arianabuilds
commented
3 months ago Entry Summary for HACK SIV @ DEF CON 2024
Thanks again for participating! This submission earned $113.38 from SIV and $187.21 from the Public Vote, for a total of $300.59.
Here's what we noted in our evaluation:
What's interesting about this submission
- Clearly important.
- Hard to conceive of what solutions might look like
What takes away from it
- Hard to make sense of this issue.
- Variation on https://docs.siv.org/mitigating-attacks/spoofing
- We recommend postal not email auth for civil elections, which are the most at risk of these sorts of adversarial situations
Issue to track getting paid: https://github.com/siv-org/hack.siv.org/issues/9
If SIV were to be deployed, wherever it uses email would be a target for malicious actors to spread disinformation. For example, attackers could send fake invitation emails with invalid auth tokens to users; or fake confirmation emails to users that inform them how they voted, whether they did or not. These emails could confuse voters by making them think SIV is not working (even if it is) and make them distrustful of the process, potentially also obscuring their right to vote.
I heard that at least some of these emails are digitally signed with a private key, which would help differentiate real SIV emails from fake ones. However, it is unclear to me if it is obvious to the recipient whether or not the email is signed and signed by the correct entity. Regardless of how the email appears, it needs to be clearly communicated to voters that they need to look for that signature to verify an email's authenticity.