Slashdot Mirror
Microsoft Proposes Fix For E-Voting Attack
Trailrunner7 writes "Microsoft Research has proposed mitigation for a known potential attack against verifiable electronic voting machines that could help prevent insiders from being able to alter votes after the fact. The countermeasure to the 'trash attack' involves adding a cryptographic hash to the receipts that voters receive (PDF). Many verifiable voting systems already include hashes on the receipts, but that hash is typically made from the ballot data for each specific voter. The idea proposed by Microsoft Research involves using a running hash that would add a hash of the previous voter's receipt to each person's receipt, ideally preventing a privileged insider from using discarded receipts to alter votes. The trash attack that the mitigation is designed to address involves election workers or others who might be motivated to change votes gathering discarded receipts and then altering those votes."
They actually do a lot of great stuff there, which is not too surprising as they have many intelligent people working in Research. Just wish much more of their stuff would see daylight.
Still, Microsoft is actually one of the only companies that spends billions in research and doesn't just buy start-up companies like Google does.
Provide a paper trail that each voter verifies. You can then count by hand to loosely verify the vote in case of fraud.
I even voted "Protest E-vote" in the 2008 election
God spoke to me
Now what do you then the voteing systems goes down and a reboot does not fix it?
That and perma dyeing voters fingers third world style.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'
My problem is that I don't really trust my vote to any product. I know that ballots can become obscenely complicated, but paper ballots, in general, are more secure. A system that actually produces a printed receipt, regardless of who manufactures it or produces the software, would seem the appropriate intermediary.
The world's burning. Moped Jesus spotted on I50. Details at 11.
Wow, that would be a cash cow! Getting a IP royalty payment for each and every vote cast, in every election!
Schroedinger's Brexit: The UK is both in and out of the EU at the same time!
Great, one hole in the sieve that is e-voting plugged. Just a few thousand more to go. When are the hashes ever verified, and what can be done once one or more ballots fail verification? How might a voter validate (via hash on receipt) that the ballot was tabulated as hashed? This is just one of a myriad of possible attack vectors. What about the others, particularly the wholesale methods of rigging like simply altering the contents of the Access database that stores the votes between when voting concludes and when votes are tabulated? That appears to have happened in Ohio in 2004, where several people were convicted of the offense.
Any system that shows how you voted after the fact opens up the possibility of purchasing votes.
I'm sure changing America from a republic to a community democracy will go smoothly.
There are two types of people in the world: Those who crave closure
Won't happen.
There have been many similar proposals made over the years. None of them are implemented, because those who maintain power are apparently happy with the way things are. American democracy is a sham, highly susceptible to fraud, and anyone who makes such observations is dismissed by "serious" journalists and citizens.
I'm very glad MS made this proposal. Kudos to them. What would move me from mild approval to full-fledged fanboyism were they to take this idea and have it implemented universally.
The idea proposed by Microsoft Research involves using a running hash that would add a hash of the previous voter's receipt to each person's receipt, ideally preventing a privileged insider from using discarded receipts to alter votes.
Isn't this the ancient notary system? take the previous hash, hash in the new document or a hash of the doc or just its sig or whatever, pub key sign the new hash, publish the new hash (maybe in a classified ad in an old fashioned news paper or something?), repeat...
Also it only works if the voters care, which is pretty unlikely, and it only matters if there is any difference between the two parties, also pretty unlikely. Democracy has failed here. Maybe it would work in a difference country?
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
This is an old issue and people have done it better for a long time. The vendors (MS included) CHOSE to use half hearted, stupid, and short sighted solution. I saw proposal papers over a decade ago at the ISOC (Internet Society) NDSS conference:
Practical Approach to Anonymity in Large Scale Electronic Voting Schemes
Andrea Rierra and Joan Boerrell
http://www.isoc.org/isoc/conferences/ndss/99/proceedings/papers/riera.pdf
Start there and get serious.
(insert Bill Gates being inexplicably elected President here)
Personally, it has bupkis to do with "votes" these days anyway. You vote for who you're told to; the only real difference is the "D" or "R" on the TV or newspaper tagline next to their names.
