Slashdot Mirror
Microsoft Proposes Fix For E-Voting Attack
Trailrunner7 writes "Microsoft Research has proposed mitigation for a known potential attack against verifiable electronic voting machines that could help prevent insiders from being able to alter votes after the fact. The countermeasure to the 'trash attack' involves adding a cryptographic hash to the receipts that voters receive (PDF). Many verifiable voting systems already include hashes on the receipts, but that hash is typically made from the ballot data for each specific voter. The idea proposed by Microsoft Research involves using a running hash that would add a hash of the previous voter's receipt to each person's receipt, ideally preventing a privileged insider from using discarded receipts to alter votes. The trash attack that the mitigation is designed to address involves election workers or others who might be motivated to change votes gathering discarded receipts and then altering those votes."
They actually do a lot of great stuff there, which is not too surprising as they have many intelligent people working in Research. Just wish much more of their stuff would see daylight.
Still, Microsoft is actually one of the only companies that spends billions in research and doesn't just buy start-up companies like Google does.
I don't trust my vote to a microsoft product.
To offset political mods, replace Flamebait with Insightful.
Have the stupid voting machine keep track of the original vote, and each subsequent change. I think that would sort out who is cooking the vote as well as preserve integrity.
A feeling of having made the same mistake before: Deja Foobar
... and that sounds pretty good to me.
Provide a paper trail that each voter verifies. You can then count by hand to loosely verify the vote in case of fraud.
I even voted "Protest E-vote" in the 2008 election
God spoke to me
Now what do you then the voteing systems goes down and a reboot does not fix it?
which is described nicely with a diagram here:
http://publictimestamp.org/?pass=info&pass2=timestampingdetailed
Simply scroll down to No. 4. Endless Logfile
How important is it to have free and fair elections when both candidates are in the pockets of huge corporations and are going to work against the interests of the people anyway?
Instead of voting for representatives, we should be voting directly on the issues.
1. Voting occurs
2. Voter receives receipt containing:
-Hash of voting record
-Verification PIN
Then, the voter can log onto a website and enter both pieces of information to retrieve their voting result for verification after the election.
Wow, that would be a cash cow! Getting a IP royalty payment for each and every vote cast, in every election!
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Great, one hole in the sieve that is e-voting plugged. Just a few thousand more to go. When are the hashes ever verified, and what can be done once one or more ballots fail verification? How might a voter validate (via hash on receipt) that the ballot was tabulated as hashed? This is just one of a myriad of possible attack vectors. What about the others, particularly the wholesale methods of rigging like simply altering the contents of the Access database that stores the votes between when voting concludes and when votes are tabulated? That appears to have happened in Ohio in 2004, where several people were convicted of the offense.
Any system that shows how you voted after the fact opens up the possibility of purchasing votes.
Well? is it???
Won't happen.
There have been many similar proposals made over the years. None of them are implemented, because those who maintain power are apparently happy with the way things are. American democracy is a sham, highly susceptible to fraud, and anyone who makes such observations is dismissed by "serious" journalists and citizens.
I'm very glad MS made this proposal. Kudos to them. What would move me from mild approval to full-fledged fanboyism were they to take this idea and have it implemented universally.
The idea proposed by Microsoft Research involves using a running hash that would add a hash of the previous voter's receipt to each person's receipt, ideally preventing a privileged insider from using discarded receipts to alter votes.
Isn't this the ancient notary system? take the previous hash, hash in the new document or a hash of the doc or just its sig or whatever, pub key sign the new hash, publish the new hash (maybe in a classified ad in an old fashioned news paper or something?), repeat...
Also it only works if the voters care, which is pretty unlikely, and it only matters if there is any difference between the two parties, also pretty unlikely. Democracy has failed here. Maybe it would work in a difference country?
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
This is an old issue and people have done it better for a long time. The vendors (MS included) CHOSE to use half hearted, stupid, and short sighted solution. I saw proposal papers over a decade ago at the ISOC (Internet Society) NDSS conference:
Practical Approach to Anonymity in Large Scale Electronic Voting Schemes
Andrea Rierra and Joan Boerrell
http://www.isoc.org/isoc/conferences/ndss/99/proceedings/papers/riera.pdf
Start there and get serious.
... there is absolutely no reason to not count manually, in the presence of observers, and then pool manual counts, in the presence of observers.
