Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cylance Discloses Voting Machine Vulnerability

blog.cylance.com

Post reply on HN
Print view View original

111–120 of 127 posts

Re: Cylance Discloses Voting Machine Vulnerability

#111

Post by akhilcacharya »

empath75 wrote: post #23
alexandercrohde wrote: post #11

I think it's high time we start taking these concerns seriously. If state actors can accomplish stuxnet, then hacking a voting system seems well within the realm of technical possibility. Fortunately, there are pretty simple policies we can enact to prevent fraud and give faith in elections (both in America, as well as other countries). If you care, I'd perhaps start at https://www.verifiedvoting.org/

They don't even need to throw the election. Two or three machines with absurd results in favor of Clinton or Trump would be enough to push the county into civil unrest.

Only if it's in a tipping point state.

Re: Cylance Discloses Voting Machine Vulnerability

#112

Post by code_duck »

campuscodi wrote: post #93
code_duck wrote: post #32

Earlier quoted context omitted.

not sure are aware, but the actual quote is "The decision to announce the research findings was intended to encourage remediation of the vulnerabilities prior to Election Day".

3 days before the election.... sure it was...

It doesn't seem likely they were seeking contracts or revenue at this time either. Perhaps making a political statement?

Re: Cylance Discloses Voting Machine Vulnerability

#113

Post by colejohnson66 »

jacalata wrote: post #83
blazespin wrote: post #41

Earlier quoted context omitted.

Exactly, more people counting is not a problem. It's actually a good thing. Why not get more people involved in the electoral process? It's beyond me why anyone would want to undermine this. Plus, I don't get the mail in states. What's up with that? Why mess with a process that works?

I'd say anywhere that people can literally have to choose between their job and their vote is not "working", which is why it needed messing with. Its hard for a lot of people to get to a specific location on any given day - there's no good reason today that a week in bed with the flu should prevent you from voting. Or that it should be harder to vote if you have three kids and no babysitter, or are on crutches, or wo…

> or work an irregular schedule at a minimum wage job

The law in California[0] guarantees you the right to vote even if you are scheduled that day. You can take up to two hours off the beginning or end of your shift to vote if necessary. For other states...[1]

[0]: CEC§14000 http://www.leginfo.ca.gov/cgi-bin/displaycode?section=elec&g...

[1]: http://www.findlaw.com/voting-rights-law.html

Re: Cylance Discloses Voting Machine Vulnerability

#114

Post by [deleted] »

Shank wrote: post #2

I worked as an election judge in the 2012 general election in Arapahoe County, Colorado. We had these exact machines. What isn't pictured is the physical security performed with them. Typically, tamper seals that are identifiable as broken are placed on all access doors (including the power switch, data load slots, etc), access panels, and openings on the device. All seals were verified in tact before and after the e…

[deleted]

Re: Cylance Discloses Voting Machine Vulnerability

#115

Post by CoryG89 »

wfunction wrote: post #50
oxide wrote: post #47

Earlier quoted context omitted.

that's a risk you have to take, at some point. you eventually have to trust that someone isn't lying, somewhere along the chain. what else could be done to further vet volunteers? you can't interrogate people or drug them with serums for the truth, so I think it's safe to assume registering is enough. so, to answer your question, I doubt there is any "guarantee" other than the fact that these are volunteers and you'd…

> that's a risk you have to take Well, obviously. But the risk can be high or low, right? You could either let any random voter you don't know walk in and become a volunteer after filling out a form, or you could let maybe ~50 people that the party's head/nominee personally trust pick a set of volunteers nationally based on e.g. personal knowledge or some concrete evidences of their past contributions and allegiance…

Maybe it's just me, but I think I would be more comfortable pulling 50 random people off the street to count votes than I would be with 50 volunteers appointed by the candidates, who have a much bigger incentive to violate the integrity of the vote (if needed).

Re: Cylance Discloses Voting Machine Vulnerability

#116

Post by specialist »

nashashmi wrote: post #61
peterarmstrong wrote: post #37

Dear America, This all sounds complicated and insecure. Why can you not just do paper voting with simple ballots, like in Canada? Yes, you have 10x the people, but just get 10x the human counters and scrutineers. Counting is parallelizable. We run elections and get accurate, verifiable results in the same day. Ours aren't as nasty as yours are, and we still have better anti-fraud than you do, since every paper ballot…

In Florida in 2000, we had these old voting machines where the voter would go into the booth, hit a bunch of buttons, and submit the vote. The voting card in the back would fall. There were often errors on them via ineffective button pushes, incorrect push, last minute mind change, and it would result in dubious votes. Some votes were discarded. There is no doubt that sometimes the vote went to the wrong candidate. D…

"... these voting machine issues clearly showed the need for electronic voting machine booths..."

