Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cylance Discloses Voting Machine Vulnerability

blog.cylance.com

Post reply on HN
Print view View original

81–90 of 127 posts

Re: Cylance Discloses Voting Machine Vulnerability

#81

Post by laser »

JumpCrisscross wrote: post #39
gergles wrote: post #12

Earlier quoted context omitted.

> It's preposterous to think that election judges aren't actively verifying seals during election day and making sure nobody is tampering with them. I've been an election worker around the country and have never been in a jurisdiction that did seal checks during the election - only once at the beginning and once at the end. Granted, I've never been in a jurisdiction using DREs, but still. I agree physical security is…

I have been an election worker. We were asked to sign the attestation envelopes in advance. I trust further checks were conducted higher up. But at our level, protocol was ignored.

You've got to be kidding? Why would you comply with that? Sounds completely illegal?

Re: Cylance Discloses Voting Machine Vulnerability

#82

Post by newjersey »

rblatz wrote: post #55
Pinckney wrote: post #44

Earlier quoted context omitted.

Absurd results aren't what you want, since they're readily dismissed as localized, and people could believe that hacking had no effect on the overall result. You want to prove that hacking took place, but subtly, so that people can imagine it was widespread. More effective would be to preselect a precise number of votes for a few machines in a swing state, with totals just 3-4 percentage points higher than what polli…

If you used a one time pad you could skip the whole hack the election part and generate a key that reflects the actual totals after they've been published.

Hm... Is it a crime to write an email, not under oath, to a journalist accepting responsibility for a crime that one didn't commit (and had no idea was taking place)? I'd like to answer no but I'm sure a judge would use the "fire!" In a crowded movie theater analogy to answer in the affirmative.

Re: Cylance Discloses Voting Machine Vulnerability

#83

Post by jacalata »

blazespin wrote: post #41
peterarmstrong wrote: post #37

Dear America, This all sounds complicated and insecure. Why can you not just do paper voting with simple ballots, like in Canada? Yes, you have 10x the people, but just get 10x the human counters and scrutineers. Counting is parallelizable. We run elections and get accurate, verifiable results in the same day. Ours aren't as nasty as yours are, and we still have better anti-fraud than you do, since every paper ballot…

Exactly, more people counting is not a problem. It's actually a good thing. Why not get more people involved in the electoral process? It's beyond me why anyone would want to undermine this. Plus, I don't get the mail in states. What's up with that? Why mess with a process that works?

I'd say anywhere that people can literally have to choose between their job and their vote is not "working", which is why it needed messing with. Its hard for a lot of people to get to a specific location on any given day - there's no good reason today that a week in bed with the flu should prevent you from voting. Or that it should be harder to vote if you have three kids and no babysitter, or are on crutches, or work an irregular schedule at a minimum wage job.

Re: Cylance Discloses Voting Machine Vulnerability

#84

Post by zwp »

gcb0 wrote: post #66
gergles wrote: post #12

Earlier quoted context omitted.

> It's preposterous to think that election judges aren't actively verifying seals during election day and making sure nobody is tampering with them. I've been an election worker around the country and have never been in a jurisdiction that did seal checks during the election - only once at the beginning and once at the end. Granted, I've never been in a jurisdiction using DREs, but still. I agree physical security is…

also trivial for attackers to have replacement plastic seals is their pockets

The seals aren't signed by election officials?

I'm not familiar with seals used on voting machines but that's common in other "tamperproof container" scenarios.

Re: Cylance Discloses Voting Machine Vulnerability

#85

Post by noir-york »

Democracy must not only be done, but also seen to be done. Trust in that most essential of democratic processes - vote counting - must be absolute.

Approaching vote counting as a mere technical problem that can be solved with enough technical safeguards misses the point. You cannot just ask a democracy to beta test vote counting and fix the bugs post-election - that will kill trust in the process.

Politics is polarised enough as is and you will find demagogues who will latch on to anything to reduce the legitimacy of an election.

It shouldn't even be up for discussion that trust and legitimacy are the most important goals in vote counting. Stick to paper voting and only introduce e-voting in parallel and not as the authoritative and final vote counting solution.

