Hacker News Reader

Comment by hourislate | Hacker News Reader

I don't think the laptop was specifically targeted. People generally don't follow the rules and walk around with too much information that isn't secure. They're bamboozled with phishing and like to click on rar files that have their FEDEX shipping documents for a package they never sent.

Or they have a developer image on their laptop that isn't locked down and download Warez or Torrent and visit Porno sites.

Until there are consequences when this kind of thing happens, like people getting fired or severe penalties, I'm afraid it will just continue. It's either some 15 year old kid in Eastern Europe or the Chinese and Russians have some more info to build dossiers on the American Armed Forces.

View on HN

>People generally don't follow the rules and walk around with too much information that isn't secure.

1 :

>A NASA inspector general report this year determined 48 NASA laptops and mobile computing devices were lost or stolen between April 2009 and April 2011, many containing sensitive data.

http://www.reuters.com/article/us-space-nasa-security-idUSBR...

Personally identifiable information of "at least" 10,000 NASA employees and contractors remains at risk of compromise following last month's theft of an agency laptop, a spokesman told Computerworld via email Thursday.

http://www.computerworld.com/article/2493084/security0/nasa-...

NASA decides to encrypt all their laptops, because PEOPLE STORE SENSITIVE INFORMATION UNENCRYPTED on laptops that they take home.

https://oig.nasa.gov/Special-Review/SpecialReview(12-17-12)....

Regarding 3: The encryption scheme we put into place probably isn't going to slow down a motivated actor. We have master decryption passphrases that are regularly disseminated among the admins and could foreseeably end up in the wild (if nothing else, it wouldn't be difficult to social engineer).

And recently, we've started transitioning to new encryption software. Our implementation of the software prohibits more than one encryption passphrase per machine. So, in order to share machines between employees, organizations have begun sharing the same passphrase across all the organization's machines.

Source: HPES employee working on NASA ACES contract

Windows 10 "the most secure OS in history" still hides file extensions by default, so that virus.pdf.exe appears as virus.pdf!

If you're running defaults then you're already negligent. Not because defaults are necessarily bad (secure defaults ftw). But because you can always do better by tailoring your systems to your specific situation.

My point is rather that I am vigilant enough to check the actual extension of the file when I know it comes from a dodgy source (and to distrust the defaults in the first place). But what about a non technical user to who if the OS says it's a PDF, has the icon of a PDF, then it must be a PDF.

Reply on news.ycombinator.com