Thread by @tayvano_

Y'all gotta stop what you are doing rn and catch up on this hot mess disgusting scammy snake oil-y non-blockchain "blockchain" app Voatz.

Yes. A blockchain voting app being touted around for real live elections. What could go wrong?

Join me. 🐰🕳🔥🔥🍆🦠🤥💥⚰😱🦠🍆🌵🍆

https://twitter.com/trailofbits/status/1238432788388478979

Nov 2019 (my date of discovery)

@mattblaze shares that our lovely bureaucracy is sending letters around demanding a security audit of a voting app. Bc, yes, we rely on paper to secure our elections. Oh…wait…😒

https://twitter.com/mattblaze/status/1192837227480518667

Fast forward ⏩ Feb 13, 2020

So while most of us were at ETHDenver, Voatz started getting attention again after a report came out by @mspecter @jimmykoppel @djweitzner from @MIT. (News possibly enhanced by the hot-mess Iowa Caucus 2wks prior.)

Report:
internetpolicy.mit.edu/wp-content/upl…

Feb 13-Feb 15, 2020

A good thread summarizing the news that research and subsequent news coverage:

https://twitter.com/konklone/status/1228023846651015178

Feb 13, 2020

Voatz responds with typical scam bullshit, "blah blah I pinky promise we're not a scam!!! 🤥🤥🤥"

blog.voatz.com/?p=1209

Feb 14, 2020

The researchers respond to Voatz response.

internetpolicy.mit.edu/faq-on-the-sec…

(Also, @schneierblog picks it up
schneier.com/blog/archives/…)

Feb 15, 2020

More glaring concerns are shared by @yaelwrites, who, unfortunately, has had experience with Voatz and their secrecy dating back to NOVEMBER 2018!! 😲

https://twitter.com/yaelwrites/status/1228828516092801024

Feb 15, 2020

@tarah says 🖕

"For a company that claims to be staffed by cybersecurity experts there appears to be a stunning lack security engineers……it takes 1.5 infosec staff about 23 days to even triage a @Hacker0x01 report"

Full of 💎's:

https://twitter.com/tarah/status/1228690018304049154

Fast forward ⏩ March 13, 2020

While we were busy w the crypto markets
…and the stock market
…and Trump being "yo I always knew this was bad! ahh chinavirus! 🤮"
…and MakerDAO was like "ahhUum USDC?"

@trailofbits drops this EPIC 122pg MASTERPIECE💥

github.com/trailofbits/pu…

Yup nope you gotta click this and at least skim it. They worked their asses off. It's the least you can do. I'll wait.

github.com/trailofbits/pu…

github.com/trailofbits/pu…

github.com/trailofbits/pu…

github.com/trailofbits/pu…

github.com/trailofbits/pu…

github.com/trailofbits/pu…

March 13, 2020

@SarahJamieLewis with the fire, per usual:

https://twitter.com/SarahJamieLewis/status/1238478618386259968

March 13, 2020

@jackhcable reappears after being shit on back Feb for disclosing that really really glaringly immature terrible stupendously ridiculous bug and being told by Voatz "we pinky-promise we aren't a total scam and yeah also you're wrong. 🤥🤥"

https://twitter.com/jackhcable/status/1238482785695866882

March 13, 2020

More summaries and good takeaways from @trailofbits' report since you are all too lazy to READ THE PDF THEY WORKED SO HARD TO GIVE YOU. 😒

https://twitter.com/jhalderm/status/1238494514299277318

March 13, 2020

Yay @lorenzofb and @jason_koebler and @matthew_d_green bringing more fire.

https://twitter.com/lorenzofb/status/1238506892730785792

Aug 6, 2018–March 13, 2020

One of my fave people, @GossiTheDog, shouted back to his AUGUST 2018 thread of more 😱 things about Voatz.

https://twitter.com/GossiTheDog/status/1238539431163854855

(scroll UP to go back in time, it's amazing 😍)

Okay so WHAT DOES THIS ALL MEAN?

🍆🦠💣🦠🦠👨‍💻💥⚰😱🍆🍆🌵

Basically, well, yup, we're still all completely fucked. Sorry.

K, for real though.

1. Governments fall for scams too.

2. This has never been a legitimate project. Period. Full stop. Period period period.

3. Trust security experts.

4. Red flags are red for a fucking reason. OPEN YOUR DAMN EYES.

4b. The red flags from 2018 should have been enough to destroy this in 2018.

There is NO reason this scam bullshit should be considered legitimate enough for basically all the top security researchers + MIT + @trailofbits to get involved. Period.

4c. This is akin to every expert telling everyone that smoking is bad and the cigarette companies going, "no…are you sure? You're not a real doctor! Let's research some more!"

No, it's worse.

It's like if that happened in 2020 and people bought their bs. 😡

5. Paper is my 👑queen👑 and it should be yours too.

Yes, technology is awesome. Yes, we should invent. No, you should not trust technology when it comes down to our truly valuable, important cores.

Less is more.

6. Elections are a zero-sum game. The winner takes all.

And, you don't have to hack all the votes, you only have to manipulate a relatively tiny amount of votes in key areas.

I highly recommend you read @chrisinsilico's Mindf*ck.

The incentives to manipulate elections are so large it's unfathomable. Understand the game you are a part of. It's happened before and will continue to.

BUT FFS DON'T MAKE IT SO FUCKING EASY.

Lastly, 🙇THANK YOU🙇 to all the security researchers, hackers, writers, tweeters, experts, and everyone out there fighting ALL the good fights. Keep fighting. We need you and we love you.

💖💪💖💪💖💪💖💪💖💪💖💪💖💪💖💪💖