Live data from Hacker News

Colorado scrambles to change voting-system passwords after accidental leak

arstechnica.com

71–80 of 682 posts

Re: Colorado scrambles to change voting-system passwords after accidental leak

#71

Please correct me where I'm mistaken. * This password list has been public for a long time, and is easy to access: hidden excel column on a public spreadsheet. * BIOS access means the intruder can change boot devices, boot their own OS, infect the BIOS with a virus, change boot devices back, compromise the vote host OS. * Keycard security isn't tight security. Any amature physical penetration tester would just use a…

[flagged]

[flagged]

Re: Colorado scrambles to change voting-system passwords after accidental leak

#72
post #6

The Indian Voting Machines are the answer. No operating system, no passwords, no connections, no bruteforcing anything, system on a chip, so widely distributed devices that hacking even a few of them is challenging, etc. The US voting machines are just waiting to be hacked, just a matter of when, not if.

I think random, serialized paper ballots are the way to go. When the polls close you know the serial numbers of every vote cast, so no new serial numbers should be added to that unless a very good reason. Keep them or destroy them afterwards is another issue, but it's a step in the right direction. I have some distrust in the American voting system, first with the computerized systems, but also that federal elections…

What do you do when duplicate serial numbers start showing up? I'm assuming you won't know who was issued which serial number, and if it's truly randomized you wouldn't even know where they were sent.

Re: Colorado scrambles to change voting-system passwords after accidental leak

#73
post #59

Earlier quoted context omitted.

Mail-in ballots are worst of all, and the people who advocate for their expansion will regret it when they see entire church memberships filling out their ballots together, checking each other to make sure they voted correctly, and shunning, expelling, or firing people who don't participate. There are currently many heads of household voting for their entire families, and even aside from mail-in ballots, there are pe…

[flagged]

Because places of worship in Christianity are usually called churches and Christianity is the most common religion in the United States.

So if I was going to pick a single word used to represent places of worship when describing such in the United States, “churches” would be a good choice.

Re: Colorado scrambles to change voting-system passwords after accidental leak

#75
post #70
post #44

Earlier quoted context omitted.

Including the safeguards where observers are safely kept away from the counting! There were a lot of irregularities in 2020. The supreme Court recently said Pennsylvania should not have counted some of the ballots it did in 2020 (policy change by secretary of state vs legislature).

>There were a lot of irregularities in 2020. Source? I thought all the election fraud lawsuits/investigations for the 2020 election basically went nowhere?

For lack of standing or lack of ability to relieve yes. Courts aren't going to question a presidential election. That doesn't mean we can't look at the videos of observers being banned, the facts of now-declared-illegal extra-legislative policy changes, the timings of various ballot drops etc.

Opinions aren't formed on court cases. That's why in 2020, more than half of Democrats thought the election was irregular. It's remarkable to me because this is one of those issues where polling says voters of both parties agree, but the media insists that there's nothing there. That's crazy

Re: Colorado scrambles to change voting-system passwords after accidental leak

#76
post #26

Earlier quoted context omitted.

"Prove that you voted for Putin or you are out of a job".

Which is what troubles me about making auditable digital voting systems. I'm not sure how you could do it while preserving the secret ballot. About the best I can come up with is a QR code displayed on the screen and on a printout that you can compare with a third party phone app. Machine results are tabulated, and the QR code sheet is put in a lock box separately. This at least provides some way to compare what the…

>About the best I can come up with is a QR code displayed on the screen and on a printout that you can compare with a third party phone app.

That's definitely not secret. If you can audit it on your phone, baddies can force you to show your phone to verify that you voted "correctly".

Re: Colorado scrambles to change voting-system passwords after accidental leak

#77

Please correct me where I'm mistaken. * This password list has been public for a long time, and is easy to access: hidden excel column on a public spreadsheet. * BIOS access means the intruder can change boot devices, boot their own OS, infect the BIOS with a virus, change boot devices back, compromise the vote host OS. * Keycard security isn't tight security. Any amature physical penetration tester would just use a…

> Where am I technically wrong here? I'm sure I'm missing something obvious.

As I understand that article, BIOS access requires two passwords, and the list only provides one of the two passwords. So, instead of "password list" I would say "partial-password list".

The list also misses "There is 24/7 video camera recording on all election equipment." Of course, you can raise concerns and failure modes about video recordings, but that all brings up the question "Were those recordings compromised?" You should not assume that they were.

Re: Colorado scrambles to change voting-system passwords after accidental leak

#78

Earlier quoted context omitted.

Mail-in ballots are worst of all, and the people who advocate for their expansion will regret it when they see entire church memberships filling out their ballots together, checking each other to make sure they voted correctly, and shunning, expelling, or firing people who don't participate. There are currently many heads of household voting for their entire families, and even aside from mail-in ballots, there are pe…

It's been the method of voting in Oregon for 25 years and Colorado for 10 years, when does the regret start? The current states that have all mail voting are also some of the least religious states in the country, you'd think the religious states would be pushing for it given the scenario you laid out. Colorado also had the second highest voter turn out nationwide in 2020 which supports the claim that all mail voting…

Oregon should never be the gold standard for how to do anything, ever. Can they even pump their own gas yet?

Re: Colorado scrambles to change voting-system passwords after accidental leak

#79
post #57

Earlier quoted context omitted.

>I hear some people say "but we use paper ballots". Then why do you have a BIOS password? If it's all paper where does the computer fit in? All of this is honest curiosity, I'm not sure how the voting system works. Not sure about Colorado specifically, but in many jurisdictions voters mark paper ballots, which go into a machine to be tabulated, and are finally deposited into a box for safe keeping/future recounts.

You get to feed the ballot into the (literal) black box yourself, it beeps and tells you your vote has been recorded. What did it record? Who knows?

> What did it record? Who knows?

How is it any different than traditional voting, where you drop your ballot into a black box and trust the poll workers would count it correctly?

You can do random spot checks select boxes to make sure the machine is tabulating correctly. If they're all correct, you can be reasonably sure the others are correct as well, unless your adversary has incredible luck.

Re: Colorado scrambles to change voting-system passwords after accidental leak

#80
post #73
post #59

Earlier quoted context omitted.

[flagged]

Because places of worship in Christianity are usually called churches and Christianity is the most common religion in the United States. So if I was going to pick a single word used to represent places of worship when describing such in the United States, “churches” would be a good choice.

[flagged]
Post reply on HN