Are there any good PPT decks, workshop material or some such you all recommend to build on top of? I'd be keen to teach a few classes or run a few workshops for local campaigns, and it seems this area must be ripe with smart people having put together material to build on already
Email security on Democratic campaigns is as bad as 2016
51–60 of 114 posts
Re: Email security on Democratic campaigns is as bad as 2016
#52Slow learners.
Re: Email security on Democratic campaigns is as bad as 2016
#53Are there any good PPT decks, workshop material or some such you all recommend to build on top of? I'd be keen to teach a few classes or run a few workshops for local campaigns, and it seems this area must be ripe with smart people having put together material to build on already
The stuff on https://techsolidarity.org/ has been peer-reviewed and battle-tested repeatedly, and is where I would start. When it comes to this stuff I think it's as much about what you don't train as what you do. There's a lot of security nerd orthodoxy that is of negative value when you've only got an hour, one time, to raise the level of a campaign.
Re: Email security on Democratic campaigns is as bad as 2016
#54I think that's because email, fundamentally just isn't very secure. Lots of email servers support fallback to non-encrypted, plaintext transmission, which can expose entire chains of replies to MITM attacks with a single message being routed questionably. [0,1,2] End-to-end encryption, via user-defined keys is actively discouraged by those who might assuredly know better, and be in a position to change minds. Usually…
PGP addresses literally none of the operational security problems congressional campaigns have. No matter how you protect individual emails, for most users (and probably every single congressional campaign staffer) your email account is still the most important account you have, the key to every other account you control. And PGP doesn't do a thing about incoming emails with malicious attachments. People think PGP is…
Wow, so, you really believe that asking people to lock up their important messages to you, using a public key that you've provided through a verified, alternate non-email channel really won't work?
PGP actually does do something about incoming email attachments. It offers the opportunity to programmatically reject anything that is non-encrypted ASCII text, and renders malicious files as non-executable ASCII text, when such policies are properly enforced. At this point, the promiscuous user is protected from delving deeper into emails. The server can effectively isolate attachments entirely, by proxying mail delivery, and refusing to decrypt attachments automatically. This would further defend against account compromise, through practices that require special handling of attachments. Email then becomes a medium of communication, rather than file transfer, and file transfer is pushed to other protocols and applications.
Sort of like a point-and-call policy. Forcing a user to cognitively jump through hoops to discover the contents of an attachment, when they should really be using email for the exchange of messages with humans, or automated control messages, such as multi-factor auth. Doing something like this limits email to character data only, rather than interpretable instructions. You know, much in the way we don't execute JavaScript from an email context.
Example:
-----BEGIN PGP PUBLIC KEY BLOCK-----
mQENBFuPKDYBCAC6xIbamQ3hTFCp8qcu8fLiz8XrSMXod/Xo5/iV/7FbqN8pE6uB
9EFyrWX1gy6ZNP+EGXrQ017sNcGHL7LquV74m+Z4/CRZlKpHMR2U9WEIhjgfL46c
vtQP/l9MB39P/VK3xsPXHTWSBiVdDdhWQTTZ5Tl88Zwo5n81ToOMFDLSXqZThlBl
CjUNOmHt1nLpkUzyn5h8c9/x2gNe/ArD2nY6DewHZCALLSDAEKLqrru+v2N6ABRh
Ad7GTVaHrD7aM84nlDMYiJmWSbx+IX2i4sxOeescjFPCmgjIuLLfIv94Oc7a6cV/
O7JzaX5Vyr+wBiHqhG2Xrwo+/V6+hRLv3Aj7ABEBAAG0H2xhdXJlbnQgbWlndWVs
IDxsbUBleGFtcGxlLmNvbT6JAVQEEwEIAD4WIQRrmP8aKYfcI7jMLtoYF2U5ECzk
nQUCW48oNgIbAwUJA8JnAAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRAYF2U5
ECzkneaeCACVHmasl2V+gz2dDKJr3ELuCM82ZGltq44kSj2Wod5KyvAulb8XB4Ox
d5LXw8rdLuHiGl8vFrPljRO1do+8ahQyPy6Sk5UNb73zi8ujubhLHm/jpSdO5lUO
ryb/TN4lnBnGSDeYkUtKn2FUr0+i4EgnqAi2L2svQoDwzzyyeWrkXBgqqm1NT0bw
hbBhQfozdafqvFF3gBfaBqrFpD/KAgHzmTe3YejrD9tJTVJamTsEvmMXNMhaXF3s
FVqlWGoGr0/17Ft75SyuKj+ssJ7oxeblxhocUum8XvtmVlu8Ee/wxqugApeDLN0x
