Hacker News new | ask | show | jobs
by throwaway2016a 3433 days ago
To answer the question:

You change the SHA1 hash of the voting data in both the PDF and the XML filename. As long as the user is not verifying against a paper printout this attack will work.

Everything else in this article is secondary.