News for hackers. Stuff that matters.
Re:4chan reveals online voter exploit that can be used to ca... by dawnerd on Sunday October 18, 2020 @02:13AM (#24815851)
Actually no, this isn't voting. It's a sample digital ballot that you have to print out and return in person. I'm honestly surprised this amount of disinformation made it to the HN front page.

Here's the form they think is real: http://oregonvotes.org/pages/ballots/11032020/Washington/34_...

Re:4chan reveals online voter exploit that can be used to ca... by Covzire on Sunday October 18, 2020 @02:51AM (#24815996)
I'm not willing to test it myself, but maybe the worst of this is that it seems to allow anyone to look up any Oregon voter's registered mail address if you have their birthday, meaning most famous/public figures in Oregon are at some risk it would seem.
Re:4chan reveals online voter exploit that can be used to ca... by grimli333 on Sunday October 18, 2020 @03:04AM (#24816046)
Yes, this is true. However, it is public information and the site has a disclaimer indicating this. There is an alternate route to register to vote if your information is confidential. It’s trivial to learn this information in other ways as well. It’s somewhat notable how easy it was for me to look up a prominent politicians registration info, but that is simply not news. This post was flagged appropriately.
Re:4chan reveals online voter exploit that can be used to ca... by brayhite on Sunday October 18, 2020 @02:54AM (#24816005)
This in itself isn’t unusual. Or at least Kentucky’s voter registration tool is the same way.
Re:4chan reveals online voter exploit that can be used to ca... by michannne on Sunday October 18, 2020 @02:15AM (#24815856)
The tweet does imply voting, but cancelling is possible, this is just the most visible tweet as of right now

Ive updated the title to reflect this

Re:4chan reveals online voter exploit that can be used to ca... by theplague42 on Sunday October 18, 2020 @02:19AM (#24815871)
The tweet does far more than imply.

Why are you posting 4Chan garbage to HackerNews? Is this even confirmed?

Re:4chan reveals online voter exploit that can be used to ca... by michannne on Sunday October 18, 2020 @02:20AM (#24815882)
If you head to the website and put your name and DOB, the cancellation of your ballot after requesting a replacement is mentioned at the bottom of the page

I'll add that anyone can request a replacement, and the cancellation is effective immediately

Re:4chan reveals online voter exploit that can be used to ca... by theplague42 on Sunday October 18, 2020 @02:22AM (#24815892)
Can you actually cancel a ballot through the online portal or not?
Re:4chan reveals online voter exploit that can be used to ca... by evan_ on Sunday October 18, 2020 @03:04AM (#24816043)
In Oregon you cannot cancel a ballot through the online portal, or at all
Re:4chan reveals online voter exploit that can be used to ca... by arkis22 on Sunday October 18, 2020 @02:20AM (#24815879)
If I had to pit 4chan against HN in a scavenger hunt, I would bet on 4chan.

edit: in fact I think this happened. wasnt there an online quiz we lost at a couple years ago?

Re:4chan reveals online voter exploit that can be used to ca... by dawnerd on Sunday October 18, 2020 @02:19AM (#24815872)
Where on the my vote portal does it let you cancel? Ballots have already been mailed anyways so it's a bit late for anyone to try to change anyones status.
Re:4chan reveals online voter exploit that can be used to ca... by michannne on Sunday October 18, 2020 @02:22AM (#24815891)
When requesting a replacement. I have hidden the thread until the story is confirmed by a reputable news org
Re:4chan reveals online voter exploit that can be used to ca... by evan_ on Sunday October 18, 2020 @02:44AM (#24815962)
In Oregon there’s not a way to request a replacement ballot. I am looking at the form right now and there is no way to either cancel or request a replacement ballot online.

To request a replacement ballot you have to fill out a form and send it to your county clerk, and the form asks you for a lot more info than your DOB.

As far as cancelling your vote, when has that EVER been an option and what purpose would it serve?

Re:4chan reveals online voter exploit that can be used to ca... by guidedprism on Monday October 19, 2020 @12:56PM (#24828242)
It wasn't an option, but it happens when you print out the new online ballot. The website has a caution notice about it when you go to print "Caution: If you continue, a ballot previously mailed to you will be canceled"
Re:4chan reveals online voter exploit that can be used to ca... by dawnerd on Sunday October 18, 2020 @02:24AM (#24815900)
That's not a feature. You can't even cancel your registration without contacting the county directly. But keep spreading misinformation.
Re:4chan reveals online voter exploit that can be used to ca... by michannne on Sunday October 18, 2020 @02:31AM (#24815920)
"But keep spreading misinformation"

I've nothing to gain spreading misinformation. As I've said I've hidden the thread until a reputable news org is able to report on this.