Re: Cylance Discloses Voting Machine Vulnerability

#86

Post by tajen »

cperciva wrote: post #62
peterarmstrong wrote: post #37

Dear America, This all sounds complicated and insecure. Why can you not just do paper voting with simple ballots, like in Canada? Yes, you have 10x the people, but just get 10x the human counters and scrutineers. Counting is parallelizable. We run elections and get accurate, verifiable results in the same day. Ours aren't as nasty as yours are, and we still have better anti-fraud than you do, since every paper ballot…

Why can you not just do paper voting with simple ballots, like in Canada? As much as I like Canada's easily audited voting system, there's a good reason for the US to not use a simple way of counting votes: They don't have simple ballots . Rather than just voting for one MP, as we do, a typical American might be asked to vote for a President, a Senator, a Representative, yes/no on 17 state propositions, a State Senat…

Ask Switzerland how they manage paper ballots for 25 different votes every 4 months.

Re: Cylance Discloses Voting Machine Vulnerability

#87

Post by tribby »

sfifs wrote: post #65

I wonder why countries don't use India's simple and scalable electronic voting systems. The latest ones have voter verified paper audit trails. They even have pooling systems to prevent counts from any single voting booth become known to prevent voter intimidation. https://en.m.wikipedia.org/wiki/Electronic_voting_in_India

I believe you've answered your own question, unfortunately.

Re: Cylance Discloses Voting Machine Vulnerability

#88

Post by tajen »

chipperyman573 wrote: post #78
jackweirdy wrote: post #69

Earlier quoted context omitted.

Same in the UK. Anyone who can vote can also take part in "The Count", where groups of volunteers count the votes in regional centres.

Wouldn't that be easy to spoof numbers? Getting a few hundred people to add 10 or 15 to a candidate in a swing state could make a huge difference.

There are 3 volunteers to tell, write and cross-check the paper ballot; and it's a public audience, meaning that there are a bunch of witnesses, including families who want to teach kids why the votes can be trusted, and party representatives who want to check that the election is not tampered with. It's hard to cheat when so many people can testify.

Re: Cylance Discloses Voting Machine Vulnerability

#89

Post by cperciva »

hubert123 wrote: post #71
cperciva wrote: post #62

Earlier quoted context omitted.

Why can you not just do paper voting with simple ballots, like in Canada? As much as I like Canada's easily audited voting system, there's a good reason for the US to not use a simple way of counting votes: They don't have simple ballots . Rather than just voting for one MP, as we do, a typical American might be asked to vote for a President, a Senator, a Representative, yes/no on 17 state propositions, a State Senat…

How do you even come up with these weird convoluted non-arguments, we have many choices on a single ballot here too. It's called a list. You can put lists on paper.

In Canadian federal elections, the vote counting process is:

1. Open the box. 2. Dump the ballots onto the table. 3. Make sure the box is empty. 4. Pick up ballots one by one, say "this looks like a vote for "Mr. X", and place into the appropriate pile. 5. Count how many ballots are in each pile.

This particular process doesn't work if you have multiple choices on one ballot. I'm not saying that you can't use paper ballots for more complex elections -- you absolutely should, for the well-known verifiability reasons -- just that the counting process is never going to be as simple as the Canadian (or UK) process.

Re: Cylance Discloses Voting Machine Vulnerability

#90

Post by cperciva »

chipperyman573 wrote: post #75
blazespin wrote: post #41

Earlier quoted context omitted.

Exactly, more people counting is not a problem. It's actually a good thing. Why not get more people involved in the electoral process? It's beyond me why anyone would want to undermine this. Plus, I don't get the mail in states. What's up with that? Why mess with a process that works?

I live in a mail-in state (WA) and in my opinion it's a pretty great system. I got my ballot almost two weeks ago and just sent it in last week. I was able to fill it out when I had free time and drop it in a ballot box (there's one about 5 minutes from where I live by foot, and I could always just mail it in if I wanted to). Lining up to vote at the polls would've been a lot more time-consuming because I would have…

I live in a mail-in state (WA) and in my opinion it's a pretty great system.

What mechanism, if any, is in place to prevent voters from being coerced or bribed to cast their vote a particular way? This is the traditional reason for using in-person voting rather than mailed ballots; if you can't show someone how you voted, they can't bribe or coerce you.

(Maybe the answer is "there is no mechanism", but increasing the ease of voting is considered more important than protecting the system from coercion and bribery. Not a tradeoff I would make, but I can see that some people would support that.)

Post reply on HN