Sounds like Voting Bloc Chaining
The machine should output the vote on paper. The voter puts it into the election box. After the election, they should be counted in a timely manner and matches to the digital result, just to be sure.
e-voting is a really bad idea. You Americans need to look north to see how an election should be run.
If I were God, wouldn't I protect my churches from acts of me?
PAPER BALLOTS!
I worked on an electronic voting system a few years back. What I did got accepted for use in a local academic department, and I even gave a WIP on it at a LISA conference once, and then I ran into the constraints of the real world when I tried to build it into something useful for a wider audience. They include the following:
1) You must not provide to a voter any form of receipt that can be used to determine how that voter voted. This is to prevent voter intimidation that has apparently turned into a major issue in places that did not abide by this constraint. If a hash can be used to verify that a vote was correct, it can be used to verify that a vote was what was required. I attempted to get around this by pre-seeding the vote results with a good number of copies of every possible result (which would cancel each other out), so you could take with you a vote receipt matching what you were required to do, but I couldn't come up with a way to make this idea scale, especially when any form of ranked voting was used.
Microsoft could get around this by giving only the hash, and not the vote record, with the receipt, but then you have no way to prove that your vote was recorded the way you input it -- the system could just as well record something else, and give you the hash matching that something else.
2) Even if you don't care about voter intimidation, and you give out receipts, not enough voters care enough to check that their votes were counted or registered correctly for crowdsourced verification to be all that useful. I remember an election irregularity report on one of the very few properly-done electronic voting systems -- backed by a printout under glass that could go either to the permanent record or the wastebin, and the UI directed the voter to carefully compare what was on the screen with the printout before accepting the vote. There was a malfunction at a station where the printer was completely nonfunctional. It wasn't even reported until an absurd amount of time after the poll opened (I can't remember the details, but many hours, and who knows how many voters). The Microsoft technique of using a running hash to prevent insertions, deletions, or alterations to a vote that is known will never be verified is nifty, but the odds are good that none of the votes in the last few hours of the day will ever be verified just because the verification count is so low, so you simply pick a spot and alter thereafter.
3) Even if a voter triggered an irregularity report by noting that the hash didn't match, there is no political will to invalidate an election. Almost no elections go by without irregularities. Some elections go through with absurd irregularities, things that obviously had the potential to change the result, or even things that definitely would have changed the result, and the result is let stand.
Discovery of the above three points made me give up on electronic voting as a solvable problem. The counted ballot has to be on a media not easily tamperable, and it must be independently verifiable by the interested parties, which, taken from a purely historical standpoint, do not appear to include the voters. Microsoft's bright idea (and I will give credit, it's not a bad thought when your only context is "how do I let a small sample detect tampering"), actually exacerbates problem #3 very badly by leading into #4:
4) Elections are expensive. You cannot build a system that lends itself to repeated invalidation. If you could ignore #1 through #3, a straight hash would still be of value, because you would only invalidate if enough people brought back signed hashes that did not match the published counted values, and a few forged receipts would not throw out all of the real resuls. Unfortunately, using a running hash over the course of the entire voting period means that the ability to tamper with a vote early in the day means you can invalidate *every vote that follows*, even if your technique was something that would only normally work on a single vote. This me
There is a much better fix to this problem. It is called getting rid of electronic voting machines and going back to the cardboard punch cards. They were cheap, fast, easy to use, worked fine, 100% auditable, and are tamper-proof. Plus, they were guaranteed to be anonymous, which is NOT the case with the machines installed a few years ago in my state.
Some things are just NOT better with so-called "advanced" automation. They were trying to solve a problem that didn't exist by spending TONS of taxpayer money and created a monster, instead.
Hash chain.
Just like Bitcoin.
Granted, in standard /. poster style, I didn't bother reading the FA but this sounds like cipher-block chaining which has been part of modern crypto systems since forever; why has it taken until 2011 for someone to apply it to e-voting?
So you detect an irregularity. What are you going to do about it? Realistically, nothing. Even if you did redo the election, that itself is an attack. It gives time to campaign some more, time for people to learn about or forget a scandal, etc.
until you take people out of the equation.
I don't care what system you choose, I can have all the receipts I want in any form I want, when I get home I have no more proof my vote even mattered as I have no guarantee that another vote or votes were not fraudulent.
So not only present a receipt that cannot be used to intimidate (why I really dislike all attempts to make union acceptance votes open in the US - card check) while assuring those who are voting that their vote doesn't get wasted by fraudulent votes entering the system.
