Skip to main content
Information Security

Return to Question

clarify scope a bit further.
Source Link
D.W.
D.W.
  • 100.3k
  • 33
  • 279
  • 604

Consider an election web site that will be used for voting over the Internet. What steps should the administrator of such a web site take to provide adequate security against man-in-the-middle attacks and spoofed web sites? Can anyone suggest a checklist of top-priority items that should not be overlooked? Assuming that the answer involves SSL, how should the site be using SSL and how should SSL be configured?

Motivation: Recently, some technical details about Halifax's use of web-based voting in the 2012 elections surfaced. Based upon the publicly available information, it appears that they fell short of accepted practices for SSL configuration. But what should they have done? What should folks deploying web-based Internet voting make sure not to overlook, to defend against man-in-the-middle attacks and spoofing attacks? How should they have configured SSL?

I'd prefer this to be a narrowly-scoped question that's limited to SSL configuration, MITM attacks, and spoofing attacks: other issues related to e-voting security, such (such as client-side malware or, insider threats, voter authentication, etc.) are out of scope.

Consider an election web site that will be used for voting over the Internet. What steps should the administrator of such a web site take to provide adequate security against man-in-the-middle attacks and spoofed web sites? Can anyone suggest a checklist of top-priority items that should not be overlooked? Assuming that the answer involves SSL, how should the site be using SSL and how should SSL be configured?

Motivation: Recently, some technical details about Halifax's use of web-based voting in the 2012 elections surfaced. Based upon the publicly available information, it appears that they fell short of accepted practices for SSL configuration. But what should they have done? What should folks deploying web-based Internet voting make sure not to overlook, to defend against man-in-the-middle attacks and spoofing attacks? How should they have configured SSL?

I'd prefer this to be a narrowly-scoped question that's limited to SSL configuration, MITM attacks, and spoofing attacks: other issues related to e-voting security, such as client-side malware or voter authentication, are out of scope.

Consider an election web site that will be used for voting over the Internet. What steps should the administrator of such a web site take to provide adequate security against man-in-the-middle attacks and spoofed web sites? Can anyone suggest a checklist of top-priority items that should not be overlooked? Assuming that the answer involves SSL, how should the site be using SSL and how should SSL be configured?

Motivation: Recently, some technical details about Halifax's use of web-based voting in the 2012 elections surfaced. Based upon the publicly available information, it appears that they fell short of accepted practices for SSL configuration. But what should they have done? What should folks deploying web-based Internet voting make sure not to overlook, to defend against man-in-the-middle attacks and spoofing attacks? How should they have configured SSL?

I'd prefer this to be a narrowly-scoped question that's limited to SSL configuration, MITM attacks, and spoofing attacks: other issues related to e-voting security (such as client-side malware, insider threats, voter authentication, etc.) are out of scope.

Source Link
D.W.
D.W.
  • 100.3k
  • 33
  • 279
  • 604

Configuring election website to prevent MITM attacks

Consider an election web site that will be used for voting over the Internet. What steps should the administrator of such a web site take to provide adequate security against man-in-the-middle attacks and spoofed web sites? Can anyone suggest a checklist of top-priority items that should not be overlooked? Assuming that the answer involves SSL, how should the site be using SSL and how should SSL be configured?

Motivation: Recently, some technical details about Halifax's use of web-based voting in the 2012 elections surfaced. Based upon the publicly available information, it appears that they fell short of accepted practices for SSL configuration. But what should they have done? What should folks deploying web-based Internet voting make sure not to overlook, to defend against man-in-the-middle attacks and spoofing attacks? How should they have configured SSL?

I'd prefer this to be a narrowly-scoped question that's limited to SSL configuration, MITM attacks, and spoofing attacks: other issues related to e-voting security, such as client-side malware or voter authentication, are out of scope.