Now if you want *real* power to pick who gets elected to a federal office, then go build a huge corporation or a national-sized bank.
(The sad part is, I'm not really trolling...)
Quo usque tandem abutere, Nimbus, patientia nostra?
Trouble is, through the choices of others, virtually all information about your life is already living in and being manipulated by microsoft products.
... there is absolutely no reason to not count manually, in the presence of observers, and then pool manual counts, in the presence of observers.
The machine should output the vote on paper. The voter puts it into the election box. After the election, they should be counted in a timely manner and matches to the digital result, just to be sure.
e-voting is a really bad idea. You Americans need to look north to see how an election should be run.
If I were God, wouldn't I protect my churches from acts of me?
To me, this is like saying you will only pay for things using paper checks because buying things from websites is insecure. Paper ballots can be lost, stolen, destroyed, or boxes stuffed. Entire boxes are lost sometimes. Polling places run out of ballots in some elections. The fact that specific platforms and software interactions can produce points of vulnerability does not mean paper is more secure. Even when paper is used, counting is arduous and waste is tremendous, to say nothing of the fact that there are tens of millions of goobers in this country who can't even figure out how to fill out a paper ballot.
Collecting the vote accurately is the first concern, so an electronic touch screen make the most sense at that point.
From there, common sense would make the level of difficulty high enough to ward off most attempts to influence the election. Certainly the voting machines with freaking USB ports on the side or any number of obvious flaws need to be weeded out. But I see no reason why electronic voting can't be made secure.
We trust all the world's financial transactions to electronic means, and nobody is saying stock needs to be traded on paper again. We just need to demand the stupidity be taken out of voting machines.
(insert Bill Gates being inexplicably elected President here)
Personally, it has bupkis to do with "votes" these days anyway. You vote for who you're told to; the only real difference is the "D" or "R" on the TV or newspaper tagline next to their names.
Now if you want *real* power to pick who gets elected to a federal office, then go build a huge corporation or a national-sized bank.
(The sad part is, I'm not really trolling...)
Actually, there are about 85% who vote for one side and would never ever vote for the other, and of the remaining 15%, about 14%of them vote based on who's better looking, or who they'd rather have come to their barbecue, not who'd be better at running the country.
Nope, nope, we can't require finger-identification, there are some people who don't have fingers.
Some countries, like Canada, have been running paper ballots for decades without any of the substantial problems you invoke. Frankly, I think the fans of electronic voting do everything they can to make paper ballots seem insecure and inaccurate, even as more and more evidence comes to light of how shaky their own systems are.
Huge parts of the world run on paper ballots, and have, for the most part, well-run elections. Let's not overstate the problems here.
The world's burning. Moped Jesus spotted on I50. Details at 11.
I worked on an electronic voting system a few years back. What I did got accepted for use in a local academic department, and I even gave a WIP on it at a LISA conference once, and then I ran into the constraints of the real world when I tried to build it into something useful for a wider audience. They include the following:
1) You must not provide to a voter any form of receipt that can be used to determine how that voter voted. This is to prevent voter intimidation that has apparently turned into a major issue in places that did not abide by this constraint. If a hash can be used to verify that a vote was correct, it can be used to verify that a vote was what was required. I attempted to get around this by pre-seeding the vote results with a good number of copies of every possible result (which would cancel each other out), so you could take with you a vote receipt matching what you were required to do, but I couldn't come up with a way to make this idea scale, especially when any form of ranked voting was used.
Microsoft could get around this by giving only the hash, and not the vote record, with the receipt, but then you have no way to prove that your vote was recorded the way you input it -- the system could just as well record something else, and give you the hash matching that something else.
