News for hackers. Stuff that matters.
Re:In Estonian parliamentary election, 44% of the votes were... by lagadu on Monday March 11, 2019 @09:01AM (#19358611)
Except the sysadmin's inability to generate valid signatures for those votes.
Re:In Estonian parliamentary election, 44% of the votes were... by codedokode on Monday March 11, 2019 @10:23AM (#19359168)
The signatures are generated by government-issued cards. Doesn't it mean that it can issue any number of new cards and generate signatures using them?

Also, they cannot store signatures with votes because that would disclose voter's identity and their choice. They have to store signatures separately from the votes and it means that the votes can be freely modified.

Here is what Wikipedia says [1]:

> This criticism was underscored in May 2014 when a team of International computer security experts released the results of their examination of the system, claiming they could be able to breach the system, change votes and vote totals, and erase any evidence of their actions if they could install malware on the election servers.

Of course, the government can install enything on its servers.

Here is a quote from a report on vulnerabilities [2]:

> The e-voting system places complete trust in the server that counts the votes at the end of the election process. Votes are decrypted and counted entirely within the unobservable “black box” of the counting server. This creates an opportunity for an attacker who compromises this server to modify the results of the vote counting.

> ...

> The attack’s modifications would replace the results of the vote decryption process with the attacker’s preferred set of votes, thus silently changing the results of the election to their preferred outcome.

Read: the government can "draw" any outcome they would like. Maybe they already did it, who knows.

[1] https://en.wikipedia.org/wiki/Electronic_voting_in_Estonia

[2] https://estoniaevoting.org/findings/summary/

Re:In Estonian parliamentary election, 44% of the votes were... by zAy0LfpBZLC8mAC on Monday March 11, 2019 @09:37AM (#19358838)
Except the sysadmin can update the database of valid signing keys as well?
Re:In Estonian parliamentary election, 44% of the votes were... by tambre on Monday March 11, 2019 @10:20AM (#19359147)
Do you mean the public database of everyone's public keys? Tampering with that would get noticed really fast and anything like that would greatly erode the trust in the system and wreak havoc on the economy since most stuff is signed digitally.