Skip to main content
SpringerLink
Log in

Mobile Voting – Still Too Risky?

  • Conference paper
  • First Online:
Financial Cryptography and Data Security. FC 2021 International Workshops (FC 2021)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 12676))

Included in the following conference series:

Abstract

This paper studies the challenges of creating a mobile device based voting client. We discuss the issues related to standalone and mobile browser based voting applications. In both cases we discuss the problems of vote privacy, integrity and voting channel availability. We conclude that neither of the options can currently achieve the level of security PC-based voting clients can provide, with the attack surface being larger in the case of mobile browser based voting application.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution
Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 99.00
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 129.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Notes

  1. 1.

    https://newjerseyglobe.com/campaigns/with-102-countries-not-receiving-mail-from-u-s-military-and-overseas-voters-might-not-get-primary-election-ballots/.

  2. 2.

    https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=Same+Origin+Policy+bypass.

  3. 3.

    https://www.chromium.org/Home/chromium-security/site-isolation.

  4. 4.

    https://wiki.mozilla.org/Project_Fission.

  5. 5.

    https://docs.microsoft.com/en-us/microsoft-edge/privacy-whitepaper.

  6. 6.

    https://tools.ietf.org/html/rfc6962.

  7. 7.

    https://tools.ietf.org/html/rfc8659.

  8. 8.

    https://blog.cloudflare.com/monsters-in-the-middleboxes/.

  9. 9.

    https://www.w3.org/TR/SRI/.

  10. 10.

    https://fetch.spec.whatwg.org/.

  11. 11.

    The Android version of Firefox supports extensions and there exist third-party mobile browsers (e.g. Kiwi) that support Google Chrome extensions.

  12. 12.

    https://toreini.github.io/projects/domtegrity.html.

  13. 13.

    https://source.android.com/security/features.

  14. 14.

    https://github.com/nabla-c0d3/ssl-kill-switch2.

  15. 15.

    https://android-developers.googleblog.com/2016/07/changes-to-trusted-certificate.html.

  16. 16.

    https://source.android.com/devices/architecture#hidl.

  17. 17.

    https://www.android.com/enterprise/recommended/.

  18. 18.

    https://source.android.com/security/apksigning.

  19. 19.

    https://source.android.com/security/apksigning/v2.

  20. 20.

    https://developer.android.com/studio/publish/app-signing.

  21. 21.

    https://source.android.com/security/apksigning/v3.

  22. 22.

    http://support.google.com/googleplay/android-developer/answer/9842756.

  23. 23.

    https://www.nytimes.com/2016/11/07/technology/more-iphone-fake-retail-apps-before-holidays.html.

  24. 24.

    https://developer.android.com/studio/publish/app-signing.

References

  1. Abdalla, M., et al.: Algorithms, key size and protocols report. Tech. rep. ECRYPT CSA (2018). https://www.ecrypt.eu.org/csa/documents/D5.4-FinalAlgKeySizeProt.pdf

  2. Cardillo, A., Essex, A.: The threat of SSL/TLS stripping to online voting. Proc. E-Vote-ID 2018, 35–50 (2018)

    Google Scholar 

  3. Cetinkaya, O.: Analysis of security requirements for cryptographic voting protocols (extended abstract). In: Proceedings ARES 2008, pp. 1451–1456. IEEE Computer Society (2008)

    Google Scholar 

  4. Corbet, S.: France Holds Local Elections Despite COVID-19 Outbreak Fears. Time, March 2020. https://time.com/5803469/france-local-elections-coronavirus/

  5. Durumeric, Z., et al.: The security impact of HTTPS interception. In: Proceedings of NDSS 2017. The Internet Society (2017)

    Google Scholar 

  6. Eilu, E., Baguma, R.: Designing reality Fit M-voting. In: Proceedings of the 7th International Conference on Theory and Practice of Electronic Governance. ICEGOV 2013, pp. 326–329. ACM (2013)

    Google Scholar 

  7. Ekong, U.O., Ekong, V.: M-voting: a panacea for enhanced e-participation. Asian J. Inf. Technol. 9(2), 111–116 (2010)

    Article  Google Scholar 

  8. Felt, A.P., et al.: Rethinking connection security indicators. In: Twelfth Symposium on Usable Privacy and Security (SOUPS 2016), Denver, CO, pp. 1–14. USENIX Association, June 2016. https://www.usenix.org/conference/soups2016/technical-sessions/presentation/porter-felt