Re:4chan reveals online voter exploit that can be used to ca... by s9w on Sunday October 18, 2020 @02:40AM (#24815951)
You prefer a third party text that has been through censorship to the direct source?
Re:4chan reveals online voter exploit that can be used to ca... by grimli333 on Sunday October 18, 2020 @02:20AM (#24815878)
I don’t understand. Why would these states allow you to invalidate a ballot online? What’s the legitimate use case for that feature?
Re:4chan reveals online voter exploit that can be used to ca... by guidedprism on Monday October 19, 2020 @12:58PM (#24828275)
They don't have a "cancel ballot" button. When you fill out and print the new online ballot it will cancel any previously sent ballots. They site says "Caution: If you continue, a ballot previously mailed to you will be canceled"
Re:4chan reveals online voter exploit that can be used to ca... by dawnerd on Sunday October 18, 2020 @02:22AM (#24815886)
They don't.
Re:4chan reveals online voter exploit that can be used to ca... by grimli333 on Sunday October 18, 2020 @02:48AM (#24815981)
Wow. This post was dangerous disinformation. I have independently confirmed this is false and ballots cannot be canceled or changed.

It is indeed possible to see addresses where ballots were mailed, and I was able to view a politician’s information using only their name and date of birth gleaned from Wikipedia.

I’m sure this information can be found in any number of ways, however. There is also a disclaimer stating “ If your information is confidential or you are not yet 18 years old, contact your county elections official to confirm your registration status.” which indicates using that site to register has no implication of privacy.

Re:4chan reveals online voter exploit that can be used to ca... by theplague42 on Sunday October 18, 2020 @02:16AM (#24815863)
It fits the reactionary narrative so I'm not sure why it's surprising.
Re:4chan reveals online voter exploit that can be used to ca... by arkis22 on Sunday October 18, 2020 @02:26AM (#24815906)
it shouldn't fit your narrative either. you believe in free and accurate elections right?

I live in Chicago. I find it absolutely absurd that people don't think politicians steal votes.

Re:4chan reveals online voter exploit that can be used to ca... by theplague42 on Sunday October 18, 2020 @02:49AM (#24815984)
I don't see why politicians would bother to create a poorly-designed public-facing website to steal an election.
Re:4chan reveals online voter exploit that can be used to ca... by arkis22 on Sunday October 18, 2020 @03:05AM (#24816048)
are you asking why politicians would bother to steal an election?
[dead]
Re:4chan reveals online voter exploit that can be used to ca... by arkis22 on Sunday October 18, 2020 @03:27AM (#24816114)
I think you should respond with a logical point rather than insulting me
Re:4chan reveals online voter exploit that can be used to ca... by evan_ on Sunday October 18, 2020 @03:16AM (#24816074)
why would they do it in a way that's easy for other politicians to use
Re:4chan reveals online voter exploit that can be used to ca... by arkis22 on Sunday October 18, 2020 @03:17AM (#24816081)
fraud is never an easy tool. it's used when you can get away with it. why is it literally known as the cook county democratic machine without backlash?

you're also assuming its easy for other politicians to use. as if counting votes is just the web app...

[dead]
Re:4chan reveals online voter exploit that can be used to ca... by arkis22 on Sunday October 18, 2020 @03:44AM (#24816179)
please be specific. this isn't a place for twitter comments. what have I said that you think is delusional?
Re:4chan reveals online voter exploit that can be used to ca... by thallium205 on Sunday October 18, 2020 @02:33AM (#24815925)
4chan was able to print Portland's Mayor Ted Wheeler ballot and change his vote to Trump. Go and look it up on the site.
Re:4chan reveals online voter exploit that can be used to ca... by theplague42 on Sunday October 18, 2020 @02:39AM (#24815947)
It's trivial to demonstrate that that claim is false.

Someone in this thread linked the page to the "voting" screen. It's just a form to print a new ballot that you would then mail or bring in person.

Re:4chan reveals online voter exploit that can be used to ca... by thallium205 on Sunday October 18, 2020 @03:07AM (#24816055)
You're right. 1) This only changes a form you can print out, sign and mail in or drop off (they're not checking accuracy of signatures this year) 2) This does reveal lots of PII 3) 4CHAN is now using obituaries to search for dead people who have voted
Re:4chan reveals online voter exploit that can be used to ca... by evan_ on Sunday October 18, 2020 @03:18AM (#24816084)
you can't just drop it off, you have to return it in a certified ballot envelope that has all of your information on it and one-time codes to avoid forgeries.

who cares if they're looking at obits, great, that's fine, every political party has lawyers to do that and they're better at it anyway.

Re:4chan reveals online voter exploit that can be used to ca... by thallium205 on Sunday October 18, 2020 @03:36AM (#24816157)
>This site allows you to mark, review, and print your ballot materials for return to your county elections office.

Their FAQ makes no mention of placing it in a ballot envelope. In fact they offer the ability to print your own from the website. Where are you getting that information?

It appears one can type in a name and dob, print a ballot, fill it out, and drop it off. What am I missing that is also not in their FAQ?

