7 ms·

This may sound a bit glib but the Democrats should just get a contract with Google, give all of their people GSuite accounts, and enroll them in the Advanced Pr

• matt4077 8y ago
  I seem to remember Podesta, whose email was leaked, was already using GMail, either because the campaign used it, or he was using a personal account. Activating 2-factor auth would probably have stopped the attack. It also bears repeating that the leaked emails contained nothing illegal or even immoral beyond a few peeks of how the sausage is made that were only outrageous for people looking for a reason to be outraged. This discussion sometimes gets dangerously close to victim blaming.
  • everdev 8y ago
    I wonder if the reaction to the hacking would have been different if dirt was found. A greater good argument might have prevailed even though it was a crime, like it the public generally has sympathy for Snowden. Breaking in and finding nothing just looks bad from top to bottom though for the hackers and those associated.
    • yourbandsucks 8y ago
      The greater good argument already prevailed with a big chunk of the country. Whether the dirt was real or outlandish made-up satanism allegations didn't wind up mattering. Turns out you can hack an inbox and claim it contained anything. People won't read. They just want their tribal allegiances confirmed.
  • swebs 8y ago
    https://en.wikipedia.org/wiki/Podesta_emails#Presidential_debate_questions_shared_by_Donna_Brazile https://en.wikipedia.org/wiki/Podesta_emails#Presidential_de...
• mushufasa 8y ago
  actually, they do all have gsuite! at least when i worked for them in 2016.
  • TheCoelacanth 8y ago
    Probably not the using the Advanced Protection Program, though. It would have made the accounts much harder to break into since you need a physical key to log in to the account.
  • idlewords 8y ago
    What we're trying to protect here is people's personal accounts. So even campaigns that use GSuite have people's personal stuff just on random Gmail (or Yahoo, or AOL...)
    • daveFNbuck 8y ago
      They're trying to protect work-related communications. These can be separated from personal accounts.
      • tptacek 8y ago
        I've been working on sensitive projects with trained professionals for 2 decades and have watched how hard it is for people to keep personal computing resources and professional ones separate. The idea that campaign staffers would be required to maintain a level of OPSEC that IT security people can't reliably maintain seems unrealistic and unproductive. I think people have a broken idea of what a congressional campaign actually is. It's not an enterprise with a security team. It's a bunch of random people working together for a year or so, and only for a few months full time, at that. That's what makes them targets. Whatever our industry does to protect campaigns needs to engage with the reality of what a campaign is, rather than pretending they're all credit scoring firms that should have known better than to not spend all of their $13,000,000 security budget this year.
        • daveFNbuck 8y ago
• heavymark 8y ago
  Curious why Google requires their users to use Chrome or Firefox but can't use Safari to access Google Services when enrolled in that program? "And you will only be able to use Chrome and Firefox to access your signed-in Google services like Gmail or Photos." I could see them just requiring Chrome but curious why they would block Safari over Firefox.
  • maxerickson 8y ago
    Safari doesn't support the hardware.
    • saagarjha 8y ago
      Uh, what?
      • maxerickson 8y ago
        The Advanced Protection program requires a U2F security key. Safari doesn't support it.
        • saagarjha 8y ago
          Thanks. Hopefully this will be solved when they adopt Web Authentication?
          • JetSpiegel 8y ago
            If Apple doesn't come up with an alternative iAuth NIH "standard".
            • saagarjha 8y ago
              https://webkit.org/status/#feature-web-authentication https://webkit.org/status/#feature-web-authentication
            • pcwalton 8y ago
• craftyguy 8y ago
  Since support for APP seems to be limited to specific browsers/hardware, why not at least do TFA with a one-time passcode app? That seems to be much more widely supported, and it considerably better than whatever they may/may not be doing today..
  • idlewords 8y ago
    That does not guard against the phishing scenario that is one of the biggest threats to campaigns. Any kind of two-factor auth short of a security key is inadequate against that threat.
    • craftyguy 8y ago
      > the phishing scenario that is one of the biggest threats to campaigns What phishing scenario, and how is TFA completely defeated by it? The article just says "the best defense against phishing is a 'security key'", but doesn't explain why other options like TFA are inadequate. I didn't say TFA would be the ultimate solution, but that it's likely to be supported by more things that people use (like apple devices..). If you choose a solution that might be technically superior but require people to make major workflow changes, you'll find they won't use it. TFA seems like a good compromise to me, so I'd really like to understand why you think it is not.
      • idlewords 8y ago
        If I show you an impostor website purporting to be Gmail, and get you to type in your password plus authenticator code / SMS code / app notification code, I can get into your email account. If I do the same and your second factor is a security key, I get a useless binary blob that I can't turn around and hand to Google. The U2F key gets the actual URL of the page you are on from the browser, so it can't be fooled by impostor websites, however clever. That's the difference, and the reason that Google moved their employees onto security keys. Too many people were getting phished otherwise.