2) Even if you don't care about voter intimidation, and you give out receipts, not enough voters care enough to check that their votes were counted or registered correctly for crowdsourced verification to be all that useful. I remember an election irregularity report on one of the very few properly-done electronic voting systems -- backed by a printout under glass that could go either to the permanent record or the wastebin, and the UI directed the voter to carefully compare what was on the screen with the printout before accepting the vote. There was a malfunction at a station where the printer was completely nonfunctional. It wasn't even reported until an absurd amount of time after the poll opened (I can't remember the details, but many hours, and who knows how many voters). The Microsoft technique of using a running hash to prevent insertions, deletions, or alterations to a vote that is known will never be verified is nifty, but the odds are good that none of the votes in the last few hours of the day will ever be verified just because the verification count is so low, so you simply pick a spot and alter thereafter.
3) Even if a voter triggered an irregularity report by noting that the hash didn't match, there is no political will to invalidate an election. Almost no elections go by without irregularities. Some elections go through with absurd irregularities, things that obviously had the potential to change the result, or even things that definitely would have changed the result, and the result is let stand.
Discovery of the above three points made me give up on electronic voting as a solvable problem. The counted ballot has to be on a media not easily tamperable, and it must be independently verifiable by the interested parties, which, taken from a purely historical standpoint, do not appear to include the voters. Microsoft's bright idea (and I will give credit, it's not a bad thought when your only context is "how do I let a small sample detect tampering"), actually exacerbates problem #3 very badly by leading into #4:
4) Elections are expensive. You cannot build a system that lends itself to repeated invalidation. If you could ignore #1 through #3, a straight hash would still be of value, because you would only invalidate if enough people brought back signed hashes that did not match the published counted values, and a few forged receipts would not throw out all of the real resuls. Unfortunately, using a running hash over the course of the entire voting period means that the ability to tamper with a vote early in the day means you can invalidate *every vote that follows*, even if your technique was something that would only normally work on a single vote. This me
There is a much better fix to this problem. It is called getting rid of electronic voting machines and going back to the cardboard punch cards. They were cheap, fast, easy to use, worked fine, 100% auditable, and are tamper-proof. Plus, they were guaranteed to be anonymous, which is NOT the case with the machines installed a few years ago in my state.
Some things are just NOT better with so-called "advanced" automation. They were trying to solve a problem that didn't exist by spending TONS of taxpayer money and created a monster, instead.
Your state problems with paper ballots is only valid for situations where there is no monitoring. And that should come as no surprise since paper ballots by itself is not secure. I.e here in Sweden anyone who likes are allowed to take part of the whole process, i.e you can stay in the voting area and supervise that no mischief is going on, you are allowed to follow the box as it is sealed and stored, and you are allowed to stay and watch the counting take place. And this right is used, especially by the political parties who have members sent to all voting facilities, i.e each vote is counted by members of different parties so the risk of fraud is very very slim. It still happens that some votes gets lots or people are trying to commit fraud, but to date all attempts have been spotted and reported and in no way could the problem ballots account for any impact of the end result.
Compare this with an all electronic system where no one, and as a programmer and systems architect I mean no one, has any ability what so ever to conduct supervision of the calculation of the votes.
And why is it a problem that the counting may take a few hours when the new elected party/president etc doesn't come to office until a few months later anyways and stays in office for 4 years. A few hours in that context is insignificant.
Hash chain.
Just like Bitcoin.
Granted, in standard /. poster style, I didn't bother reading the FA but this sounds like cipher-block chaining which has been part of modern crypto systems since forever; why has it taken until 2011 for someone to apply it to e-voting?
to say nothing of the fact that there are tens of millions of goobers in this country who can't even figure out how to fill out a paper ballot.
Small wonder when the ballots seem to be designed with malicious intent towards that end.
If you actually hear of people having difficulty figuring out a Canadian style ballot (Hell, my legally blind grandmother voted fine last election), let me know.
upon the advice of my lawyer, i have no sig at this time
So you detect an irregularity. What are you going to do about it? Realistically, nothing. Even if you did redo the election, that itself is an attack. It gives time to campaign some more, time for people to learn about or forget a scandal, etc.
until you take people out of the equation.
I don't care what system you choose, I can have all the receipts I want in any form I want, when I get home I have no more proof my vote even mattered as I have no guarantee that another vote or votes were not fraudulent.
