6 ms·

Hawaii missile alert standdown delayed by forgotten log-in

77 points by whyleyc 9y ago

taneq 9y ago
Damned if you do write the password on a post-it note, damned if you don't.
- i_feel_great 9y ago
  No need to write "password123" down
  - mikeash 9y ago
    That’s not very secure. Instead, use “password124”.
- pc86 9y ago
  Not damned if you just remember the goddamn password OR use a password manager.
  - t3f 9y ago
    At least it wasn't due to a Expired SAML Certificate?
  - beat 9y ago
    Use a password manager. I'd prefer that critical government social media accounts not use passwords that a human being can realistically remember.
- bluehatbrit 9y ago
  I'm a fan of Nadine Dorries's approach of just telling everyone and the interns your password. Crowd sourced memory, right? - source http://www.bbc.co.uk/news/uk-politics-42216622 http://www.bbc.co.uk/news/uk-politics-42216622
  - oneeyedpigeon 9y ago
    As a UK citizen, I was furious about that at the time. I can't understand how that's not illegal, for someone in her position.
- mtgx 9y ago
  You say that as if those are the only two options. How about using a sandboxed browser with a password manager that auto-completes the credentials and a Yubikey for 2FA? Of course this is only to make it as "easy" as possible for them, considering they'd be moving up from post-it note passwords. But it wouldn't be ideal either in terms of security.
- williamscales 9y ago
  Write it on a post-it note and put it in your wallet. If you lose your wallet you probably have some work to do anyway to cancel cards. Just change your password first.
Waterluvian 9y ago
I'm not sure what the other duties of this team are, so this is more of a generic thought, not specific to the Hawaii alert bungle. Maybe it's important not to let any career exist that exercises its capabilities so infrequently. For example, firefighters train for massive disasters that rarely occur, but they more regularly fight smaller fires, and even more regularly respond to other problems like traffic accidents. So they are deployed on a very regular basis. Contrast that with the Minuteman missile teams who, I hope, have never ever fulfilled their role in actuality. Does this make them less effective? Also makes me think about military efficacy. You can either go to war a lot, or find other ways to practice your skills. Which is why disaster response seems like such a natural fit for military.
- fredley 9y ago
  I read an article recently about how we know what we know about history. The big takeaway for me was that most of what we know about ancient times, we know because the information was repeated. Ancient texts were copied by scholars and monks over and over again. Even when the originals were destroyed or decayed, we retained some of the copies. This turns out to be a common pattern with almost anything in the sum of human knowledge. We only know what is newly discovered, or what is rediscovered (repeated). In the digital sphere we have the same issue. There is a whole heap of data out there, but much of it is under threat of being lost, because it only exists on a hard drive we have lost the technology to read, unless we rebuild it (but we've also forgotten how to do that). If the platters decay without that data being copied, it's lost forever. Just as the military knows, with its constant drilling, the same is true of human behaviours too. Repetition is the key to everything we know, and everything we do. Knowledge and behaviours that aren't repeated will be lost.
swarnie_ 9y ago
Wasn't it stuck to the monitor with a post-it note?
- mtgx 9y ago
  That was just the password. Maybe they forgot the username, too.
- fredley 9y ago
  Presumably after they'd discovered it, they took this measure to prevent a repeat of the same situation.
albertgoeswoof 9y ago
> Forgotten Twitter log-in details have been blamed for delaying a public correction to Hawaii's missile alert earlier this month. Kind of floored that twitter is what the government has to use to put a notification out to it's public to provide critical information. But then I continued to read and the article goes on to say that twitter and other social media was used by the Governor after the emergency text message was sent out, which means it obviously isn't a primary source of information. So actually it's just clickbait journalism. Anyone panicking in the area would have almost certainly picked up a text before getting anything over twitter. What is pretty terrible is that the governor of Hawaii most likely doesn't have 2FA on his twitter account and keeps the password on his phone, probably in a notes app of some kind, and is willing to publicly admit that.
- ian0 9y ago
  Actually I learned today that its maybe not a bad idea to broadcast public announcements through alternate channels like twitter. There was a quake here in Jakarta and the resulting hug of death took the governments site offline briefly - but their twitter account was fine. It worked as a great CDN! Semi-related - when everyone evacuated their office blocks and stood on the road it flooded the cell towers making internet browsing impossible. But whatsapp continued to connect intermittently making it relatively fine to use. Not saying these types of channels should be used in place of the actual emergency protocols in the phone network. But no harm broadcasting if you can keep them secure.
