Glass Box Voting

In other news, Diebold admits their machines lose votes

Scott Shorter — Fri, 22 Aug 2008 17:57:42 +0000

Slashdot: “Premier Election Solutions (a subsidiary of Diebold) has acknowledged a flaw that causes the systems to lose votes. It cannot be patched before the election and the machines are used in half of Ohio’s counties, but they are issuing guidelines for avoiding the problem that presumably contain a work-around. While Diebold initially blamed anti-virus [...]

Open Source does not equal secure, chapter++

Scott Shorter — Fri, 22 Aug 2008 13:36:17 +0000

Some reminders of security holes in open source software: Debian-Ubuntu Key Generation Flaw of 2006-2008 That was a huge flaw that went unnoticed that introduced serious vulnerabilities in to countless systems. The code was sitting there for everyone to see, but nobody looked there and understood what it meant for almost two years (don’t quote me [...]

Open Source does not equal secure, chapter 437

Scott Shorter — Fri, 22 Aug 2008 13:23:18 +0000

The Open Voting Consortium is a voting system vendor that promotes itself as a voting integrity advocacy group. Their “About OVC” link states: The Open Voting Consortium is a not-for-profit organization dedicated to the development, maintenance, and delivery of trustable and open voting systems for use in public elections. OVC is actively seeking “members” (people to send [...]

Pattern Voting

Scott Shorter — Fri, 20 Jun 2008 03:08:51 +0000

Go read Rick Carback’s article How Secret Is Your Secret Ballot?.

The Debian/Ubuntu key generation flaw

Scott Shorter — Mon, 19 May 2008 18:59:48 +0000

It’s all in the news these days, the Debian distribution used a version of OpenSSL with a key generation flaw. This bug raises an interesting can of worms that I’m still trying to figure out. Debian/Ubuntu servers built since 2006 need to be rekeyed. That is a nontrivial thing, and it not going to happen in a [...]

Security requirements in social networks

Scott Shorter — Fri, 09 May 2008 19:03:17 +0000

An interesting post about an exploit in some forum software causing medical harm to epileptics. That got me thinking about social networks generally as a security domain. As with voting, you have understand the security environment before you can determine the security requirements. Users of new social networks have a wild array [...]

On training vines and users

Scott Shorter — Thu, 08 May 2008 14:07:14 +0000

I am an amateur gardener in my not-so-copious spare time, and this year I am attempting to train wisteria and honeysuckle vines onto some cords I have strung around the garden. This involves going out to all of the vines several times a week and gently moving the new growth towards the cord you [...]

Supreme Court allows Voter ID laws

Scott Shorter — Wed, 30 Apr 2008 18:56:10 +0000

Monday’s Supreme Court ruling reminds us that exploiting vulnerabilities in voting equipment is not the only way to manipulate an election. To say nothing of Bush v Gore.

Thoughts on AG’s report

Scott Shorter — Wed, 30 Apr 2008 17:05:21 +0000

The contents of the report are good. It’s missing discussion of security and public trust in equipment, but I believe they will address that in the next phase.

Maryland AG Voting Irregularities Report

Scott Shorter — Tue, 29 Apr 2008 14:30:41 +0000

Released just now while I was writing the “awaiting press release” post. I will read it now and post my thoughts. The release in full after the jump. Attorney General’s Task Force on Voting Irregularities Submits First Report Includes 13 Recommendations for [...]