Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

To Protect Voting, Use Open-Source Software

mobile.nytimes.com

Post reply on HN
Print view View original

61–70 of 237 posts

Re: To Protect Voting, Use Open-Source Software

#61

Post by drdaeman »

pjmorris wrote: post #50
drdaeman wrote: post #39

Earlier quoted context omitted.

There are attempts to create an end-to-end auditable voting systems. Where you don't have to trust the organizers or machinery to not trick you, and you can validate that your vote was counted correctly. https://en.wikipedia.org/wiki/End-to-end_auditable_voting_sy... Sadly, as far as I know, none is without issues (older systems were found to have various problems, and newer stuff is still bleeding edge that wasn't y…

The trick is that you don't just have to convince somebody (a security expert) that the system is trustworthy, you have to convince everyone (voters) that the system is trustworthy. Anything more complicated than paper ballots counted in public will leave room for doubt.

There are systems that are essentially paper ballot and by no means remove the "classic" experience, but have extra properties that allow audit, e.g. https://en.wikipedia.org/wiki/Punchscan

Re: To Protect Voting, Use Open-Source Software

#62

Post by zAy0LfpBZLC8mAC »

octalmage wrote: post #60
TeMPOraL wrote: post #25

Earlier quoted context omitted.

Where is the good old Anonymous when we need them? We need a high-profile hack of some local elections to drive that point home. Something done completely for teh lulz, leading to a result so absurd the elections would have to be redone.

At defcon this year they had a bunch of the popular electronic voting booths set up, and they were all hacked within 6 hours. A big problem is having physical access to the booth. All of the hacks involve picking a lock.

Given that the voting computers sit in some warehouse between elections, that's not really a big hurdle.

Re: To Protect Voting, Use Open-Source Software

#63

Post by Iv »

TeMPOraL wrote: post #25
danirod wrote: post #3

Electronic voting is a bad idea and I'd be suspicious on anyone trying to promote it. How can you know that even if the source code for the voting machine is open, the voting machine is running the exact same source code? How can you know nobody has tampered the code the instance is running? I'm glad my country is still running on paper ballots and glad we require voter ID.

Where is the good old Anonymous when we need them? We need a high-profile hack of some local elections to drive that point home. Something done completely for teh lulz, leading to a result so absurd the elections would have to be redone.

If all that was at risk was a night in police jail and a slap on the wrist, it would be done, but reading the sentences one faces for election tampering is really chilling.

I would not risk it for a million, I will certainly not risk it for the lulz. Plus, in most cases, it involves (laughably weak) physical security. I am less confident on how to hide my tracks there and I suppose many would-be hackers feel the same.

Re: To Protect Voting, Use Open-Source Software

#64

Post by feintruled »

richardknop wrote: post #28
Accacin wrote: post #20

Earlier quoted context omitted.

My country doesn't require voter ID at all, other than confirming a few details and most studies here has shown that requiring ID didn't cut down on fraud. For me it's important that the barrier to voting is as low as possible, and we don't have a governement issued ID that is free.

That should be solved by issuing a free government ID, not by compromising and creating a giant loophole when potentially citizens of other countries can vote in your election and there is no way to verify that.

Not as easy as it sounds. I was in a Government office for some tax related reason and was in line behind some guys trying to apply for their 'electrical card' (sic, electoral). This is in N. Ireland, which unlike the rest of the UK requires ID to vote.

They were having to be talked through filling in the form only to hit a roadblock when it came to proof of address. After expressing their voluble disbelief at some length that the handwritten doctor's note they had would not suffice, they eventually left empty-handed. (Incidentally, they were only looking the card to use it for ID for flying, they had no interest in voting).

Now these guys were obviously jokers, but it shows you will need a certain degree of application and time to get even the most rudimentary of verifiable ID. Even the conscientious may find themselves not getting around to getting the ID before election and losing their vote.

Re: To Protect Voting, Use Open-Source Software

#65

Post by cmiles74 »

danirod wrote: post #3

Electronic voting is a bad idea and I'd be suspicious on anyone trying to promote it. How can you know that even if the source code for the voting machine is open, the voting machine is running the exact same source code? How can you know nobody has tampered the code the instance is running? I'm glad my country is still running on paper ballots and glad we require voter ID.