The hanging chad fiasco showed the need for following established procedures. Those particular machines had not been cleaned for multiple years. So the holes filled up. Preventing new votes from being cast.

The problem electronic voting machines solved was the vendors were envious of dot com valuations. The HAVA pork triggered a gold rush by the vendors, juicing their revenue and stock prices and exec payouts. The gear didn't actually solve any technical problems. They weren't even "accessible", which was their primary stated purpose.

Re: Cylance Discloses Voting Machine Vulnerability

#117

Post by shshhdhs »

azernik wrote: post #99
scoot wrote: post #91

Earlier quoted context omitted.

So someone could spoil all the votes by breaking the seals?

Sure. And they could also spoil all the votes with an armed robbery - at many polling stations, there's no actual police presence until/unless someone calls them in. The main intent of all the security measures is that any such tampering be obvious, and that it be clear whose votes (or at least, which precincts' votes) were compromised.

Sure, but that doesn't address an attack that certain precincts that vote a specific party line could be compromised. If 100 attackers at 100 precincts slit some seals than that could swing a swing state

Re: Cylance Discloses Voting Machine Vulnerability

#118

Post by kilotaras »

tajen wrote: post #86
cperciva wrote: post #62

Earlier quoted context omitted.

Why can you not just do paper voting with simple ballots, like in Canada? As much as I like Canada's easily audited voting system, there's a good reason for the US to not use a simple way of counting votes: They don't have simple ballots . Rather than just voting for one MP, as we do, a typical American might be asked to vote for a President, a Senator, a Representative, yes/no on 17 state propositions, a State Senat…

Ask Switzerland how they manage paper ballots for 25 different votes every 4 months .

"Do you know one state in USA is as big as Switzerland." That's the kind of an answer a big part of population tend to give when you point other countries as examples.

Re: Cylance Discloses Voting Machine Vulnerability

#119

Post by anonbanker »

scoot wrote: post #91
azernik wrote: post #28

Earlier quoted context omitted.

In Alameda County, CA we use what look superficially to be the same machines, and have similar physical security measures - there are seals on all access points (e.g. on the cover protecting the power switch), and whenever we access one of them we save the seal's tag, log its ID, and log the ID of the replacement. At the end of the day you end up with basically a series of tags on a form that show chain of custody (t…

So someone could spoil all the votes by breaking the seals?

Basically, a team of 20 voters with boxcutters could spoil the results from an entire precinct.

Re: Cylance Discloses Voting Machine Vulnerability

#120

Post by pseudalopex »

djrogers wrote: post #108
cperciva wrote: post #90

Earlier quoted context omitted.

I live in a mail-in state (WA) and in my opinion it's a pretty great system. What mechanism, if any, is in place to prevent voters from being coerced or bribed to cast their vote a particular way? This is the traditional reason for using in-person voting rather than mailed ballots; if you can't show someone how you voted, they can't bribe or coerce you. (Maybe the answer is "there is no mechanism", but increasing the…

> What mechanism, if any, is in place to prevent voters from being coerced or bribed to cast their vote a particular way? If imcoerced into voting a particular way on my mail-in ballot, I can go to the polling place in Election Day and fill out a provisional ballot hat will be counted in place of my coerced ballot. Not perfect, but this year it allows me to vote even though I'm out of the state next week.

How many people know that? The Washington Secretary of State's FAQs don't mention coercion or bribery as reasons to receive a provisional or replacement ballot.[1][2] King County, with over 1/4 of the state's population, only mentions voting centers as an accessibility option.[3] And does the ballot tracker[4] show if a ballot is invalidated?

Every state has provisions for absentee voting, and 3/4 allow early voting in person.

[1] https://www.sos.wa.gov/elections/general-election-faqs.aspx

[2] https://www.sos.wa.gov/elections/faq_vote_by_mail.aspx

[3] http://www.kingcounty.gov/depts/elections/how-to-vote/ballot...

[4] https://info.kingcounty.gov/elections/ballottracker.aspx

Post reply on HN