Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

US Government Sites Give Bad Security Advice

krebsonsecurity.com

Post reply on HN
Print view View original

11–14 of 14 posts

Re: US Government Sites Give Bad Security Advice

#11

Post by ENOTTY »

Cpoll wrote: post #5

I was going to reply to guacamole4's comment, which is unfortunately [dead] now. I think it's useful to talk about. > Author then claims that just about anybody can get .gov domain which is untrue. It didn't take much Googling to find Krebs stating that it's pretty easy: https://krebsonsecurity.com/2019/11/its-way-too-easy-to-get-... Even without an article, it seems obvious to me that a criminal setting up a phishin…

After Brian Krebs' reporting, the GSA just announced a new process to get a .gov domain. https://krebsonsecurity.com/2020/03/u-s-govt-makes-it-harder...

Re: US Government Sites Give Bad Security Advice

#12

Post by rsfern »

Rebelgecko wrote: post #2

What else is new? I can't find a source right now, but IIRC NIST doesn't even follow their own password guidelines. This seems like a relatively minor flub in comparison. If the verbiage was tweaked a bit to say something like "the https ensures that you're actually connected to the website whose name shows up in your address bar" I think there'd be nothing to complain about.

NISTer here — We still have a password rotation policy, which I assume you are referring to in reference to [0]. I think they are working on it, but I’m not sure if we set our own password policy or if it’s something that needs to go through Commerce or GSA or similar.

But in fairness to NIST all of their machines have been smartcard auth only for a while now. Internal services are still under a password rotation policy, but you need a smartcard to access any NIST computer, and smartcard or RSA token for remote access to the network.

So in my opinion it could be a lot worse in terms of an actual security risk. (I am not a security researcher, just a random NIST scientist with personal opinions)

[0]: https://pages.nist.gov/800-63-3/sp800-63b.html

Re: US Government Sites Give Bad Security Advice

#13

Post by Cpoll »

ENOTTY wrote: post #11
Cpoll wrote: post #5

I was going to reply to guacamole4's comment, which is unfortunately [dead] now. I think it's useful to talk about. > Author then claims that just about anybody can get .gov domain which is untrue. It didn't take much Googling to find Krebs stating that it's pretty easy: https://krebsonsecurity.com/2019/11/its-way-too-easy-to-get-... Even without an article, it seems obvious to me that a criminal setting up a phishin…

After Brian Krebs' reporting, the GSA just announced a new process to get a .gov domain. https://krebsonsecurity.com/2020/03/u-s-govt-makes-it-harder...

> But I’m left to wonder: If I’m a bad guy who’s willing to forge someone’s signature and letterhead in a fraudulent application for a .gov domain, why wouldn’t I also be willing to fake a notarization?

It's probably not enough.

I think just by the nature of .gov domains, it's going to be very difficult to properly secure them. Even if registration is airtight, an attacker can still use other vectors: - XSS vuln on a legit .gov page to inject their own content - Open redirect vuln to redirect a legit .gov link to their page - Break a .gov server. I'm sure at least one of them is running a WordPress site with a vulnerable plugin - Break into or social engineer into the DNS server

Post reply on HN