4 ms·
Sure... they should just use their (clearnet) government email addresses, secured with mandatory 2FA. If those get hacked it would be potentially embarrassing,
by hendzen 10y ago
Sure... they should just use their (clearnet) government email addresses, secured with mandatory 2FA. If those get hacked it would be potentially embarrassing, but it would be less likely if they all had reasonable security measures.
For any classified material officials can use their SIPRNET/JWICS emails, for which suspicious access is much more closely monitored, of course.
- tptacek 10y agoIt's worth remembering that the fundamental premise of that position is that the government might be able to field a better security team to protect the most sensitive email in the world than could Google. Not many security people in the world would sign on to that position.
- hendzen 10y agoThat's not really an issue. The government is perfectly free to use Google Apps for clearnet email. Do you mean to suggest that Gmail is more secure than government classified networks?
- tptacek 10y agoYes, that is exactly what I mean to suggest.
- hendzen 10y agoWhat gives you that impression?
- smileysteve 10y agoCompetition. Also simple things like spf and tls when many state and federal sites fail at it.
- ComputerGuru 10y agoEh. At some point, the threat isn't how good your crypto is but rather how much you're willing to sacrifice to keep it that way. Signal's authors may be more technically competent than a government security officer, but Signal can be coerced into releasing an update that surreptitiously changes the behavior of the application whereas well-protected NSA officers are (theoretically) more immune.
- tptacek 10y agoYeah, now work through how they do that without alerting their targets.
- a3n 10y agogmail isn't the only thing that govt services "compete" with. Clinton's self-"secured" email server, for example. In that case, we all would have been better off is she had used govt services, for security and for the "sunshine" effect.
- tptacek 10y agoNo, that's also almost certainly false, because at the time she was doing that, unbeknownst to her, the State Department email servers were completely owned up by Russian hackers. Clearly, I'd rather Clinton use GApps than run her own email server. But for security, her worst option was the official servers.
- a3n 10y agoWell put. But I don't remember "State servers owned by hackers" as part of the narrative. Is that "inside baseball," or was that reported? I'd think it would be part of the conversation on the Senate's possible investigations in that area now.
- tptacek 10y agoIt was heavily reported, and it's not unusual: IT security in the USG is a shit-show.