  9. Gamba, J., Rashed, M., Razaghpanah, A., Tapiador, J., Vallina-Rodriguez, N.: An analysis of pre-installed android software. In: 2020 IEEE Symposium on Security and Privacy (SP), pp. 197–213, May 2020

    Google Scholar 

  10. Heiberg, S., Willemson, J.: Modeling threats of a voting method. In: Design, Development, and Use of Secure Electronic Voting Systems, pp. 128–148. IGI Global (2014)

    Google Scholar 

  11. Helbach, J., Schwenk, J.: Secure internet voting with code sheets. In: Alkassar, A., Volkamer, M. (eds.) Vote-ID 2007. LNCS, vol. 4896, pp. 166–177. Springer, Heidelberg (2007). https://doi.org/10.1007/978-3-540-77493-8_15

    Chapter  Google Scholar 

  12. Hermanns, H.: Mobile democracy: mobile phones as democratic tools. Politics 28(2), 74–82 (2008)

    Article  Google Scholar 

  13. Ikram, M., Vallina-Rodriguez, N., Seneviratne, S., Kâafar, M.A., Paxson, V.: An analysis of the privacy and security risks of android VPN permission-enabled apps. Proc. IMC 2016, 349–364 (2016)

    Google Scholar 

  14. Kellner, A., Horlboge, M., Rieck, K., Wressnegger, C.: False sense of security: a study on the effectivity of jailbreak detection in banking apps. In: Proceedings of IEEE EuroS&P 2019, pp. 1–14. IEEE (2019)

    Google Scholar 

  15. Kogeda, O.P., Mpekoa, N.: Model for a mobile phone voting system for South Africa. In: Proceedings of 15th Annual Conference on World Wide Web Applications, Cape Town, South Africa (2013)

    Google Scholar 

  16. Kondracki, B., Aliyeva, A., Egele, M., Polakis, J., Nikiforakis, N.: Meddling middlemen: empirical analysis of the risks of data-saving mobile browsers. In: 2020 IEEE S&P, pp. 1678–1692. IEEE, May 2020

    Google Scholar 

  17. Krimmer, R.: The evolution of e-voting: why voting technology is used and how it affects democracy. Ph.D. thesis, Tallinn University of Technology (2012)

    Google Scholar 

  18. Leith, D.J.: Web browser privacy: what do browsers say when they phone home? (2020), SCSS Technical Report, 24th February 2020

    Google Scholar 

  19. Luo, M., Laperdrix, P., Honarmand, N., Nikiforakis, N.: Time does not heal all wounds: a longitudinal analysis of security-mechanism support in mobile browsers. In: Proceedings of NDSS 2019. The Internet Society (2019)

    Google Scholar 

  20. Luo, M., Starov, O., Honarmand, N., Nikiforakis, N.: Hindsight: understanding the evolution of UI vulnerabilities in mobile browsers. In: Proceedings of the 2017 ACM CCS, CCS 2017, pp. 149–162. ACM (2017)

    Google Scholar 

  21. Mitrou, L., Gritzalis, D., Katsikas, S.K.: Revisiting legal and regulatory requirements for secure e-voting. In: Ghonaimy, A., El-Hadidi, M.T., Aslan, H.K. (eds.) Security in the Information Society: Visions and Perspectives, IFIP TC11 17\({}^{\text{th}}\) International Conference on Information Security (SEC2002), 7–9 May 2002, Cairo, Egypt. IFIP Conference Proceedings, vol. 214, pp. 469–480. Kluwer (2002)

    Google Scholar 

  22. Rajasegaran, J., Karunanayake, N., Gunathillake, A., Seneviratne, S., Jourjon, G.: A multi-modal neural embeddings approach for detecting mobile counterfeit apps. In: The World Wide Web Conference, WWW 2019, San Francisco, CA, USA, 13–17 May 2019, pp. 3165–3171. ACM (2019)

    Google Scholar 

  23. Reis, C., Moshchuk, A., Oskov, N.: Site isolation: process separation for web sites within the browser. In: 28th USENIX Security Symposium (USENIX Security 19), Santa Clara, CA, pp. 1661–1678. USENIX Association, August 2019. https://www.usenix.org/conference/usenixsecurity19/presentation/reis

