Live data from Hacker News

DEF CON report on vulnerabilities in US election infrastructure [pdf]

defcon.org

101–110 of 145 posts

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#101
post #84

Earlier quoted context omitted.

> 2. Remote Attacks Proven: ​Despite insistence the fact that machines are “air gapped” from the Internet protects against all remote attacks, both DEF CON 25 and 26 found exploits to hack machines remotely, requiring physical access to the machine. Did you leave out a word?

without

Conversely, is it possible to physically or remotely access one of these machines and determine if they've been hacked (or pre-hacked?) and how long would that take?

Also, does the hack simply modify the results for that machine, it does it grant access to manipulating the entire county vote?

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#102

From the "Next Steps" section in the report: >Congress Must Fund Election Security:​ National defense is not the role of state and local government. Further, no state or local government will ever be able to raise enough capital to defend itself from a determined nation state. Thus, having codified the basic security standards developed by local election officials above, Congress must finance the implementation of th…

Elections are not national defense. State and local governments have been handling their own elections since before the country was founded. This is a good thing , because it keeps elections close to the people, accountable to the people. The last thing we need is nationalized elections. That would make all of our elections vulnerable together. And that includes federal funding for state and local elections, because…

>That would make all of our elections vulnerable together.

They're already vulnerable, all together.

> which would effectively put elections under federal control.

They are already under numerous federal laws. Strangely enough, counter to your point, federal laws have been the #1 driving force for allowing more people to vote ("closer to the people"). See: https://www.usa.gov/voting-laws

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#103

From the "Next Steps" section in the report: >Congress Must Fund Election Security:​ National defense is not the role of state and local government. Further, no state or local government will ever be able to raise enough capital to defend itself from a determined nation state. Thus, having codified the basic security standards developed by local election officials above, Congress must finance the implementation of th…

Elections are not national defense. State and local governments have been handling their own elections since before the country was founded. This is a good thing , because it keeps elections close to the people, accountable to the people. The last thing we need is nationalized elections. That would make all of our elections vulnerable together. And that includes federal funding for state and local elections, because…

All it means is a foreign entity like Russia just attacks each state differently. It won't stop them. Clearly, we are doing literally what you're saying, and it hasn't worked.

Elections, in the 21st century, should fall within the range of national defense. Power grids and other types of infrastructure are, why not the democratic infrastructure like elections and voting?

> The last thing we need is nationalized elections. That would make all of our elections vulnerable together.

Or you know, the ability for elections to actually be fixed in a systemic fashion. It's really the only way.

I really don't understand this attitude. To take an example from the software industry, would you rather have your users on one OS, for you to secure, or 20+ different ones, where you need to plug holes independently?

Fix one issue with a voting machine, fix them all, as opposed to just fixing Florida's specific homegrown crap.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#104

Earlier quoted context omitted.

> From my perspective, democrats are working to improve election security while republicans are not. Does voter ID improve election security? Which party opposes voter ID laws?

>Does voter ID improve election security? It does not.

If one defines "election security" as "ensuring that each voter is registered, is alive and present, votes only once, and votes only in the correct location," then obviously requiring voters to legally identify themselves, just as they do when doing any number of everyday activities that involve local government, improves election security. Your assertion seems a bit knee-jerk.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#105

Earlier quoted context omitted.

I was just going to post that. I'm concerned that since election security is not (just) a technological problem, that very little will be done to improve it in the foreseeable future. I'm from Idaho which is currently conservative by close to a 2/3 majority, but remember growing up that we had many liberal elected officials like Cecil Andrus and Frank Church. From my perspective, democrats are working to improve elec…

> From my perspective, democrats are working to improve election security while republicans are not. Does voter ID improve election security? Which party opposes voter ID laws?

The opposition to voter ID laws is usually down to the implementation details of them that make them non-viable - for example, requiring costly IDs that are also difficult to get (while also closing facilities that issue them in some areas which just happen to vote a certain way).

A well-written voter ID law - one that truly guarantees the right to vote for every citizen eligible to do so - might well get enough bipartisan support; I'm just not aware of anyone ever trying such a thing.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#106
post #58

That's why you research and read before you go. Otherwise you'll wind up voting yes to "Proposition B: Unlimited Internet Freedom" which does something possibly disastrous despite the title. Because that's how Republicans roll.

Right, you should do that, but not all voters have the means to research beforehand.

You can research at the library for free. You can ask other people's opinions for free. Newspapers are inexpensive and widely available. I'm sure there are other options I'm missing. Who doesn't have the means for free?

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#107

Earlier quoted context omitted.

