Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cylance Discloses Voting Machine Vulnerability

blog.cylance.com

Post reply on HN
Print view View original

101–110 of 127 posts

Re: Cylance Discloses Voting Machine Vulnerability

#101

Post by heisenbit »

mpweiher wrote: post #33

I really don't see what problem these machines are solving, except for "as an operative, I would like additional vectors to manipulate the election". In Germany, we get (a) a paper ballot (b) a pen Works perfectly. And quickly.

It is also worth pointing out that while this is labor intensive it can be

- scaled reasonably down. Which allows polling places staffed by fewer people.

- allows a higher number of voting stations as only a low tech physical curtain is needed to ensure privacy.

- throughput is primarily limited by identity verification which takes a cross check of ID document and voting notification card that is mailed to any eligible person once they reach their 18th birthday.

Re: Cylance Discloses Voting Machine Vulnerability

#102

Post by mark_edward »

cperciva wrote: post #90
chipperyman573 wrote: post #75

Earlier quoted context omitted.

I live in a mail-in state (WA) and in my opinion it's a pretty great system. I got my ballot almost two weeks ago and just sent it in last week. I was able to fill it out when I had free time and drop it in a ballot box (there's one about 5 minutes from where I live by foot, and I could always just mail it in if I wanted to). Lining up to vote at the polls would've been a lot more time-consuming because I would have…

I live in a mail-in state (WA) and in my opinion it's a pretty great system. What mechanism, if any, is in place to prevent voters from being coerced or bribed to cast their vote a particular way? This is the traditional reason for using in-person voting rather than mailed ballots; if you can't show someone how you voted, they can't bribe or coerce you. (Maybe the answer is "there is no mechanism", but increasing the…

I think you're guarding against different things. If you live in a society where there are (following historical patterns here) patriarchs coercing the votes of spouses and dependents you probably have a whole slew of other problems that make this particular one just part of a larger social reform that should happen anyway.

Re: Cylance Discloses Voting Machine Vulnerability

#103

Post by sschueller »

slim wrote: post #40
Shank wrote: post #2

I worked as an election judge in the 2012 general election in Arapahoe County, Colorado. We had these exact machines. What isn't pictured is the physical security performed with them. Typically, tamper seals that are identifiable as broken are placed on all access doors (including the power switch, data load slots, etc), access panels, and openings on the device. All seals were verified in tact before and after the e…

You mean I could void all the votes simply by tampering with the seal? Seams like an easy attack

I think that is correct. If the seal is broken you can not guarantee that the votes are correct especially if there is no paper trail.

So for maximum impact make sure you go break the seal at the end of the day...

How many votes are stored on a single machine in a large district?

Re: Cylance Discloses Voting Machine Vulnerability

#104

Post by codingdave »

motardo wrote: post #16
pmoriarty wrote: post #4

Earlier quoted context omitted.

I'd feel a million times more confident in a simple pen and paper voting system.

Yes. With paper ballots, cheating is at least detectable because there is literally a paper trail. With touch screens, maybe the results are correct, maybe the machine miscounted. There is no way to really know.

The machine I used in early voting also had a paper trail - when you submitted the votes, it printed them as a secondary record. It was moving too fast for me to read all the votes as the paper went by, but the ones I caught were correct. So there is a literal paper trail there.

Re: Cylance Discloses Voting Machine Vulnerability

#105

Post by djrogers »

JumpCrisscross wrote: post #39
gergles wrote: post #12

Earlier quoted context omitted.

> It's preposterous to think that election judges aren't actively verifying seals during election day and making sure nobody is tampering with them. I've been an election worker around the country and have never been in a jurisdiction that did seal checks during the election - only once at the beginning and once at the end. Granted, I've never been in a jurisdiction using DREs, but still. I agree physical security is…

I have been an election worker. We were asked to sign the attestation envelopes in advance. I trust further checks were conducted higher up. But at our level, protocol was ignored.

I hope to God you refused and reported this. That's completely illegal and could get you in a lot of hot water - not to mention the potential for enabling vote fraud.

