News for hackers. Stuff that matters.
Re:Why online voting is harder than online banking by quantified on Sunday September 13, 2020 @02:41AM (#24458903)
How are the serial numbers allocated? If I can predict the serial numbers used over a swath of land, I can replace a large number of ballots dropped in its boxes with my own that have the same serial number. Those I can't predict, I just deliver as-is.

Probably need the equivalent of poll watchers to pick them up from the drop box and deliver to the monitored counting center. I'll believe the tamper-evident nature of the envelopes when I understand the solvent or process required to remove the adhesive without tearing the cover.

Re:Why online voting is harder than online banking by mulmen on Sunday September 13, 2020 @05:25PM (#24464069)
The drop box pickup has poll watchers.

The serial numbers are also tied to my address and name so you'd have to both decode the system used for generating the numbers and know the number the state assigned to me.

Re:Why online voting is harder than online banking by quantified on Tuesday September 15, 2020 @07:40PM (#24487971)
Do you know the system that encodes your name and address into the serial number? I hope it's a strong one-way hash in order to preserve your anonymity. I also hope it's valid, and not easily identified as one to discard in favor of the right one. Since the state generates the serial number encoded from your personal deets, it's not anonymous until the vote has been separated from the envelope without any association of its contents to your serial number. If there's any such association, your vote is no longer anonymous.

And a root of trust here is state IT systems. In addition to state actors (the nation-state type), we have the classic insider threats driven by both elected and career officials. Need to assume a higher level of competence at least than election commissions have deserved in the past.

The poll watchers are interesting. Do they watch each box from the time it's placed on the curb until the time its contents are entered into the counting system? (What's the overnight security like on them?, what's the transit security?)

Yes I sound like I'm trying to find problems...