5 ms·

it seems we need better safeguards for personal data for elected officials. I think the government could do it easily: 1. Issue iPhone with finger scanner for

it seems we need better safeguards for personal data for elected officials. I think the government could do it easily: 1. Issue iPhone with finger scanner for MFA for all important access. This works so easy that it would be hard for someone to screw it up. 2. Setup home networks to always use secure tunnels ( custom routers with openvpn settings, Etc). 3. MFA all accounts. The key is to make it so easy to do things the right way that it's hard to mess it up.

peterwwillis 11y ago
For non-personal accounts they already use multi-factor auth. And adding more authentication and tunnels doesn't defeat all the other attack vectors. Honestly, do you think these people really care if their Facebook gets hacked or the chain letters passed around by their family members get leaked?
- knz 11y ago
  It's easy to dismiss the contents of their personal email and social media as irrelevant but surely they represent possible attack vectors for extortion or worse.
rhino369 11y ago
The problem is that it's personal email, therefore, not the governments business or problem. That's why they aren't allowed to use their personal email for work purposes. For the really important stuff, they don't even cell remote access. You have to do everything at a secure location.
- Alupis 11y ago
  > That's why they aren't allowed to use their personal email for work purposes Since when? I agree it should be the policy, but it's not. Evidenced by Hillary Clinton's scandal[1], as well as the recent Director of the CIA[2]. In neither case (so far) has the individual been punished. In Hillary's case, the State Department is even siding with her use of private email for official business (including recently discovered classified documents with the header deleted [3]). [1] http://www.businessinsider.com/fbi-hillary-clinton-email-investigation-2016-1 http://www.businessinsider.com/fbi-hillary-clinton-email-inv... [2] http://fortune.com/2015/10/22/cia-aol-email-hack/ http://fortune.com/2015/10/22/cia-aol-email-hack/ [3] http://hotair.com/archives/2016/01/11/hillary-by-ordering-identifying-heading-i-meant-dont-transmit-classified-info-or-something/ http://hotair.com/archives/2016/01/11/hillary-by-ordering-id...
  - rhino369 11y ago
    It is policy and Clinton broke the policy. That is why it's a scandal. The Brenner Scandal was overblown. There wasn't any secret info in there.
kelvin0 11y ago
The finger scanner makes me think of a funny story: http://www.bbc.com/news/world-latin-america-21756709 http://www.bbc.com/news/world-latin-america-21756709
- currysausage 11y ago
  Or this: http://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands http://www.theguardian.com/technology/2014/dec/30/hacker-fak...
toomuchtodo 11y ago
> The key is to make it so easy to do things the right way that it's hard to mess it up. Before you roll out any tech fix, you need a policy fix: "If you use you personal accounts for any official business, you will be terminated and held criminally liable." EDIT: If someone from the USDS sees this, perhaps mention it to the US CTO and POTUS. I hear executive orders are a big thing for the next 12 months.
- matt_wulfeck 11y ago
  Good grief what a terrible policy!
  - toomuchtodo 11y ago
    Why is it bad policy to demand accountability from those who work for us?
izacus 11y ago
Why only elected officials and not everyone?
godgod 11y ago
You'll never get me to adopt using the fingerprint scanner. That is something I will never submit to out of a general principal. I say that KNOWING that the FBI probably already has all of our prints...but that doesn't mean company X won't try to steal it.
jamesrom 11y ago
Fingerprints aren't secrets. Once you have your fingerprint stolen, it's useless. https://www.schneier.com/blog/archives/2015/10/stealing_finger.html https://www.schneier.com/blog/archives/2015/10/stealing_fing... http://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands http://www.theguardian.com/technology/2014/dec/30/hacker-fak...
- matt_wulfeck 11y ago
  Everything is always a trade off. Finger prints offer considerable convenience, especially when they work in tandem with something like a secure HSM. For example, on an iPhone 5s and beyond, the fingerprint doesn't decrypt the phone, it unlocks the secure enclave which decrypts the phone.
  - newman314 11y ago
    I suggest that you read this article on identity, authn & authz. https://technet.microsoft.com/en-us/library/cc512578.aspx https://technet.microsoft.com/en-us/library/cc512578.aspx Also, AFAIK, you cannot be compelled at this point to provide a PIN/password (short of the rubber hose) but someone can just use your finger to unlock a phone. Yes, tradeoffs but the convenience factor is not worth it IMO.
rubberstamp 11y ago
they don't deserve more privacy than what we get
kevin_thibedeau 11y ago
What they need is to blacklist personal email so a compromise there doesn't grant the keys to the cattle. It shouldn't be possible for any government employee to correspond through their private a accounts.
josteink 11y ago
> 1. Issue iPhone with finger scanner for MFA for all important access. This works so easy that it would be hard for someone to screw it up. Yes. Lets use a closed platform controlled by a single private entity to ensure the safety of all sensitive government data. Or how about not. Open-source must be a requirement, and then (sadly) Android is the only option. That said, it does support full disk encryption and use of finger-scanners too, so it's not like you would lose security capabilities.