Elections are not national defense. State and local governments have been handling their own elections since before the country was founded. This is a good thing , because it keeps elections close to the people, accountable to the people. The last thing we need is nationalized elections. That would make all of our elections vulnerable together. And that includes federal funding for state and local elections, because…

All it means is a foreign entity like Russia just attacks each state differently. It won't stop them. Clearly, we are doing literally what you're saying, and it hasn't worked. Elections, in the 21st century, should fall within the range of national defense. Power grids and other types of infrastructure are, why not the democratic infrastructure like elections and voting? > The last thing we need is nationalized elect…

> All it means is a foreign entity like Russia just attacks each state differently. It won't stop them. Clearly, we are doing literally what you're saying, and it hasn't worked.

This country has been around for over 200 years. Our elections have worked well, or else we wouldn't be having this conversation.

> Elections, in the 21st century, should fall within the range of national defense. Power grids and other types of infrastructure are, why not the democratic infrastructure like elections and voting?

No, they shouldn't. I want my city, county, and state elections run by my city, county, and state, so that when something goes wrong, I can go to the city, county, or state to see about making it right, and even run for office locally to fix it myself, or go to the state capital at worst--not have to go to Washington, D.C. and complain to some bureaucrat that hasn't even heard of my city and couldn't care less about my state.

> Or you know, the ability for elections to actually be fixed in a systemic fashion. It's really the only way.

Bald assertion.

> I really don't understand this attitude. To take an example from the software industry, would you rather have your users on one OS, for you to secure, or 20+ different ones, where you need to plug holes independently?

You're looking at it the wrong way. What is easier to attack: a homogeneous network in which every machine has the same, known vulnerabilities, or a heterogeneous network in which only subsets of machines have certain vulnerabilities? What is easier to destroy: a forest comprised of a single species with the same vulnerabilities to certain pathogens, or a forest with a variety of species?

Recent history shows the inherent risk of homogeneous networks, e.g. the NotPetya worm that took down global IT infrastructure for the biggest companies in the world in a matter of seconds: https://www.wired.com/story/notpetya-cyberattack-ukraine-rus...

This country was designed around compartmentalization. If one state enacts bad policies, has corrupt government, etc, it doesn't necessarily affect every other state. But when the federal government makes bad decisions and becomes corrupt, it does affect every state.

You want our elections to be more easily compromised, more easily controlled by third parties? Nationalize them. Use the same systems and rules and policies everywhere. Make every election, everywhere, have the same, known flaws and vulnerabilities. Make every election, everywhere, reliant on the slow-moving federal government to fix problems that states and localities could fix independently and quickly.

> Fix one issue with a voting machine, fix them all, as opposed to just fixing Florida's specific homegrown crap.

How about letting Florida worry about fixing Florida's elections, and you fix yours. I don't think you'd like Florida telling you how to run your elections, but that's exactly what you propose in reverse. It's antithetical to liberty.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#108

Earlier quoted context omitted.

All it means is a foreign entity like Russia just attacks each state differently. It won't stop them. Clearly, we are doing literally what you're saying, and it hasn't worked. Elections, in the 21st century, should fall within the range of national defense. Power grids and other types of infrastructure are, why not the democratic infrastructure like elections and voting? > The last thing we need is nationalized elect…

> All it means is a foreign entity like Russia just attacks each state differently. It won't stop them. Clearly, we are doing literally what you're saying, and it hasn't worked. This country has been around for over 200 years. Our elections have worked well, or else we wouldn't be having this conversation. > Elections, in the 21st century, should fall within the range of national defense. Power grids and other types…

> This country has been around for over 200 years. Our elections have worked well, or else we wouldn't be having this conversation.

Doesn't follow; countries can exist for a long time without elections at all, and, a fortiori, without elections that “work well”. Our existence and ability to debate th topic doesn't prove our elections worked well on average over history, or that they've been working well in their most recent form. Or much of anything else.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#109
post #58

Earlier quoted context omitted.

Right, you should do that, but not all voters have the means to research beforehand.

You can research at the library for free. You can ask other people's opinions for free. Newspapers are inexpensive and widely available. I'm sure there are other options I'm missing. Who doesn't have the means for free?

I'm willing to send you "Evicted" in ebook format if you email the address in my profile. That's the best way I can think of to share with you the experience of being dirt poor in America, and why the things you just listed are irrelevant to a massive swath of Americans.

Re: DEF CON report on vulnerabilities in US election infrastructure [pdf]

#110

Earlier quoted context omitted.

> From my perspective, democrats are working to improve election security while republicans are not. Does voter ID improve election security? Which party opposes voter ID laws?

>Does voter ID improve election security? It does not.

Voter ID addresses a threat model that has been repeatedly proven to be minor at worst. It does absolutely nothing for the much more serious threat model of digital tampering.
Post reply on HN