        • craftyguy 8y ago
• idlewords 8y ago
  There are a couple of problems with this (and it's a good question!). One is that many campaigns are just small and don't have any in-house IT expertise, even the kind needed to run GSuite. Another is that GSuite doesn't protect people's personal accounts, which is the big risk here. APP is nice in theory, but I don't believe it's workable in practice for Congressional campaigns. The keys break too easily, and there is no fallback if they are lost or broken. We have one candidate trying out APP and I'll be eager to hear her feedback. But for the time being, just getting them onto 2FA with yubikeys maxes out people's mental budget for "security stuff".
  • rrdharan 8y ago
    You can opt in personal accounts to APP can't you? Or are you just saying it's not easy to enforce?
    • idlewords 8y ago
      I'm arguing that it's a nonstarter to hand campaign staff who had not heard of security keys at the start of the meeting an easily breakable dongle and say this is the only way to get in to your email now; don't lose it. They need fallbacks (like security codes or Google Authenticator).
      • godzillabrennus 8y ago
        Seems like the threshold for caring if a staffer loses email access was crossed when the DNC got hacked. Seems more reasonable to lose an account to a damaged key than to lose an election.
        • idlewords 8y ago
          Having your finance manager lose access to spreadsheets for four days is also not tenable. The trade-offs are complicated here.
      • solatic 8y ago
• Alex3917 8y ago
  APP is great if you're traveling abroad or if there is a specific threat you need to mitigate for a few weeks, but it's not really a viable longterm solution since it disables all of the third-party apps that candidates need to use for their campaigns. For the average candidate, they're going to improve their chances of winning much more by using a CRM than by forgoing its use on the off chance a state-sponsored attacker tries to steal their data from Intercom or HubSpot or whatever. When you're starting out with zero supporters and zero dollars and need to somehow connect with over 50% of voters within the span of a few months, it just isn't a super realistic trade off to make. Especially when you can enable almost all of the same security features piecemeal without it.
  • tptacek 8y ago
    Anecdotally: there are campaigns using APP, and it apparently hasn't been problematic in that regard.
    • Alex3917 8y ago
      Interesting. I wonder if they're just using browser extensions though to get the same functionality? Since if you have any browser plug-ins installed (e.g. AdBlock), you've got the same potential issue.
      • tptacek 8y ago
        Here I will defer to everyone else who knows more about APP than I do; that one tidbit I brought up was related to me by an HN-phobe who didn't want to say it themselves. :)
        • Alex3917 8y ago
          Yeah I don't know much about APP. As far as I know, no one does; there doesn't seem to be any information at all about what OAuth scopes (if any) are allowed. In general though I think we'd be better off with Google just adding more restrictive OAuth scopes and improving their logging functionality so that users can see how apps are using their data. I'm clearly biased since my app is built on Gmail OAuth, but I generally just think that for whatever issues OAuth has, pushing people toward browser extensions or IMAP is a step in the wrong direction.
• camgunz 8y ago
  No Democratic organization (DNC, DSCC, DCCC, OFA) really holds sway over campaigns. The DCCC would basically never say "hey, use these 2FA dongles or we're not sending money" to a competitive campaign, and they definitely can't do that over personal accounts ("hey ditch Yahoo! or we're not running any ads"). Maybe they should, it's debatable, but there's a lot of things we should do that are on the spectrum of "unimportant in the grand scheme of things" to "infeasible".
  • idlewords 8y ago
    Campaigns I have worked with are generally eager for this kind of training and would gladly accept it if it were offered. They are aware of the hacking threat and feel out of their depth. I think a good starting point is to simply offer in-person training at key points in the campaign (on filing, after a primary win, and before the general election).
    • camgunz 8y ago
      Super agree, this would be fantastic. I'm sure there are people at the DNC and elsewhere who would happy to advocate for the (very small amount of) funding it would take -- as you wrote it should be a top priority.
  • dillondoyle 8y ago
    The main DSCC and DCCC can and will force campaigns to use approved vendors and they could very easily enforce google apps. This only works where they provide $ or staff though as leverage. But generally I think carrot works better than stick
    • camgunz 8y ago
      Kind of and in some cases sure (most obvious is union printing), but if a campaign says "no", really all the DCCC can do is threaten to pull resources (which they wouldn't for a competitive campaign). Really this happens more as advice and political pressure. But also consider downticket races like secretary of state or state ag. Then you're talking state parties who have almost no power at all. So yeah I think carrot is definitely better than stick, but there basically is no stick. I do think the DCCC should set up gapps for every general campaign and provide it for free, and should probably also offer it to professional Democrats, also for free, but this is a larger tech infrastructure question that starts to include organizing tech, website tech, VAN, email tech, etc. I personally think we should provide all those things, but there are a lot of (vendor, of course) politics involved, it's not cheap, and things like 2FA are so far down the list you can't see them. Again I think we agree, I just think a lot of people think the party controls campaigns and that's largely not the case, and even when it is there are arguably more urgent issues (campaign finance law training, ex) that could benefit from any kind of standardization.