- TeMPOraL 9y ago
  In emergency situations, if social media platforms work better than "official channels" (and they do), I'd prefer the government to use them.
  - craftyguy 9y ago
    I don't. Having to agree to yet more 'privacy' policies and succumb to tracking and other rights violations by the big social media platforms just to be able to recieve important messages from our government is, well, extremely stupid. The government must have a reliable way to do this. They don't, so they are trying to take the 'easy way', and that's a failure on their part.
mxuribe 9y ago
Hmm, i just assumed that all executives - even in government - have their public-facing accounts managed by their communications/public relations team. Maybe this is one of those rare times that it would have been good to have a team of people have access to the account? ;-)
zaroth 9y ago
It’s perfectly rational, efficient and good policy to use social media to reach people in an emergency. Twitter has spent billions to deploy a worldwide network that people engage with to communicate short status updates. They also have the content, and scale to have a large percentage of the population actually familiar with how to use their tool. To get an equivalent reach and scale and level of familiarity with a government run tool would be a $100 billion project doomed to fail. Should Twitter be the only way that government reaches the population to deliver critical updates? Of course not, but it absolutely must be one of the primary ways, and in many cases because the system design of Twitter is so much better, it will be the channel with the most accurate and up-to-date data. I mean the best part of that is then Homeland can designate Twitter as “critical national infrastructure” and put their agents in the data centers! </s>
- harlanji 9y ago
  I'm so glad you put that </s> at the end. I definitely see them jumping to make those inroads. It's not hard to self operate this stuff now that distributed computing is cheaper (eg. $50 raspi 2018 = 10+ $2000 boxes 1998). How was Google built, lots of commodity hardware you say? Why can't a neighborhood watch-like group operate a p2p network of RasPis located in homes of volunteers, using enough replication and a signing policy with YubiKeys or something, and operating guides and maintenance kits? Self-promotion, I started working on something like this in Nov. This morning I awoke to a map of my block covered in blue saying a warning had started 20 minutes ago, in a Facebook post from a foodie. I like to think those friendly warning sirens that blare at noon would tell me something, to begin with. Then those loud alerts that go to my phone no matter how many times I disable the setting. Then maybe text blast, granted I don't know all the ones I should be on. I just had a needless bpm added to my heart rate. All notifications are disabled on my mobile except calls; much as people depend on them I won't let myself. Two days of disaster and everyone's battery is dead, along with ability to search the web for life skills and claim to have invented fire. Tangent, but for the doubters, I inspect routes before I drive and know my way around blind after just a few thousand miles in the city over 4 years (typical commuter is 10k/yr+). And literally nobody of consequence has complained about responding to things a few times per day in batches (around lunch, late afternoon/5). People think I'm too intense, actually I think they're just addicts with no attention span. So one can see why I don't want to turn on Notifs for an advertising network in case there's something urgent. Oh hey, false alarm, buy some stuff and surrender some power... [just click here :D]
orliesaurus 9y ago
Nothing wrong with using twitter to spread important news around faster. But this article is as click bait as it gets honestly.. Next article on this subject will be titled something: Hawaii social media person delayed by additional 3 minutes because had to use the restroom during crisis
sixothree 9y ago
That's funny, I don't know my twitter password either. Nor do I know my facebook password, or most of my other passwords. edit: I guess my point is that the word is not getting out about good password practices.
- mikejmoffitt 9y ago
  Maybe it's snooty holier-than-thou posts by users of password managers, lacking in substance or any real argument, that lets the majority of password users remain unconvinced.
  - perl4ever 9y ago
    Password managers make me nervous for two reasons: (1) if someone breaches the password manager, they have all your passwords, rather than one, and (2) you have to trust the source of the password manager that it doesn't have an intentional backdoor - even if it was trustworthy, every update is the potential for a new problem. Also, in my experience, you're not allowed to use one at work, so what do you think people do?

