61–70 of 114 posts
I understand the challenges of end users and security, but why not give them Signal or at least Whatsapp? Email is never going to be secure, regardless, and many users can handle the new messaging applications.
It's very hard to move people entirely off of email. A big part of campaign security training is to move people onto Signal or Whatsapp, though, and I'm glad you brought it up.
Reading the phrase "political truffle pig" is a win regardless of anything else you may think about this article.
The standard political nomenclature is "bundler", but I don't think I've ever witnessed a bundler describing himself as such. They prefer euphemism.
Earlier quoted context omitted.
Since support for APP seems to be limited to specific browsers/hardware, why not at least do TFA with a one-time passcode app? That seems to be much more widely supported, and it considerably better than whatever they may/may not be doing today..
That does not guard against the phishing scenario that is one of the biggest threats to campaigns. Any kind of two-factor auth short of a security key is inadequate against that threat.
Earlier quoted context omitted.
There are a couple of problems with this (and it's a good question!). One is that many campaigns are just small and don't have any in-house IT expertise, even the kind needed to run GSuite. Another is that GSuite doesn't protect people's personal accounts, which is the big risk here. APP is nice in theory, but I don't believe it's workable in practice for Congressional campaigns. The keys break too easily, and there…
You can opt in personal accounts to APP can't you? Or are you just saying it's not easy to enforce?
Earlier quoted context omitted.
Anecdotally: there are campaigns using APP, and it apparently hasn't been problematic in that regard.
Interesting. I wonder if they're just using browser extensions though to get the same functionality? Since if you have any browser plug-ins installed (e.g. AdBlock), you've got the same potential issue.
Earlier quoted context omitted.
PGP addresses literally none of the operational security problems congressional campaigns have. No matter how you protect individual emails, for most users (and probably every single congressional campaign staffer) your email account is still the most important account you have, the key to every other account you control. And PGP doesn't do a thing about incoming emails with malicious attachments. People think PGP is…
Wow, so, you really believe that asking people to lock up their important messages to you, using a public key that you've provided through a verified, alternate non-email channel really won't work? PGP actually does do something about incoming email attachments. It offers the opportunity to programmatically reject anything that is non-encrypted ASCII text, and renders malicious files as non-executable ASCII text, whe…
Earlier quoted context omitted.
If I show you an impostor website purporting to be Gmail, and get you to type in your password plus authenticator code / SMS code / app notification code, I can get into your email account. If I do the same and your second factor is a security key, I get a useless binary blob that I can't turn around and hand to Google. The U2F key gets the actual URL of the page you are on from the browser, so it can't be fooled by…
> so it can't be fooled by impostor websites, however clever Can't this be defeated by DNS poisoning? TLS/HSTS would help, but that assume folks are verifying that the hostname matches the cert... (big assumption) In any case, I see your point, thank you for explaining it.
Earlier quoted context omitted.
Wow, so, you really believe that asking people to lock up their important messages to you, using a public key that you've provided through a verified, alternate non-email channel really won't work? PGP actually does do something about incoming email attachments. It offers the opportunity to programmatically reject anything that is non-encrypted ASCII text, and renders malicious files as non-executable ASCII text, whe…
You can downvote all you want, but you're simply matadoring behavioral issues as if they are technical hurtles, and that's dishonest.
Earlier quoted context omitted.
> so it can't be fooled by impostor websites, however clever Can't this be defeated by DNS poisoning? TLS/HSTS would help, but that assume folks are verifying that the hostname matches the cert... (big assumption) In any case, I see your point, thank you for explaining it.
You don't have to verify that your hostname matches the cert. The browser does that for you. That's part of the point.