Slashdot Mirror
Master Diebold Key Copied From Web Site
Harrington writes "In another stunning blow to the security and integrity of Diebold's electronic voting machines, someone has made a copy of the key which opens ALL Diebold e-voting machines from a picture on the company's own website. " Update: 02/06 17:40 GMT by Z : We previously discussed this story, early last year.
Hmm, I seem to recall this story from somewhere...it sounds somehow strangely familiar...almost as if this exact thing had occurred before...
Oh, that's right, this story was covered -- right here on slashdot, no less -- a year ago, complete with a link to the very same now-year-old blog post, which was significantly updated at the time, and caused Diebold to remove the photo in question! (A very generic key form was used.) Might want to update this post...
Archives - January 2007 should be a clue. Or at least one would hope.
While you guys are at it, can you fix your patently incorrect story about Iran being "offline", when it clearly and provably isn't, thereby negating the main premise of the story? You know, since no one seems to care about anything sent to the on-duty editor email.
Slashdot is really on fire today!
The picture was of a piece of luggage with the combination of "12345."
Pretty damn stupid to use that as a master key.
Soon on Slashdot: USA bans images on the internet as a safety method, "Evil hackers posting these so called images danger our protections, and we have to ban them all".
http://64.233.183.104/search?q=cache:FcvferlnsJAJ:www.bradblog.com/%3Fp%3D4066+site:.bradblog.com+diebold&hl=en&strip=1
With the way it's gone so far today, apparently, slashdot is hosted in Iran.
The above comments are not guaranteed to make sense to anyone other than the author...
Any country making both democracy and security its highest priorities for years, even at cost of a perpetual state of emergency, suspended liberty, thousands dead and many tens of thousands wounded (multiplied in the non-American casualties), unsupportable debts, alienating allies and activating enemies, would immediately remove these untrustworthy machines and never allow their vendors or technologies into the critical path of its government again.
Such a country would never have allowed such a risk at all, either before or after such vulnerabilities were publicly exposed.
But instead, this story will become a footnote. Precisely because there's an election going on. An election that is threatened by these untrustworthy machines.
Since those priorities were set and executed by a government installed on the reports of these kinds of untrustworthy machines, I guess we've got everything we deserve.
--
make install -not war
Yeah, either this is from Digg, or from Reddit. I saw the same old today on Reddit... I haven't bothered comparing the dates to see who was first though.
:-(
But it's an interesting new problem in social news reporting. News tend to spread like wildfire, but that also includes bad or confusing reporting. This isn't the first time it has happened, at I predict it will become tremendously more common in the future, the more interconnected and popular social news sites like Slashdot (it now is one too especially since Firehose was implemented -- and no doubt have you seen the signs of this lately), Digg, Reddit, etc.
Beware: In C++, your friends can see your privates!
What's the problem? We've all been demanding "open" elections.
Sheesh, evil *and* a jerk. -- Jade
While this story may be old, it was not a major election year when it ran, and all the e-voting problems still have not been fixed. So it is at least worth mentioning again, I think. Also, this story serves as a reminder that the most fearsome element of malicious "hacking" is not some geek with uber skills in a dark room, it's the information we willingly give out without realizing the danger.
Ok, I done trying to be constructive. I always was mostly a crowd follower, so here goes: Slashdot sucks and I hate them for posting this story.
I've got an even better one for stamping out abuse... use paper ballots designed such that each potential vote is listed on one line with a hollow oval at the far end, then have each voter fill in the appropriate dot with a provided pen and run the ballots through a machine designed to read such ballots and compile the results as appropriate.
You know, the same way that many institutions grade multiple choice exams.
The best part is that this is not only comprised entirely of existing technology, but that it is already how at least one state does things, demonstrating that the methodology works just fine. It's how I voted just yesterday.
It's completely obscene that ballot design has become so convoluted and messy that people can reasonably cast an incorrect vote, and it's just stupid to leave yourself without any means for a manual recount.
Try not to take me more seriously than I take myself.
...the machines are pre-programmed to cast, someone could photocopy that and save us all the trouble of actually voting.
It must have been something you assimilated. . . .
Second, from the appearance of the key it seems to be a lock that's EXTREMELY easy to pick so the effort to make a copy - even by trial and error - would be small.
So if everybody that knows that Diebold machines are in use during an election makes their own key and just unlocks it and leaves the machine open... That could be for some interesting news. Votes dismissed due to irregularities - 50%. Just make sure that the machines is in the counties populated mostly by your opponent.
And - what stops one from ordering keys from Diebold?
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
The major difference here is a subtle but important one. With the banking system, if someone manages to get money or goods they are not entitled to, someone will be missing that money or goods and that someone will know about it once they take inventory or reconcile the numbers. These systems are routinely attacked and banks do lose money to fraud, and they invest in security enough so that the cost of fraud is less than the cost of the security measures.
With voting, the party that loses due to fraud is the public, and especially if there is no paper trail, there is no way to prove that any fraud did actually take place. It's very easy to make machines that count votes, it's basically impossible to make those machines such that no one involved could manipulate the results from the election officials, executives, programmers, and voters. With a paper election, the fraud-proofness is guaranteed though the fact that votes are opened with representatives of the various parties in place, and tallies are signed and published so that any fraud could be easily detected by the interested parties.
Make even shorter URLs - 8LN.org
Can someone please explain to me why an electronic voting machine is a Bad Thing(tm)?
If something goes wrong with your ATM you know it happened right there when it happened, you contact your bank and get it fixed right then. And even then, you don't really *trust* the ATM. At least I hope you take your paper receipt, and check your balance, and if they don't match you can STILL call the bank about it.
If something goes wrong with your voting machine you NEVER know about it, because you don't get any feedback (like, you know, the money doesn't come out). So what you need to do is to take your paper ballot from the machine and put it in a box and make sure that the boxes and the papers are safe and *those* are what need to be retained for a recount when someone thinks things don't match and needs to "call the bank about it".