77 points by whyleyc 9y ago

taneq 9y ago

Damned if you do write the password on a post-it note, damned if you don't.

i_feel_great 9y ago
No need to write "password123" down
- mikeash 9y ago
  That’s not very secure. Instead, use “password124”.
pc86 9y ago
Not damned if you just remember the goddamn password OR use a password manager.
- t3f 9y ago
  At least it wasn't due to a Expired SAML Certificate?
- beat 9y ago
  Use a password manager. I'd prefer that critical government social media accounts not use passwords that a human being can realistically remember.
bluehatbrit 9y ago
I'm a fan of Nadine Dorries's approach of just telling everyone and the interns your password. Crowd sourced memory, right? - source http://www.bbc.co.uk/news/uk-politics-42216622 http://www.bbc.co.uk/news/uk-politics-42216622
- oneeyedpigeon 9y ago
  As a UK citizen, I was furious about that at the time. I can't understand how that's not illegal, for someone in her position.
mtgx 9y ago
You say that as if those are the only two options. How about using a sandboxed browser with a password manager that auto-completes the credentials and a Yubikey for 2FA? Of course this is only to make it as "easy" as possible for them, considering they'd be moving up from post-it note passwords. But it wouldn't be ideal either in terms of security.
williamscales 9y ago
Write it on a post-it note and put it in your wallet. If you lose your wallet you probably have some work to do anyway to cancel cards. Just change your password first.

Waterluvian 9y ago

I'm not sure what the other duties of this team are, so this is more of a generic thought, not specific to the Hawaii alert bungle. Maybe it's important not to let any career exist that exercises its capabilities so infrequently. For example, firefighters train for massive disasters that rarely occur, but they more regularly fight smaller fires, and even more regularly respond to other problems like traffic accidents. So they are deployed on a very regular basis. Contrast that with the Minuteman missile teams who, I hope, have never ever fulfilled their role in actuality. Does this make them less effective? Also makes me think about military efficacy. You can either go to war a lot, or find other ways to practice your skills. Which is why disaster response seems like such a natural fit for military.

fredley 9y ago
I read an article recently about how we know what we know about history. The big takeaway for me was that most of what we know about ancient times, we know because the information was repeated. Ancient texts were copied by scholars and monks over and over again. Even when the originals were destroyed or decayed, we retained some of the copies. This turns out to be a common pattern with almost anything in the sum of human knowledge. We only know what is newly discovered, or what is rediscovered (repeated). In the digital sphere we have the same issue. There is a whole heap of data out there, but much of it is under threat of being lost, because it only exists on a hard drive we have lost the technology to read, unless we rebuild it (but we've also forgotten how to do that). If the platters decay without that data being copied, it's lost forever. Just as the military knows, with its constant drilling, the same is true of human behaviours too. Repetition is the key to everything we know, and everything we do. Knowledge and behaviours that aren't repeated will be lost.

swarnie_ 9y ago

Wasn't it stuck to the monitor with a post-it note?

mtgx 9y ago
That was just the password. Maybe they forgot the username, too.
fredley 9y ago
Presumably after they'd discovered it, they took this measure to prevent a repeat of the same situation.

albertgoeswoof 9y ago

> Forgotten Twitter log-in details have been blamed for delaying a public correction to Hawaii's missile alert earlier this month. Kind of floored that twitter is what the government has to use to put a notification out to it's public to provide critical information. But then I continued to read and the article goes on to say that twitter and other social media was used by the Governor after the emergency text message was sent out, which means it obviously isn't a primary source of information. So actually it's just clickbait journalism. Anyone panicking in the area would have almost certainly picked up a text before getting anything over twitter. What is pretty terrible is that the governor of Hawaii most likely doesn't have 2FA on his twitter account and keeps the password on his phone, probably in a notes app of some kind, and is willing to publicly admit that.

