Estonian Electronic Identity Card: Security Flaws in Key Management

I take the view that rights are inalienable, I don't have a problem with documents but with Id cards.

Given the structural deficiencies of the US police (And other police forces) giving them an excuse to stop people is to be avoided unless strictly required.

You’re the one that seems to be thinking in absolutes (when it suits you).

  1. In cryptographical/philosophical sense that’s a tough problem. But our goal is to improve on existing solution not come up with an absolutely ideal scheme, right? So let’s look at what sort of trust our current system provides us. Do you get to see how the whole system works? No. Does any single person gets to see the whole system for that matter? No. But you are provided with the description of the process and large part of it is happening in the open even though though you can’t attend all the places / oversee everything in a single election due to real life and restrictions. Some people are also provided with the power to inspect arbitrary components of the whole scheme  when they see fit and even though they don’t inspect even the whole components all the time and no one is inspecting absolutely everything, these people are attracted from all interested parties and can act on random, so we believe that if there were any symptomatic fault play someone would have found it simply by chance. And we generally don’t believe in conspiracies but we try to counteract them by providing more incentives for people to speak up, get involved, become a whistleblower if that’s necessary so that any largish conspiracy would inevitably become public knowledge quickly enough. Well, we can arrange all of these in electronic voting as well and we can even double down on all the in depth mitigations by providing more monitoring capabilities in real time & possibly even making data openly available in whole after election.
  2. You can sell your vote in our current system as well. But somehow that’s fine because we have different standards for what we grandfathered already, am I right? Yeah, you could pay people if they film themselves voting, but there is no evidence of they being widespread so no need to worry. Mail ballots aren’t anonymous and could be spied/spoofed easily but there is no evidence of that ever happening, so no need to worry. Lack of strong ID requirements in US could lead to massive voter fraud but there is no evidence of they ever happening in a large enough numbers to skew the election, so no need to worry about. And yet when it comes to electronic voting, geek versions of Penn and Teller - cryptographers have shown us in their stage shows that they can conceive such situations where the victim gets unknowingly duped into disclosing their vote, or the vote being miscounted. So that means literally anyone could carry out the same attack in practice and at an arbitrary scale (or maybe not but we’d better err on side of caution).
  3. How do you know that that nice lady overseeing voting in your district isn’t a secret Trump/Clinton/Nazi/Communist sympathizer? You don’t, but you have a faith in the system as a whole that it won’t crumble because of a single person. Similarly we can use defense in depth tactics in designing election security. The hardware would only be able to run signed code in a minimal environment, you could even make the decided stateless, meaning the code gets reset before each new vote gets accepted, maybe even provide an option for voters to reflash the device themselves (with a click of a button on their phone). Devices themselves don’t have to be generic PCs with USB ports and what not, these could be a really dumb chips enclosed into sealed & transparent casing with each one being certified etc. You could make the system modular by having multiple devices each doing their small thing - like the Unix utilities but with each utility being separate hw and most of them disconnected from any networking / being air gapped with obvious input/output interfaces. There are so many things we could do it we approached this in a sane manner as a serious engineering challenge instead of trying to out-cynic each other.
  4,5,6,7 That’s exactly my point, electronic voting can be made even more transparent and with the records being forensically preserved they could be analyzed in full at any time after the votes have been casted (with the operational stuff being able to run all sort of threat hunting / anomaly detection during the Election Day). Granted this assumes the whole system uses the same protocols and is run/overseen by a joint committee which might or might not be viable in US, but the discussion started from Estonia - European country, where this would be totally expected.
  9, 10 Not all 0days are noclick RCEs present in a default configuration (of a desktop/mobile). In fact we haven’t seen such a beauty in a long time. So no, there isn’t a price for that as it’s not something you could buy off the shelf. And if you could get one you would burn it pretty fast by using it in such a campaign. Makes much more sense to keep it as a nuclear option as no matter how aggressive in your opinion nation state attackers are, their primary incentive is fear for the survival/integrity of their own country (yes the bears crap their pants thinking about possible armed intervention any year soon and so do the pandas). So no I don’t think there is any conceivable way to exploit large portion of private devices in a country in a uniform fashion. You totally could do that using top bottom approach - sort of like exploiting DC and pushing malware from it via group policy. But in case of Estonia voting apps would be the last tech to use for that. They are already mandated to use governmental services for various everyday tasks, they have centralized ID and there are just a couple of major banks - all of which require having an app for modern banking. So there are already plenty of avenues to wreck havoc for a skillful/motivated attacker. And yet we don’t have panic attacks over it, it’s just operational risk that we seek to understand & mitigate just like in every other enterprise.

1. You feel that the process is well understood because that’s the only process you’re familiar with and likely it was taught to you since school. In reality other schemes such as electronic voting could be just as clear and transparent, while possibly even more natural as visiting websites and using apps is what people do every day as opposed to gathering physically in order to run an ancient form of poor cryptography manually. Also, no you never had an opportunity to see the whole process end-to-end, as you never were allowed to open and inspect voting ballots or boxes, or attending the central counting place in your state/at the federal level to make sure they are counting everything correctly as well. Think of the bits you saw this way: it your adversaries were evil versions of Penn and Teller, would they be able to fool you by presenting you completely boring looking yet larger than life process that feels completely fair yet of which - due to completely human reasons - you can only see a one facet at a time - all while in fact running a completely different play in the background? Sure, this isn’t how we normally think about adversaries in real life but that’s what the adversaries in cryptography are. When the guy in the video said that there have been some concerns about Estonian voting system which basically means anyone could have stolen the election - that’s what he meant really: Penn and Teller could have arranged in their stage show show such a contraption that would have fooled mock election participants into disclosing their vote or it being discounted, therefore basically anyone can steal our election. 2. This isn’t obvious at all nor substantiated by facts/reasoning. Parties still could hire/attract auditors to oversee the process, independent organizations and foreign counties still could be provided with visibility into the process, in fact the process could be made more verifiable by using preserving audit logs and forensic evidence for generations to come, so that single researcher could viably check their hypotheses across the whole election days, months or years later, not just one small fragment at a time in places they themselves got an opportunity to physically be present, like what you described. And the process could be made much more transparent to the public at large as their vote could be counted in soft real time, meaning they could verify it reached central tally right after voting.

Yeah that sounds like a classic American move - who cares if they're on vacation, just make them work! Glad your employer stood up for you all (or that the law forced him/her to)!

One time here in the US I had to work late hours and weekends to hit an ambitious deadline for a French customer who wanted to review our work before they all went on their vacations.

Ah, right.

Yeah I should definitely check with an accountant in the country where I will end up residing.

> Rigging (digital or not) would be hard to hide, because it could only be a minor adjustment to remain plausible.

How many more votes would the party in second place at the last election have needed in order to have won instead?

> If some party suddenly receives a lot more votes than they polled for - it will be noticed.

Is there a mechanism by which the election could be run again (before the winners of the election have a chance to prevent this)?

> Also Estonia already has a history of (non-digital) election rigging

Or it's an argument that a voting system should have both hand-counting and digital counting, because rigging both counts is at least twice as difficult as rigging one.

> Rigging (digital or not) would be hard to hide, because it could only be a minor adjustment to remain plausible.

As candidates & parties become more competitive, the difference in their voting shares tends to narrow. Eventually you end up with large coalitions that split the electorate fairly evenly. A small adjustment is all it'd take to tip the scales. If landslide victories are common, I'd say your political system is doing something wrong.