peterwwillis 11y ago

For non-personal accounts they already use multi-factor auth. And adding more authentication and tunnels doesn't defeat all the other attack vectors. Honestly, do you think these people really care if their Facebook gets hacked or the chain letters passed around by their family members get leaked?

knz 11y ago
It's easy to dismiss the contents of their personal email and social media as irrelevant but surely they represent possible attack vectors for extortion or worse.

rhino369 11y ago

The problem is that it's personal email, therefore, not the governments business or problem. That's why they aren't allowed to use their personal email for work purposes. For the really important stuff, they don't even cell remote access. You have to do everything at a secure location.

Alupis 11y ago
> That's why they aren't allowed to use their personal email for work purposes Since when? I agree it should be the policy, but it's not. Evidenced by Hillary Clinton's scandal[1], as well as the recent Director of the CIA[2]. In neither case (so far) has the individual been punished. In Hillary's case, the State Department is even siding with her use of private email for official business (including recently discovered classified documents with the header deleted [3]). [1] http://www.businessinsider.com/fbi-hillary-clinton-email-investigation-2016-1 http://www.businessinsider.com/fbi-hillary-clinton-email-inv... [2] http://fortune.com/2015/10/22/cia-aol-email-hack/ http://fortune.com/2015/10/22/cia-aol-email-hack/ [3] http://hotair.com/archives/2016/01/11/hillary-by-ordering-identifying-heading-i-meant-dont-transmit-classified-info-or-something/ http://hotair.com/archives/2016/01/11/hillary-by-ordering-id...
- rhino369 11y ago
  It is policy and Clinton broke the policy. That is why it's a scandal. The Brenner Scandal was overblown. There wasn't any secret info in there.

kelvin0 11y ago

The finger scanner makes me think of a funny story: http://www.bbc.com/news/world-latin-america-21756709 http://www.bbc.com/news/world-latin-america-21756709

currysausage 11y ago
Or this: http://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands http://www.theguardian.com/technology/2014/dec/30/hacker-fak...

toomuchtodo 11y ago

> The key is to make it so easy to do things the right way that it's hard to mess it up. Before you roll out any tech fix, you need a policy fix: "If you use you personal accounts for any official business, you will be terminated and held criminally liable." EDIT: If someone from the USDS sees this, perhaps mention it to the US CTO and POTUS. I hear executive orders are a big thing for the next 12 months.

matt_wulfeck 11y ago
Good grief what a terrible policy!
- toomuchtodo 11y ago
  Why is it bad policy to demand accountability from those who work for us?

izacus 11y ago

Why only elected officials and not everyone?

godgod 11y ago

You'll never get me to adopt using the fingerprint scanner. That is something I will never submit to out of a general principal. I say that KNOWING that the FBI probably already has all of our prints...but that doesn't mean company X won't try to steal it.

jamesrom 11y ago

Fingerprints aren't secrets. Once you have your fingerprint stolen, it's useless. https://www.schneier.com/blog/archives/2015/10/stealing_finger.html https://www.schneier.com/blog/archives/2015/10/stealing_fing... http://www.theguardian.com/technology/2014/dec/30/hacker-fakes-german-ministers-fingerprints-using-photos-of-her-hands http://www.theguardian.com/technology/2014/dec/30/hacker-fak...

matt_wulfeck 11y ago
Everything is always a trade off. Finger prints offer considerable convenience, especially when they work in tandem with something like a secure HSM. For example, on an iPhone 5s and beyond, the fingerprint doesn't decrypt the phone, it unlocks the secure enclave which decrypts the phone.
- newman314 11y ago
  I suggest that you read this article on identity, authn & authz. https://technet.microsoft.com/en-us/library/cc512578.aspx https://technet.microsoft.com/en-us/library/cc512578.aspx Also, AFAIK, you cannot be compelled at this point to provide a PIN/password (short of the rubber hose) but someone can just use your finger to unlock a phone. Yes, tradeoffs but the convenience factor is not worth it IMO.

rubberstamp 11y ago

they don't deserve more privacy than what we get

kevin_thibedeau 11y ago

What they need is to blacklist personal email so a compromise there doesn't grant the keys to the cattle. It shouldn't be possible for any government employee to correspond through their private a accounts.

josteink 11y ago

> 1. Issue iPhone with finger scanner for MFA for all important access. This works so easy that it would be hard for someone to screw it up. Yes. Lets use a closed platform controlled by a single private entity to ensure the safety of all sensitive government data. Or how about not. Open-source must be a requirement, and then (sadly) Android is the only option. That said, it does support full disk encryption and use of finger-scanners too, so it's not like you would lose security capabilities.