Re:4chan reveals online voter exploit that can be used to ca... by evan_ on Sunday October 18, 2020 @03:39AM (#24816170)
https://sos.oregon.gov/voting/Pages/instructions-disabilitie...

   Step 4: Return your Ballot

   After printing your marked ballot summary:  
   Enclose your ballot in the secrecy envelope.  
   Then place that envelope in the return identification envelope.
   Sign the ballot declaration and the return identification envelope
Is your theory simply that nobody in the Oregon Secretary of State's office thought people might try to cheat?
Re:4chan reveals online voter exploit that can be used to ca... by thallium205 on Sunday October 18, 2020 @03:32AM (#24816138)
If that's the case why are they offering users the ability to print it out and return it if doing so requires a unique one time ballot envelope?
Re:4chan reveals online voter exploit that can be used to ca... by evan_ on Sunday October 18, 2020 @03:39AM (#24816168)
Visually impaired voters who can use a screen reader but may have trouble with the paper ballot. Voters with motor issues that make it difficult to fill in a bubble with a pen.

Here are the instructions for using the alternate ballot: https://sos.oregon.gov/voting/Pages/instructions-disabilitie...

Re:4chan reveals online voter exploit that can be used to ca... by michannne on Sunday October 18, 2020 @02:44AM (#24815963)
The tweet is wrong yes, but my main point was the fact that requesting a replacement ballot invalidates the previous sent ballot.
Re:4chan reveals online voter exploit that can be used to ca... by grimli333 on Sunday October 18, 2020 @02:55AM (#24816010)
It does not. Also, you can’t even update registration info without an Oregon DMV number. At that point you’re straight up committing identity theft. Even if you could it does not invalidate an already submitted ballot. This is not correct information you are spreading.
Re:4chan reveals online voter exploit that can be used to ca... by nseggs on Sunday October 18, 2020 @02:51AM (#24815995)
Does it?
Re:4chan reveals online voter exploit that can be used to ca... by michannne on Sunday October 18, 2020 @02:57AM (#24816020)
I'll clarify: using name and DOB allows you to see voter information. This is relatively benign as it is public information. However the site also has the option to request a replacement ballot. When requesting a replacement, the website mentions that if a previous mail-in ballot has not yet been successfully validated, it will be cancelled.

My aim is not to spread disinformation here. I have hidden the thread until a reputable source can confirm further as there may be other details I'm missing. This is not about changing votes, but the replacement of a ballot that can be initiated using very little information, and can cause a person's mail-in ballot to be invalidated.

Re:4chan reveals online voter exploit that can be used to ca... by evan_ on Sunday October 18, 2020 @03:01AM (#24816031)
> However the site also has the option to request a replacement ballot.

In Oregon, there is no such option.

Re:4chan reveals online voter exploit that can be used to ca... by swhittaker on Sunday October 18, 2020 @03:14AM (#24816072)
Here is the specific page that people are somewhat concerned about. I'm a WA voter, but it seems like they use a similar system to OR. When I go to https://voter.votewa.gov/ and enter my first/last name and DOB, I can go to "My Ballot -> Online Ballot" and it gives the following text:

>To print a ballot packet, only click "Continue" if you did not receive your ballot by mail or your ballot is lost or damaged. Continue only if you intend to vote this ballot.

>Print both 1) Replacement Ballot and 2) Ballot Return Packet.

>To view what's on your ballot, select the voters' guide in the navigation menu.

>Frequently asked questions

>This site allows you to mark, review, and print your ballot materials for return to your county elections office.

>Can I just view my online ballot and then vote the paper ballot coming to me in the mail? >No, the online ballot should only be used if you want to print, vote and return it. Click on Voters' Guide in the >left navigation to see what will be on your ballot and to learn more about the candidates and measures. >I lost my paper ballot, can I print and return this online ballot? >Yes, the online ballot is a great replacement ballot option. When printing make sure to print both the 1) replacement ballot and 2) the ballot packet. Follow the ballot packet instructions and make sure you return your ballot on time – the earlier the better! >Caution: If you continue, a ballot previously mailed to you will be cancelled.

It is specifically this phrase Caution: If you continue, a ballot previously mailed to you will be cancelled. that is concerning. It makes one think that if I press the [Continue] button on that page, then the ballot that has already been mailed to me will be automatically canceled. Can you confirm that that is not the case, and if so what is your evidence?

Re:4chan reveals online voter exploit that can be used to ca... by SV_BubbleTime on Sunday October 18, 2020 @04:44PM (#24820989)
Oregon aside. This seems really concerning. Can someone explain to me this isn’t really the case?

I don’t believe anyone anymore (only like 1/2 hyperbole).

Re:4chan reveals online voter exploit that can be used to ca... by evan_ on Sunday October 18, 2020 @03:27AM (#24816117)
well, I'm only able to speak for Oregon, so I will update my post.

I don't know what will happen if you click through. You could try it I guess, apparently 4chan has already cancelled everyone's vote anyway.