The vote processing chain is lengthy, it is inevitable that a computer system will be inserted somewhere in that chain. Right now the push is to have these systems right at the front, facing the voter, but that isn't the only time the votes are processed electronically.

In my district we vote by coloring in little circles with a #2 pencil, we then feed that directly into an electronic machine that tallies the results for my district. While the paper I handled is stored in the machine, I am sure that the results are transmitted to the next link in the chain through some computer system.

With so many links in the chain, it's my opinion that it's unreasonable to expect them all to be processed by people. It won't scale and I'm not convinced that it's that much safer anyway. It would be my preference that the pieces of the system that perform this processing are backed with open source software.

At the very least, if there is a case where tampering is suspected, officials of the court can compare the software on the machine with the software in the repository. This would prove in a clear and straightforward manner that tampering has occurred.

As painful as it is, I think we all need to trust the state, to some degree, to do the jobs that are the responsibility of the state. Once the votes have been tallied for a district, isn't it possible to tamper with them as they are transmitted up the chain to the next link in the processing? Or when regions of the state send their votes up to whatever the next link might be? I think that is possible, the best we can hope for is to push for as much transparency as possible and hope that, if it comes to it, we have enough data to detect such tampering.

Re: To Protect Voting, Use Open-Source Software

#66

Post by alkoumpa »

fredley wrote: post #5
alkoumpa wrote: post #2

to protect voting, audit your software/system extensively. Openssh is open-source and we all know the story..

But how can I (a voter), audit it in the voting booth? How can I verify that the extensively audited software is actually running on the machine in front of me?

do you think these questions are addressed by open-source software? I mean, if you only have a few buttons in front of you, how can you verify/audit the software it's running?

Re: To Protect Voting, Use Open-Source Software

#67

Post by cmiles74 »

ai_ja_nai wrote: post #29

This is plain bullshit. Opensource gives no guarantee that the vote won't be altered by whoever runs the machine. What we need is a zero-knowledge proof: we need the entire voting dataset to be publicly downloadable and some kind of checksumming so that, while maintaining anonimity, I can 1)check that my vote is the same 2)run whole the counting in a blink on my PC. This gives much better guarantees of no tampering

I think this make a lot of sense. I'm not sure a checksumming method that can indicate tampering can be devised, but my hope would be that by making the data publicly available for every stage of the processing pipeline, auditors or interested parties might be able to detect fraud.

Re: To Protect Voting, Use Open-Source Software

#68

Post by Iv »

danirod wrote: post #3

Electronic voting is a bad idea and I'd be suspicious on anyone trying to promote it. How can you know that even if the source code for the voting machine is open, the voting machine is running the exact same source code? How can you know nobody has tampered the code the instance is running? I'm glad my country is still running on paper ballots and glad we require voter ID.

Came here to say that.

Transparent voting boxes, ballots in envelopes, manual redundant counting done by people, usually voter who were nicely asked if they can come help back in the evening. That's what we use in France, you get the official result a few hours after the closing of the voting stations.

The whole process is watchable, from the sealing of the box the morning to the count in the end and parties send observers in random stations to check nothing fishy happens. An official log book is open for anyone to notice if they feel something fishy happened (you were not allowed to vote, the counting was unfair, etc...)

Oh, and make voting day a holiday, or just put it on Sundays.

I used to wonder how US could not even get that last part right, but then I understood that a whole party thinks it is in its interest to have less voters.

Re: To Protect Voting, Use Open-Source Software

#69

Post by alkoumpa »

alkoumpa wrote: post #2

to protect voting, audit your software/system extensively. Openssh is open-source and we all know the story..

plus, I might add, you can create secure software, that can't be penetrated from outside, but what about the hardware? Unless you write this (software) too, how can you trust the underlying hardware? e.g.: broadpwn. Yes, open source makes it easier to audit/collaborate/patch but it's not enough.
Post reply on HN