6cqEH837QIU6vQgx3mGK7Vv035uRru1yuQENBFuPKDYBCADC1Hea+6AMj7gwNnfX
tOIJ8X/rKeqw6u3Up1vt7DC3IOrml0AQHk08bklLbXokO/GlW0uUwX/tqKeIz35y
l+uzqBooR62H99CQc36trN96GD6zxeVYlbMpWdTzPqgxSVmEx9EvfCPhsgCueTz1
oTJw5SW4dUOHuL3k8R/cEFraJJpigp8PceXJWsxinUTOVSKH1VhWsZaActRRicf4
Y9GOcEJhgFhNlvVgFW+x/+hYL3vLXeUNTb6UCH6O9X0I+zv03VbLO/GdZFGA3Vps
MYzzk8y/n93DkAIAD6vCPZAvcOLGMXaEv5GER2Scpv/sgINefh67+ExH/Vc8ZrUl
C421ABEBAAGJATwEGAEIACYWIQRrmP8aKYfcI7jMLtoYF2U5ECzknQUCW48oNgIb
DAUJA8JnAAAKCRAYF2U5ECzknTEMB/0ZcvUYZq5IlqsBNYdZjCaXY5KQqWqKnQlW
jISSM7RmjCQwDqjTgyOVfl19PeVpj63h/tAPTXcsJ31LlpyHUklBVAeQmXuvMRry
WMfLeHa5nAQmS3VgZNyahFyps+mGFiDChy7Zz14v/bpfUAeqBIY4txVHwT4fLWEM
M1ZRbu8DcgwUErXt5xe5kOJZRWd8Q/xnspn9Tg+QvdWF67xi4CZ7RTl2+aL8MshT
051atXtkskDomQD/kNhP757cUuvDBkC4FydP8rztMdNLUiiC0L1R6V4bxhr4Yhsh
dbf+w0XrcuUaSnaka5TAeh+NCK//CoUsnVF/fun2bJ8bRikMPwxy
=/JKx
-----END PGP PUBLIC KEY BLOCK-----Re: Email security on Democratic campaigns is as bad as 2016
#55I understand the challenges of end users and security, but why not give them Signal or at least Whatsapp? Email is never going to be secure, regardless, and many users can handle the new messaging applications.
Re: Email security on Democratic campaigns is as bad as 2016
#56Amazing that the article contained not one word about Hillary Clinton's private email server. I'd have thought that would deserve at least a little coverage.
I wrote the article. In what way do you think the email server is germane?
On a different topic, is it your impression that other political parties are better at email security than the Democrats? If so, why is that? If not, why is the media focus on Democrats?
Re: Email security on Democratic campaigns is as bad as 2016
#57Earlier quoted context omitted.
They're trying to protect work-related communications. These can be separated from personal accounts.
I've been working on sensitive projects with trained professionals for 2 decades and have watched how hard it is for people to keep personal computing resources and professional ones separate. The idea that campaign staffers would be required to maintain a level of OPSEC that IT security people can't reliably maintain seems unrealistic and unproductive. I think people have a broken idea of what a congressional campai…
Shouldn't the fact that they're a bunch of random people make it easier to separate work from personal communications?
Re: Email security on Democratic campaigns is as bad as 2016
#58Reading the phrase "political truffle pig" is a win regardless of anything else you may think about this article.
The standard political nomenclature is "bundler", but I don't think I've ever witnessed a bundler describing himself as such. They prefer euphemism.
Re: Email security on Democratic campaigns is as bad as 2016
#59Earlier quoted context omitted.
If Apple doesn't come up with an alternative iAuth NIH "standard".
Google didn't support U2F for Gmail in Firefox for a long time because Chrome was incorrectly implementing the spec [1] and relied on interoperability with their previous proprietary implementation [2] of U2F, and Gmail relied on that. Apple has been a better actor in this regard than Google has, since they are planning to implement the spec as written [3]. [1]: https://bugzilla.mozilla.org/show_bug.cgi?id=1409573 [2…
Didn't Google implement before the browser integration APIs spec was final?
If so, I totally understand a migration period, and it's nothing to hold against them.
Re: Email security on Democratic campaigns is as bad as 2016
#60Earlier quoted context omitted.
I've been working on sensitive projects with trained professionals for 2 decades and have watched how hard it is for people to keep personal computing resources and professional ones separate. The idea that campaign staffers would be required to maintain a level of OPSEC that IT security people can't reliably maintain seems unrealistic and unproductive. I think people have a broken idea of what a congressional campai…
Shouldn't the fact that they're a bunch of random people make it easier to separate work from personal communications?
Not at all, a bunch of random people really means "ad hoc - just use what works".
That means no IT support to get that 2FA protected (if you even have it) email account onto your phone. Guess what email they will start using?