benadida / helios-server

Helios server

Home Page:http://heliosvoting.org

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Check required logins earlier, alternatively warn about them

RichiH opened this issue · comments

Voting in https://vote.heliosvoting.org/helios/e/otel-gc-2021 , I was able to get to the last step in the voting process, in an incognito browser. Only when clicking submit did it check for my login and errored out.

This is less than ideal as I initially thought I had found a security issue in the vote, but didn't want to click submit in fear of voiding the vote and/or leaking my preferred options in the vote.

I saw, and appreciate, that the information taken through GitHub is minimal and shed right after the vote; this is appreciated very much. This is an opposing goal to "confirm login early", so I am deliberately not suggesting possible implementations, just asking for consideration to cover the aspect of "don't make the security-minded think there might be an exploit and a catch 22", as well.

This was my first time using helios; while #56 is a real pity, I liked the overall experience and the clear thought that went into the system. Thanks!