  24. Salvador, D., Cucurull, J., Julià, P.: wraudit: a tool to transparently monitor web resources’ integrity. In: Groza, A., Prasath, R. (eds.) MIKE 2018. LNCS (LNAI), vol. 11308, pp. 239–247. Springer, Cham (2018). https://doi.org/10.1007/978-3-030-05918-7_21

    Chapter  Google Scholar 

  25. Schryen, G.: Security aspects of internet voting. In: 37th Hawaii International Conference on System Sciences (HICSS-37 2004), CD-ROM/Abstracts Proceedings, 5–8 January 2004, Big Island, HI, USA. IEEE Computer Society (2004)

    Google Scholar 

  26. Scoccia, G.L., Kanj, I., Malavolta, I., Razavi, K.: Leave my apps alone! a study on how android developers access installed apps on user’s device. In: Proceedings of the 7th IEEE/ACM International Conference on Mobile Software Engineering and Systems (2020). http://www.ivanomalavolta.com/files/papers/MOBILESoft_iam_2020.pdf

  27. Shapshak, T.: Africa not just a mobile-first continent - it’s mobile only (2012), CNN Business. https://edition.cnn.com/2012/10/04/tech/mobile/africa-mobile-opinion/index.html

  28. Specter, M.A., Koppel, J., Weitzner, D.: The Ballot is Busted Before the Blockchain: A Security Analysis of Voatz, the First Internet Voting Application Used in US Federal Elections (2020)

    Google Scholar 

  29. Thiel, D.: iOS Application Security: The Definitive Guide for Hackers and Developers. No Starch Press (2016). https://nostarch.com/iossecurity

  30. Yoshida, K., Imai, H., Serizawa, N., Mori, T., Kanaoka, A.: Understanding the origins of weak cryptographic algorithms used for signing android apps. J. Inf. Process. 27, 593–602 (2019)

    Google Scholar 

Download references

Acknowledgements

This paper has been supported by the Estonian Research Council under the grant number PRG920 and European Regional Development Fund through the grant number EU48684 and EXCITE centre of excellence. The authors are grateful to the Estonian Information System Authority and State Electoral Office for their support to the research process.

Author information

Authors and Affiliations

  1. Smartmatic-Cybernetica Centre of Excellence for Internet Voting, Tartu, Estonia

    Sven Heiberg

  2. Institute of Computer Science, University of Tartu, Tartu, Estonia

    Kristjan Krips

  3. Cybernetica, Tartu, Estonia

    Kristjan Krips & Jan Willemson

  4. Software Technology and Applications Competence Center, Tartu, Estonia

    Jan Willemson

Authors
  1. Sven Heiberg
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Kristjan Krips
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Jan Willemson
    View author publications

    You can also search for this author in PubMed Google Scholar

Editor information

Editors and Affiliations

  1. University of Michigan–Ann Arbor, Ann Arbor, MI, USA

    Matthew Bernhard

  2. Computer Science and Mathematics, Stirling University, Stirling, UK

    Andrea Bracciali

  3. Imperial College London, London, UK

    Lewis Gudgeon

  4. Norwegian University of Science and Technology, Trondheim, Norway

    Thomas Haines

  5. Ithaca College, Ithaca, USA

    Ariah Klages-Mundt

  6. Department of Computer Science, Georgetown University, Washington, WA, USA

    Shin'ichiro Matsuo

  7. Imperial College London, London, UK

    Daniel Perez

  8. Dipartimento di Matematica, University of Trento, Trento, Trento, Italy

    Massimiliano Sala

  9. Imperial College London, London, UK

    Sam Werner

Rights and permissions

Reprints and permissions

Copyright information

© 2021 International Financial Cryptography Association

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Heiberg, S., Krips, K., Willemson, J. (2021). Mobile Voting – Still Too Risky?. In: Bernhard, M., et al. Financial Cryptography and Data Security. FC 2021 International Workshops. FC 2021. Lecture Notes in Computer Science(), vol 12676. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-662-63958-0_23

Download citation

  • DOI: https://doi.org/10.1007/978-3-662-63958-0_23

  • Published:

  • Publisher Name: Springer, Berlin, Heidelberg

  • Print ISBN: 978-3-662-63957-3

  • Online ISBN: 978-3-662-63958-0

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation