Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Email security on Democratic campaigns is as bad as 2016

washingtonpost.com

Post reply on HN
Print view View original

41–50 of 114 posts

Re: Email security on Democratic campaigns is as bad as 2016

#41

Post by craftyguy »

idlewords wrote: post #34
craftyguy wrote: post #33

Earlier quoted context omitted.

> the phishing scenario that is one of the biggest threats to campaigns What phishing scenario, and how is TFA completely defeated by it? The article just says "the best defense against phishing is a 'security key'", but doesn't explain why other options like TFA are inadequate. I didn't say TFA would be the ultimate solution, but that it's likely to be supported by more things that people use (like apple devices..).…

If I show you an impostor website purporting to be Gmail, and get you to type in your password plus authenticator code / SMS code / app notification code, I can get into your email account. If I do the same and your second factor is a security key, I get a useless binary blob that I can't turn around and hand to Google. The U2F key gets the actual URL of the page you are on from the browser, so it can't be fooled by…

> so it can't be fooled by impostor websites, however clever

Can't this be defeated by DNS poisoning? TLS/HSTS would help, but that assume folks are verifying that the hostname matches the cert... (big assumption)

In any case, I see your point, thank you for explaining it.

Re: Email security on Democratic campaigns is as bad as 2016

#42

Post by tptacek »

craftyguy wrote: post #41
idlewords wrote: post #34

Earlier quoted context omitted.

If I show you an impostor website purporting to be Gmail, and get you to type in your password plus authenticator code / SMS code / app notification code, I can get into your email account. If I do the same and your second factor is a security key, I get a useless binary blob that I can't turn around and hand to Google. The U2F key gets the actual URL of the page you are on from the browser, so it can't be fooled by…

> so it can't be fooled by impostor websites, however clever Can't this be defeated by DNS poisoning? TLS/HSTS would help, but that assume folks are verifying that the hostname matches the cert... (big assumption) In any case, I see your point, thank you for explaining it.

You don't have to verify that your hostname matches the cert. The browser does that for you. That's part of the point.

Re: Email security on Democratic campaigns is as bad as 2016

#43

Post by Alex3917 »

tptacek wrote: post #36
Alex3917 wrote: post #31

Earlier quoted context omitted.

APP is great if you're traveling abroad or if there is a specific threat you need to mitigate for a few weeks, but it's not really a viable longterm solution since it disables all of the third-party apps that candidates need to use for their campaigns. For the average candidate, they're going to improve their chances of winning much more by using a CRM than by forgoing its use on the off chance a state-sponsored atta…

Anecdotally: there are campaigns using APP, and it apparently hasn't been problematic in that regard.

Interesting. I wonder if they're just using browser extensions though to get the same functionality? Since if you have any browser plug-ins installed (e.g. AdBlock), you've got the same potential issue.

Re: Email security on Democratic campaigns is as bad as 2016

#44

Post by rrdharan »

idlewords wrote: post #24
Someone1234 wrote: post #2

This may sound a bit glib but the Democrats should just get a contract with Google, give all of their people GSuite accounts, and enroll them in the Advanced Protection Program[0]. It isn't perfect but it would be a massive step up from everyone having their own home-ground solutions that may or may not be secure. [0] https://landing.google.com/advancedprotection/

There are a couple of problems with this (and it's a good question!). One is that many campaigns are just small and don't have any in-house IT expertise, even the kind needed to run GSuite. Another is that GSuite doesn't protect people's personal accounts, which is the big risk here. APP is nice in theory, but I don't believe it's workable in practice for Congressional campaigns. The keys break too easily, and there…

You can opt in personal accounts to APP can't you? Or are you just saying it's not easy to enforce?

Re: Email security on Democratic campaigns is as bad as 2016

#45

Post by [deleted] »

tptacek wrote: post #28
laurentMiguel wrote: post #6

I think that's because email, fundamentally just isn't very secure. Lots of email servers support fallback to non-encrypted, plaintext transmission, which can expose entire chains of replies to MITM attacks with a single message being routed questionably. [0,1,2] End-to-end encryption, via user-defined keys is actively discouraged by those who might assuredly know better, and be in a position to change minds. Usually…

PGP addresses literally none of the operational security problems congressional campaigns have. No matter how you protect individual emails, for most users (and probably every single congressional campaign staffer) your email account is still the most important account you have, the key to every other account you control. And PGP doesn't do a thing about incoming emails with malicious attachments. People think PGP is…

[deleted]

Re: Email security on Democratic campaigns is as bad as 2016

#46

Post by [deleted] »

tptacek wrote: post #28
laurentMiguel wrote: post #6

I think that's because email, fundamentally just isn't very secure. Lots of email servers support fallback to non-encrypted, plaintext transmission, which can expose entire chains of replies to MITM attacks with a single message being routed questionably. [0,1,2] End-to-end encryption, via user-defined keys is actively discouraged by those who might assuredly know better, and be in a position to change minds. Usually…

PGP addresses literally none of the operational security problems congressional campaigns have. No matter how you protect individual emails, for most users (and probably every single congressional campaign staffer) your email account is still the most important account you have, the key to every other account you control. And PGP doesn't do a thing about incoming emails with malicious attachments. People think PGP is…

[deleted]

Re: Email security on Democratic campaigns is as bad as 2016

#47

Post by pcwalton »

JetSpiegel wrote: post #29
saagarjha wrote: post #17

Earlier quoted context omitted.

Thanks. Hopefully this will be solved when they adopt Web Authentication?

If Apple doesn't come up with an alternative iAuth NIH "standard".

Google didn't support U2F for Gmail in Firefox for a long time because Chrome was incorrectly implementing the spec [1] and relied on interoperability with their previous proprietary implementation [2] of U2F, and Gmail relied on that. Apple has been a better actor in this regard than Google has, since they are planning to implement the spec as written [3].

[1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1409573

[2]: https://bugzilla.mozilla.org/show_bug.cgi?id=1436078

[3]: https://webkit.org/status/#feature-web-authentication

Re: Email security on Democratic campaigns is as bad as 2016

#48

Post by laurentMiguel »

ISL wrote: post #20
laurentMiguel wrote: post #6

I think that's because email, fundamentally just isn't very secure. Lots of email servers support fallback to non-encrypted, plaintext transmission, which can expose entire chains of replies to MITM attacks with a single message being routed questionably. [0,1,2] End-to-end encryption, via user-defined keys is actively discouraged by those who might assuredly know better, and be in a position to change minds. Usually…

PGP is so easy to use that the first day I attempted to configure it, I accidentally emailed my friends my private, rather than public, key. I await the day that a great PGP client for everyone might emerge, but I'm not sure that it is possible, nor am I certain that people will want it. There is substantial utility involved in letting Google read all of my email for spam/malware filtering and more.

The strong will survive. On some level you have to make peace with the way evolution really works. Or, you know, wind up extinct.

Re: Email security on Democratic campaigns is as bad as 2016

#49

Post by danjoc »

saudioger wrote: post #37
RickJWagner wrote: post #21

Amazing that the article contained not one word about Hillary Clinton's private email server. I'd have thought that would deserve at least a little coverage.

Private servers can be secure, that's not really relevant to the issues being discussed in the article.

What self hosted email does U2F? Seems like a legit point in an article touting U2F email authentication.

Re: Email security on Democratic campaigns is as bad as 2016

#50

Post by jessaustin »

daveFNbuck wrote: post #35
idlewords wrote: post #27

Earlier quoted context omitted.

What we're trying to protect here is people's personal accounts. So even campaigns that use GSuite have people's personal stuff just on random Gmail (or Yahoo, or AOL...)

They're trying to protect work-related communications. These can be separated from personal accounts.

Where have we heard this before?
Post reply on HN