Hacker News Reader

Comment by eropple | Hacker News Reader

> This attacks could be easily mitigated. [...] second, we should start using physical cryptographic keys instead of passwords

Man--I like the way you think, I really do, but this is not "easy". Technical simplicity and social ease are vastly different, and it's usually the humans who are getting hacked.

View on HN

Can confirm. I did tech at the DNC in 2012. We pushed to get senior staff using 2FA and ran internal phishing drills. Obviously didn't take.

That's super annoying. The 100 person startup I'm at uses 2 factor authentication! It's so easy these days there is no technical excuse anymore.

I'd be willing to bet the 100 person start up you're part of is largely of a different demographic than the parent's DNC staff group.

Hmm. Maybe we should chat? Not directly related to this, but I'd love to pick your brain. Email's in my profile.

I honestly think politicians have stopped using email. This leak was so inconvenient that it has changed behaviors.

If an organization is working with sensitive data maybe they should invest some resources into security. I understand it is not easy because companies like Microsoft have been releasing poorly designed software (with things like autorun for USB drives) for 20 years and it still is the leader. But we have to advance step by step. For every single person needing executable attacments there are maybe million users who can run them without understanding the consequences.

I mean, you're talking about the campaign of a person who was running while being investigated for circumventing security procedures. Regardless of what you think about those topics or their validity, is it that surprising that the campaign wasn't up to par on the security front?

You're conflating 2 different stories. HRC had no say over how the DNC ran their email nor were they subject to any special regulation as a private organization. Although it's been widely speculated there's yet no proof that HRC's private email server was ever hacked.

The RNC was hacked as well, although they similarly circumvented the same security procedures.

That the RNC was also hacked seems to be a popular, but probably false, meme.

http://www.cnn.com/2016/12/10/politics/smerconish-spicer-hac...

Belief in this will likely depend on who someone trusts more, spokespersons for the RNC, or the New York Times and the Washington Post.

From the New York Times article: "One senior government official, who had been briefed on an F.B.I. investigation into the matter, said that while there were attempts to penetrate the Republican committee’s systems, they were not successful."

From the WaPo: "U.S. officials said the Republican National Committee’s computer systems were also probed and possibly penetrated by hackers tied to Russian intelligence services, but that it remains unclear how much material — if any — was taken from the RNC."

There were a number of significant caveats in the NYT and WaPo reporting of this that people have ignored because it confirms their existing assumptions. Probably by design; it lets the papers push their preferred narratives whilst giving them something to fall back on if it turns out not to be true.

My other post is flagged and downvoted by well, yeah, I'll keep it civil despite them.

But the point was, The russian hacker forums are orders of magnitude better than anything offered in English, and virtually every single one has made no secret (other than you need to read Russian) that they were working hard all year to get Trump "elected". From spreading rumours, distributing any dirt they could elicit, to boots on the ground playing with the voting machines. There was even talk of cash incentives from George Soros and Peter Thiel.

WaPo and NYT undoubtably have journalists that both read Russian and Frequent such forums. But it will be a while before they get the courage to go public with just how much US infrastructure is now completely pwned by the Ruskies. RNC and DNC only made headlines because some of the haul got sent to wikileaks aka FVEY.

My personal opinion is "America" deserves it for all the effort they put into making systems insecure.

"Maybe" they should. But almost none of them do.

That's why it's a social problem, not a technical problem, yeah?

I think it is rather the problem of poorly designed software. It is impossible to make millions of users to set up some secure configuration, install firewalls etc.

The software should have secure default settings, if a user is not a computer engineer he should not be able to execute files from email attachments.

I think it's a generational thing. Americans of a certain vocation and certain age and older tend to have no idea about how this whole Internet thing works. No matter what their education level or achievement level. Obama held onto his Blackberry for almost 2 years after SS told him you can't use that thing.

I suspect what needs to happen is each branch of government needs to have infosec people assigned to it that sets standards and policies around this stuff. If they don't comply there have to be consequences.

It's not necessarily a generational thing. John Podesta was suspicious and sent the phishing email to campaign IT. Clinton campaign IT screwed up and told him to click the link and reset his password. Podesta is in his 60s and the IT people look like hey we're in their 20s.

That is an impressively dismissive statement.

Well, we've been working on making it pretty easy over at Userify! but, truthfully, we're only tackling one piece of the puzzle (SSH keys). Your point is well taken about websites/web apps designed for mere mortals.

TLS client auth is really pretty much a dead letter: it's not easy at all. The biggest impediment for widespread TLS client auth seems to be that CA's are involved.

U2F might help.. and widespread MFA/2FA. Maybe we shouldn't be just tossing out passwords just yet, but just pushing for full MFA support for mission critical apps.

Reply on news.ycombinator.com