Hacker News Reader

Comment by ehnto | Hacker News Reader

Compromise feels almost inevitable. Perhaps the idea that we can keep data protected and accessible at the same time using complex software is folly? Systems get more and more complex, security measures layer on top, patching over holes as they are found. But we are never in front of the cat and mouse game by necessity, only ever behind. So it must be that compromise is inevitable.

I wouldn't put personal data I am not willing to lose online or on an intranet at all anymore. No amount of money and engineering seems to be able to keep up, and companies prove over and over that they are negligent, naive, or simply a few steps too far behind.

View on HN

> I wouldn't put personal data I am not willing to lose online or on an intranet at all anymore

Anymore? Not trusting the internet used to be the default.

I was at Barnes and Noble yesterday and on an end, I saw an "internet password log book" for $5.98.

A few years ago, I soughed at it, poking fun at it.

Now, it's not a bad idea.

Note that he said "intranet" (not "internet"), which had historically been presumed to be limited to internal access only. I think his point is valid and a little alarming.

For a while I've thought "patch holes as we discover them" is the wrong approach to computer security.

Perhaps we should be using formal proof systems? Perhaps we should just admit that computers are bad at holding secrets, and instead make everything on a computer public.

Now extend that to voting systems too... not just folly, but criminal insanity.

I work with digitisation in the public sector of Denmark. We’ve digitised our elections, but we’ve digitised the part that makes sense, the registration you do before you’re handed you ballot.

In the old days, we used to have big books where you’d get crossed off after you were identified. This naturally takes a lot of time, so today we print a little bar code on the piece of paper that we mail every adult citizen at every election. This means that we can scan you instead of manually crossing you off in a book.

We still have queues at prime time, but they are 10-15 minutes instead of two hours.

The actual voting is done with paper, so that there is a paper trail.

This is the only thing that makes sense. Especially when you look at the business side of things. We reduce the hassle for citizens (our customers of sorts) and we maintain security. Sure we could provide results faster if we counted votes digitally, and you could frankly also provide a paper trail if the machine printed you vote, but does speed of counting really matter? Financially digital vote counting would be insanely more expensive, because public IT systems are insanely expensive and paying staff a little extra to count votes isn’t.

I mean, the registration system is really expensive as well, but at least it benefits the citizens, so that is a reasonable sacrifice to us. But digital voting? That’s as you put it, insane.

It’s not a democratic process if you don’t have the physical votes and a system which makes sure they aren’t tampered with.

In Australia we have the staff still ruling us off in the electoral role. That usually takes a minute or less. The entire voting process (including queuing) depends upon the popularity of the individual voting booth and time of day, but is usually less than 10 minutes. This may be because there are an adequate number of booths and trained staff.But it is also because of compulsory voting. The highly likely attendance numbers per booth and their distribution across the day are known and can be planned for, unlike some other more random systems.

And the other great part is the democracy sausage at the event!

Although my local polling booth didn't have a bbq going which was kind of disappointing.

As a Dane, our palementary elections gets about 86-90% participations, and not having voting mandatory means you get an effective signal for how the population feels by how well they attend.

We are due for a new election before july, so I will probably just save the queue and vote by mail, if I elect to vote at all.

There's another way to use computers to help with voting.

Have Ballots with a unique identifier. People come to a polling station, get a ballot, fill in their vote.

The ballot goes through a scanner to tally the vote, and then goes into a standard vote bin.

At the end of voting, you cross-check a random sample (both ways) and check the total number of votes matches between the scanner and bin.

If all goes well, scanner results get electronically combined. If the sampling shows an error, count by hand.

One extra addition. Your ballot is filled out by a separate printer. This ensures proper readability at the scanner, and allows placing the unique ID after someone gave you the ballot (to keep your vote secret). Any tampering with non-unique IDs is detectable by the random sampling.

This requires you to put the trust with one person/entity.

IDs on ballots don't make sense. You cannot know your ID without breaking a requirement for good free voting systems: It shall not be possible to prove to others how you voted. This is to prevent forcing or purchasing votes.

If you place the ID after the ballot is handed out (by a printer that is also used to fill in the ballot). Then this systems still doesn't allow proving of votes.

The ID here is meant to identify a ballot, not a voter. It should probably be something like a UUID. The aim of this system is to allow cross-checking between the scanner and the physical ballots.

> The ID here is meant to [..]

I got that, but you can still kind of prove it. Your know your ID + your-vote. This is likely the only valid ID+vote combination you can know before results are counted. That's when I'd "ask" you and late verify it.

If you want to verify the machine is working, just put the ballot in the standard bin and add those IDs in the counting phase. That seems fine in principle and make it easy to check the tech is working as intended. You'd end up with having list of all individual votes available, maybe even to the public. I'd be worried about people throwing statistical algorithms at that. You better also find a near perfect method to randomize order...

> add those IDs in the counting phase

That'd probably work. You'd need to somehow ensure the scanner that ads the IDs doesn't double IDs

> does speed of counting really matter?

That's a great question. The answer depends a little bit on how many issues are on the ballot, and a hell of a lot more on whether you're asking the media, or those with a direct stake in the outcome, or those voters. Your system is optimized to serving voters.

We need to make companies criminally liable for this information if it gets stolen. If they can’t secure it, don’t collect it.

This was the approach of the game site GoG at first. The user had no choice to save their payment preference (e.g. credit card) and they explained the reason was that it's impossible for hackers to get the info if they don't store it in the first place. It was a refreshing approach at the time for me (~2007) They've since given the option to save but it's optional.

With social engineering anything can be compromised, online or off. Online just gets more convenient seeing how you never have to leave your location.

I came across an interesting slide deck one time that had various examples of social engineering used in corporate settings to acquire data online and in person. A clever individual can get their hands on just about anything if they try.

"Compromise feels almost inevitable ... I wouldn't put personal data I am not willing to lose online"

I kinda wonder. How do you do that in our modern age? Is the computer you store the data on connected to the internet? If the answer is yes, your data can be accessed. If the answer is no, is that computer on the same network as any other device you use to connect to the internet? If the answer is yes, your data can be accessed. If the answer is no, you might be secure, but then I have a question, who the hell are you that you run a disconnected, private network just to store some personal data?

My counter-point to this would be that we haven't seen significant breaches (at least, not on the scale of this) from the tech giants (FAANG and co). So there are companies that can keep your data safe. They're just vanishingly few.

Wasn’t Google revealed to be getting tapped at unencrypted points in its network by the Snowden leaks? I’m guessing they had way way more than 6tb of emails stolen by that program.

Yes. But it's also true that if you live in a country with a lot of powerful intelligence agencies, and one of those intelligence agencies wants access to your data, they will get it through some means or another. It doesn't really matter how secure your practices are.

By using Google you are defacto tapped. But if you use a small provider, you'll only be tapped if they can be bothered with you, which for the average folk is quite unlikely.

They've definitely had breaches, which while obviously their containment was a bit better, leads me to believe they're not any less susceptible in the long run.

Reply on news.ycombinator.com