ian0 9y ago
Actually I learned today that its maybe not a bad idea to broadcast public announcements through alternate channels like twitter. There was a quake here in Jakarta and the resulting hug of death took the governments site offline briefly - but their twitter account was fine. It worked as a great CDN! Semi-related - when everyone evacuated their office blocks and stood on the road it flooded the cell towers making internet browsing impossible. But whatsapp continued to connect intermittently making it relatively fine to use. Not saying these types of channels should be used in place of the actual emergency protocols in the phone network. But no harm broadcasting if you can keep them secure.
TeMPOraL 9y ago
In emergency situations, if social media platforms work better than "official channels" (and they do), I'd prefer the government to use them.
- craftyguy 9y ago
  I don't. Having to agree to yet more 'privacy' policies and succumb to tracking and other rights violations by the big social media platforms just to be able to recieve important messages from our government is, well, extremely stupid. The government must have a reliable way to do this. They don't, so they are trying to take the 'easy way', and that's a failure on their part.

mxuribe 9y ago

Hmm, i just assumed that all executives - even in government - have their public-facing accounts managed by their communications/public relations team. Maybe this is one of those rare times that it would have been good to have a team of people have access to the account? ;-)

zaroth 9y ago

It’s perfectly rational, efficient and good policy to use social media to reach people in an emergency. Twitter has spent billions to deploy a worldwide network that people engage with to communicate short status updates. They also have the content, and scale to have a large percentage of the population actually familiar with how to use their tool. To get an equivalent reach and scale and level of familiarity with a government run tool would be a $100 billion project doomed to fail. Should Twitter be the only way that government reaches the population to deliver critical updates? Of course not, but it absolutely must be one of the primary ways, and in many cases because the system design of Twitter is so much better, it will be the channel with the most accurate and up-to-date data. I mean the best part of that is then Homeland can designate Twitter as “critical national infrastructure” and put their agents in the data centers! </s>

harlanji 9y ago
I'm so glad you put that </s> at the end. I definitely see them jumping to make those inroads. It's not hard to self operate this stuff now that distributed computing is cheaper (eg. $50 raspi 2018 = 10+ $2000 boxes 1998). How was Google built, lots of commodity hardware you say? Why can't a neighborhood watch-like group operate a p2p network of RasPis located in homes of volunteers, using enough replication and a signing policy with YubiKeys or something, and operating guides and maintenance kits? Self-promotion, I started working on something like this in Nov. This morning I awoke to a map of my block covered in blue saying a warning had started 20 minutes ago, in a Facebook post from a foodie. I like to think those friendly warning sirens that blare at noon would tell me something, to begin with. Then those loud alerts that go to my phone no matter how many times I disable the setting. Then maybe text blast, granted I don't know all the ones I should be on. I just had a needless bpm added to my heart rate. All notifications are disabled on my mobile except calls; much as people depend on them I won't let myself. Two days of disaster and everyone's battery is dead, along with ability to search the web for life skills and claim to have invented fire. Tangent, but for the doubters, I inspect routes before I drive and know my way around blind after just a few thousand miles in the city over 4 years (typical commuter is 10k/yr+). And literally nobody of consequence has complained about responding to things a few times per day in batches (around lunch, late afternoon/5). People think I'm too intense, actually I think they're just addicts with no attention span. So one can see why I don't want to turn on Notifs for an advertising network in case there's something urgent. Oh hey, false alarm, buy some stuff and surrender some power... [just click here :D]

orliesaurus 9y ago

Nothing wrong with using twitter to spread important news around faster. But this article is as click bait as it gets honestly.. Next article on this subject will be titled something: Hawaii social media person delayed by additional 3 minutes because had to use the restroom during crisis

sixothree 9y ago

That's funny, I don't know my twitter password either. Nor do I know my facebook password, or most of my other passwords. edit: I guess my point is that the word is not getting out about good password practices.

mikejmoffitt 9y ago
Maybe it's snooty holier-than-thou posts by users of password managers, lacking in substance or any real argument, that lets the majority of password users remain unconvinced.
- perl4ever 9y ago
  Password managers make me nervous for two reasons: (1) if someone breaches the password manager, they have all your passwords, rather than one, and (2) you have to trust the source of the password manager that it doesn't have an intentional backdoor - even if it was trustworthy, every update is the potential for a new problem. Also, in my experience, you're not allowed to use one at work, so what do you think people do?