So not only present a receipt that cannot be used to intimidate (why I really dislike all attempts to make union acceptance votes open in the US - card check) while assuring those who are voting that their vote doesn't get wasted by fraudulent votes entering the system.
So, perhaps your vote plus all others accounted for in a form decipherable by a computer?
Still politicians are doing their best to keep us from even asking people to have valid IDs to vote with. How can you get a real system where those asking for one are intimidated by being called out as racists/bigots and the like simply by asking for one person one vote verification and how do you do that without ID? ( and I don't mean to be mean, but other than a picture ID how do you help people who are not all that bright?)
* Winners compare their achievements to their goals, losers compare theirs to that of others.
It is called pen and paper.
Don't fight for your country, if your country does not fight for you.
I always wondered... How on earth did people like that vote in the first place? I suppose they'd have to get someone to assist them, and you could always perma dye the finger of THAT person.
All the world's a CPU, and all the men and women merely AI agents
but that may wipe out the votes and you can't have that and after reinstall then you have to load the elections for that poling place.
I propose that, for the people to trust their democracy, they must be able to understand all aspects of the voting system. This rules out pretty well all automated systems, especially computers with cryptography and hashes. Just go back to people writing on paper and ballot boxes.
Sure counting the ballots by hand is expensive but it's tiny compared to the cost of travel and time for the voters. The risk of serious, undetected fixing of results can't be eliminated with automated systems.
Why should someone who assists a disabled person in exercising their democratic right to vote lose that right themselves?
Once Microsoft fixes a security problem, it stays fixed and no further problems can arise.
Sorry, but gray text on gray background is making my eyes bleed.
In the entire history of computing, there has never been a computer system that has resisted a resourceful and well-financed attacker. Heck, 99.9% of computer systems fall to modestly-funded hobbyists.
Considering that it costs over $1billion to elect a president of the United States, I can see someone spending $300 million to crack an e-voting system and considering it a bargain.
Here in Canada, we use paper ballots. There has never to my knowledge been a federal election with any serious allegation of fraud or any doubt about the outcome (unlike the US in 2000.)
Paper ballots scale quite nicely; Canada's population is only about 35 million, but even Germany with a population of 80 million gets by with paper ballots. So why not the US?
It is enough to have Bill Gates running Micro$oft. We don't want him running a country as well.....
I had to smile reading the headline.
Comp.Risk has been Paul Revering computer election fraud warnings
for over a decade, nobody seems to care.
It's been proved many times that elections can be swung one
way or the other. Computer voting has made it so very easy.
Yet all we get is more headlines.
Was talking about voter fraud with a friend, and how Obama didn't stand a chance
when he took office as it was all coming down and he was in the way.
He mentioned "while trying not to sound of conspiracy", it's entirely
possible that the Republicans didn't want the office this term for
just that reason.
I had a wow/epiphany moment.
----
Please, I don't post politics and don't wish a political challenge for this.
It was just a conversation I'm relating be it right or wrong.
"Microsoft is actually one of the only companies that spends billions in research and doesn't just buy start-up companies like Google does" SharkLaser
...
So that's how Microsoft Research developed Android before Google stole it from Microsoft and tried to fob it off on the public as original results, shame on you Google
Paper Ballots is the only voting system that could be made uncorruptible.
I once asked a vendor visiting from Norway (he grew up in England and emigrated many years ago), what type of voting machines they use. He replied with a quizzical look: "Paper".
Everyone advocating any sort of e-voting or use of electronic machines have agendas - none of which are related to free and fair elections.
Microsoft needs to stay out of the electoral process. We need to use Paper ballots, scanned by linux (open) based machines. This electronic only stuff will end badly.
I wasn't thinking that. I'm thinking it would be a different color dye or something so that it would be clear that they assisted someone rather than voting themselves.
All the world's a CPU, and all the men and women merely AI agents
Only allowed to assist one person?
You would have to pick a spot to mark the hand less voters. Perhaps an earlobe, it doesn't really matter just so it's something. Plus a third spot for the hand and ear less.
John McAfee 'It was like that time I hired that Bangkok prostitute; to do my taxes, while I fucked my accountant'