Thread by @konklone

Today, the NYT covered research by @mspecter, @jimmykoppel, and @djweitzner into the security of Voatz, a mobile app that's been used for online voting in US elections:

nytimes.com/2020/02/13/us/…

This found serious issues, but they're just some of the many problems with @Voatz. 1/

The researchers here reported these issues to @CISAgov, rather than @Voatz directly, out of concern for potential retaliation.

Their fear is well justified. In October, Voatz reported a student at U of Michigan to authorities for analyzing their app: 2/

magazine.cointelegraph.com/2020/02/07/saf…

@CISAgov @Voatz And in response to the researchers' work today, rather than acknowledging any of the issues in the paper, @Voatz accuses them of acting in bad faith, with the goal of sowing discord in elections:

blog.voatz.com/?p=1209

@CISAgov @Voatz To appear transparent, @Voatz makes a big deal about having a public bug bounty.

But the bounty doesn't allow the public to examine their backend, or the live production app. This dramatically limits public review of Voatz' infrastructure.

4/

Worse, at the time @Voatz reported the U of M student, the scope was ambiguous and easily could have led a casual reader to believe the production app was in scope.

But instead of extending any benefit of the doubt, Voatz reported the student and changed their scope text: 5/

@Voatz This is the total opposite of how anyone involved in elections should deal with researchers.

Even given a scope, people will still accidentally tread outside the lines. Election officials and voting companies need to work collaboratively with researchers to be successful. 6/

Recently, @CISAgov posted a draft directive that would require that federal agencies receive reports of vulns in their live systems from the general public:

cyber.dhs.gov/bod/20-01/

It's a genuinely great directive, and accurately captures modern norms in vuln disclosure. 7/

One of the key sentences in @CISAgov's guidance is that federal agencies should be "more concerned with receiving and fixing vulnerabilities than in enforcing strict compliance with the letter of the policy."

This is right, and what we should be bringing to election systems. 8/

But this is clearly not @Voatz' perspective.

Given how they handled the U of M student, how they responded to the MIT research today, their discomfort with basic transparency, and their reliance on security-through-obscurity -- Voatz should not be trusted to run US elections.

The researchers behind yesterday's disclosure of security issues with @Voatz published a solid FAQ today on their work and why they reported it the way they did:

internetpolicy.mit.edu/faq-on-the-sec…

In the meantime, @Voatz posted a transcript of a press call in which they claim that a ballot privacy flaw isn't important because it's not realistic for anyone to intercept internet traffic to the US from overseas.

Just to be clear: that is super wrong.

blog.voatz.com/?p=1243

CNN covered yesterday's security research on @Voatz, and Voatz' (generally misleading) statements since.

I'm also quoted, noting that Voatz' public bounty doesn't allow the public to research their back-end server the way Voatz claims:

cnn.com/2020/02/14/pol…

I also emphasized to CNN that vuln disclosure by the public has overall gotten better: @Voatz's reaction is more unusual today.

"Security through obscurity" can be tempting, but real security means not being afraid to let the public verify your work.

cnn.com/2020/02/14/pol…

In a reversal, citing cybersecurity concerns, West Virginia will not use Voatz for its primary election after all.

They'll use Democracy Live instead, where ballots can be marked on- or offline, then printed and mailed:

nbcnews.com/news/amp/ncna1…

This is a clear win for West Virginia voters and for the security community, whose trust Voatz very deservedly lost.

In the piece, West Virginia's elections general counsel indicates they'll be looking to the security community later this year to judge how far Voatz has come:

It could be quite tough for @Voatz to regain that trust.

Two weeks ago, Voatz responded to valid security issues by inaccurately dismissing their impact, and publicly accusing the researchers of wanting to deliberately disrupt elections.

blog.voatz.com/?p=1209

This week, @Voatz updated their vulnerability disclosure policy.

But instead of offering an olive branch, they hand-wave at being "critical infrastructure" to falsely imply they have no discretion in reporting researchers who examine their live systems:

hackerone.com/voatz/policy_v…

Given how @Voatz is responding to all this, I'd say they have a long, long way to go to rebuild trust with the security community.

In the meantime, if you find a bug in Voatz' systems, I encourage you to report it right to CISA, since reporting it to Voatz directly is unsafe.

And today, @Voatz no longer has a public bug bounty on HackerOne: hackerone.com/voatz

There's no public indication of why, but it's good that it's closed. Given how Voatz treated security researchers, H1 was hosting a space that was unsafe for the public to engage with.