean that it can issue any number of new cards and generate signatures using them?

Also, they cannot store signatures with votes because that would disclose voter's identity and their choice. They have to store signatures separately from the votes and it means that the votes can be freely modified.

Here is what Wikipedia says [1]:

> This criticism was underscored in May 2014 when a team of International computer security experts released the results of their examination of the system, claiming they could be able to breach the system, change votes and vote totals, and erase any evidence of their actions if they could install malware on the election servers.

Of course, the government can install enything on its servers.

Here is a quote from a report on vulnerabilities [2]:

> The e-voting system places complete trust in the server that counts the votes at the end of the election process. Votes are decrypted and counted entirely within the unobservable “black box” of the counting server. This creates an opportunity for an attacker who compromises this server to modify the results of the vote counting.

> ...

> The attack’s modifications would replace the results of the vote decryption process with the attacker’s preferred set of votes, thus silently changing the results of the election to their preferred outcome.

Read: the government can "draw" any outcome they would like. Maybe they already did it, who knows.

[1] https://en.wikipedia.org/wiki/Electronic_voting_in_Estonia

[2] https://estoniaevoting.org/findings/summary/

Re:In Estonian parliamentary election, 44% of the votes were... by zAy0LfpBZLC8mAC on Monday March 11, 2019 @09:37AM (#19358838)
Except the sysadmin can update the database of valid signing keys as well?
Re:In Estonian parliamentary election, 44% of the votes were... by tambre on Monday March 11, 2019 @10:20AM (#19359147)
Do you mean the public database of everyone's public keys? Tampering with that would get noticed really fast and anything like that would greatly erode the trust in the system and wreak havoc on the economy since most stuff is signed digitally.