Re: Cylance Discloses Voting Machine Vulnerability

#106

Post by djrogers »

peterarmstrong wrote: post #37

Dear America, This all sounds complicated and insecure. Why can you not just do paper voting with simple ballots, like in Canada? Yes, you have 10x the people, but just get 10x the human counters and scrutineers. Counting is parallelizable. We run elections and get accurate, verifiable results in the same day. Ours aren't as nasty as yours are, and we still have better anti-fraud than you do, since every paper ballot…

> Why can you not just do paper voting with simple ballots, like in Canada?

Some places do - voting is handled at the state and county level, not federal. For example. I vote on paper in the county where I live.

> You've had some problems with your ballots 16 years ago, and we're not sure why you haven't fixed this by now.

Those were paper ballots, what you see now is largely an attempt to avoid similar multi-day challenges and recounts due to hanging chads and ambiguous markings on paper ballots.

Re: Cylance Discloses Voting Machine Vulnerability

#107

Post by MichaelGG »

nashashmi wrote: post #61
peterarmstrong wrote: post #37

Dear America, This all sounds complicated and insecure. Why can you not just do paper voting with simple ballots, like in Canada? Yes, you have 10x the people, but just get 10x the human counters and scrutineers. Counting is parallelizable. We run elections and get accurate, verifiable results in the same day. Ours aren't as nasty as yours are, and we still have better anti-fraud than you do, since every paper ballot…

In Florida in 2000, we had these old voting machines where the voter would go into the booth, hit a bunch of buttons, and submit the vote. The voting card in the back would fall. There were often errors on them via ineffective button pushes, incorrect push, last minute mind change, and it would result in dubious votes. Some votes were discarded. There is no doubt that sometimes the vote went to the wrong candidate. D…

How does this show the need for e-voting? It just shows the need for decent engineering. It's silly to pretend a computer is the only solution here. You can add on instant counting, too, with a camera and slot to drop the ballot in.

Re: Cylance Discloses Voting Machine Vulnerability

#108

Post by djrogers »

cperciva wrote: post #90
chipperyman573 wrote: post #75

Earlier quoted context omitted.

I live in a mail-in state (WA) and in my opinion it's a pretty great system. I got my ballot almost two weeks ago and just sent it in last week. I was able to fill it out when I had free time and drop it in a ballot box (there's one about 5 minutes from where I live by foot, and I could always just mail it in if I wanted to). Lining up to vote at the polls would've been a lot more time-consuming because I would have…

I live in a mail-in state (WA) and in my opinion it's a pretty great system. What mechanism, if any, is in place to prevent voters from being coerced or bribed to cast their vote a particular way? This is the traditional reason for using in-person voting rather than mailed ballots; if you can't show someone how you voted, they can't bribe or coerce you. (Maybe the answer is "there is no mechanism", but increasing the…

> What mechanism, if any, is in place to prevent voters from being coerced or bribed to cast their vote a particular way?

If imcoerced into voting a particular way on my mail-in ballot, I can go to the polling place in Election Day and fill out a provisional ballot hat will be counted in place of my coerced ballot. Not perfect, but this year it allows me to vote even though I'm out of the state next week.

Re: Cylance Discloses Voting Machine Vulnerability

#109

Post by Mtinie »

slim wrote: post #40
Shank wrote: post #2

I worked as an election judge in the 2012 general election in Arapahoe County, Colorado. We had these exact machines. What isn't pictured is the physical security performed with them. Typically, tamper seals that are identifiable as broken are placed on all access doors (including the power switch, data load slots, etc), access panels, and openings on the device. All seals were verified in tact before and after the e…

You mean I could void all the votes simply by tampering with the seal? Seams like an easy attack

Internally applied seals would be one form of defense against this vector.

Breaking the external seals would put the device into the "needs further investigation" category. After the election the device would be inspected and the internal seals confirmed. If those were still intact, the results from the machine could be certified.

Re: Cylance Discloses Voting Machine Vulnerability

#110

Post by [deleted] »

slim wrote: post #40
Shank wrote: post #2

I worked as an election judge in the 2012 general election in Arapahoe County, Colorado. We had these exact machines. What isn't pictured is the physical security performed with them. Typically, tamper seals that are identifiable as broken are placed on all access doors (including the power switch, data load slots, etc), access panels, and openings on the device. All seals were verified in tact before and after the e…

You mean I could void all the votes simply by tampering with the seal? Seams like an easy attack

[deleted]
Post reply on HN