So, perhaps your vote plus all others accounted for in a form decipherable by a computer?
Still politicians are doing their best to keep us from even asking people to have valid IDs to vote with. How can you get a real system where those asking for one are intimidated by being called out as racists/bigots and the like simply by asking for one person one vote verification and how do you do that without ID? ( and I don't mean to be mean, but other than a picture ID how do you help people who are not all that bright?)
* Winners compare their achievements to their goals, losers compare theirs to that of others.
It is called pen and paper.
Don't fight for your country, if your country does not fight for you.
but that may wipe out the votes and you can't have that and after reinstall then you have to load the elections for that poling place.
Of course, paper trail is among the best ways to have an e-voting system. However, the best way to have a voting system does not involve a computer receiving the votes.
There are many ways to abuse a paper trail system - But instead of rehashing it here, I'll rather point you to my friend Federico Heinz's text: Urnas electrónicas: con imprimir el voto no alcanza (Spanish original) or automated translation: Electronic booths: Printing the vote is not enough.
I propose that, for the people to trust their democracy, they must be able to understand all aspects of the voting system. This rules out pretty well all automated systems, especially computers with cryptography and hashes. Just go back to people writing on paper and ballot boxes.
Sure counting the ballots by hand is expensive but it's tiny compared to the cost of travel and time for the voters. The risk of serious, undetected fixing of results can't be eliminated with automated systems.
what the fuck
is going to run for the Presidency, I tell ya.
Once Microsoft fixes a security problem, it stays fixed and no further problems can arise.
Sorry, but gray text on gray background is making my eyes bleed.
In the entire history of computing, there has never been a computer system that has resisted a resourceful and well-financed attacker. Heck, 99.9% of computer systems fall to modestly-funded hobbyists.
Considering that it costs over $1billion to elect a president of the United States, I can see someone spending $300 million to crack an e-voting system and considering it a bargain.
Here in Canada, we use paper ballots. There has never to my knowledge been a federal election with any serious allegation of fraud or any doubt about the outcome (unlike the US in 2000.)
Paper ballots scale quite nicely; Canada's population is only about 35 million, but even Germany with a population of 80 million gets by with paper ballots. So why not the US?
Wow! They just invented GIT!
It is enough to have Bill Gates running Micro$oft. We don't want him running a country as well.....
I had to smile reading the headline.
Comp.Risk has been Paul Revering computer election fraud warnings
for over a decade, nobody seems to care.
It's been proved many times that elections can be swung one
way or the other. Computer voting has made it so very easy.
Yet all we get is more headlines.
Was talking about voter fraud with a friend, and how Obama didn't stand a chance
when he took office as it was all coming down and he was in the way.
He mentioned "while trying not to sound of conspiracy", it's entirely
possible that the Republicans didn't want the office this term for
just that reason.
I had a wow/epiphany moment.
----
Please, I don't post politics and don't wish a political challenge for this.
It was just a conversation I'm relating be it right or wrong.
"Microsoft is actually one of the only companies that spends billions in research and doesn't just buy start-up companies like Google does" SharkLaser
...
So that's how Microsoft Research developed Android before Google stole it from Microsoft and tried to fob it off on the public as original results, shame on you Google
I think you're trying to argue against SharkLaser but your example actually agrees with him (Google bought Android Inc.).
ah I remember now a hash built upon a previous hash yeah they got it from Bit Coin, is it going to take an hour to confirm each vote....
Paper Ballots is the only voting system that could be made uncorruptible.
Based on records alone there is no way Microsoft can make a secure platform that can not be cracked and that is one for sure that I do not want to find out is cracked again.
I once asked a vendor visiting from Norway (he grew up in England and emigrated many years ago), what type of voting machines they use. He replied with a quizzical look: "Paper".
Everyone advocating any sort of e-voting or use of electronic machines have agendas - none of which are related to free and fair elections.
This does nothing to prevent "man in the middle" hardware from being attached to the voting machines
to change votes as they are being cast.
Hash chaining E2E ballot receipts in this particular way has been in the literature since at least 2009. See section IV of:
http://ieeexplore.ieee.org/xpl/freeabs_all.jsp?arnumber=5282555
Microsoft needs to stay out of the electoral process. We need to use Paper ballots, scanned by linux (open) based machines. This electronic only stuff will end badly.