3 ms·

I work in digital D politics professionally. I can't tell you how many Congressman use multiple @yahoo or whatever personal email accounts, social, and wordpres

I work in digital D politics professionally. I can't tell you how many Congressman use multiple @yahoo or whatever personal email accounts, social, and wordpress accounts with very guessable and repeated passwords. Even the young 'savvy' ones. And I know this because the creds are shared in plain text with multiple people over email (like me) or put into a shared google doc. We enforce 2fa for our consultancy staff. I would love to enforce it for campaigns but I can guarantee endless problems and troubleshooting especially needy candidates calling because they can't figure out how to get their email. Another big problem is shitty wordpress sites filled with plugins. Literally I see $10k sites (FEC reports!) designed using a $100 paid drag and drop theme with even more plugins thrown on top. It's a big pet peeve of mine and when I can I move clients to a static plain html site hosted on s3 or similar. My big concern here is if you have write access to wordpress I could see a scenario where you could upload say verification-hash.html and then reclaim ownership of a domain or regain access to email. Or perhaps some turst attack domain.com/my-innocent-file-has-virus.file The main D voter file GUI (votebuilder) which all campaigns use to contact voters and work with voterfile data does have 2fa but it's still only SMS. This is my real name so I don't want to throw too much public shade, but let's just say when I have to work with campaign data stored in van first thing I do is export out. ActBlue which is increasingly the monopoly online fundraising app in my experience has good engineering and for me personally they are the only 'tech' provider for Dems that I jive with (don't get me started on NGPVAN or maybe do, but over PM). AB has 2fa token support, though they should make it mandatory given that if you have AB login access you can do a lot of damage (I've actually had this conversation with them about campaign provided js that shows up on donate pages, putting on separate cookie domain, iframe etc).

bsder 8y ago
> We enforce 2fa for our consultancy staff. What kind of 2FA and how are you doing it?
- dillondoyle 8y ago
  Google authenticator app
idlewords 8y ago
Thank you for this very informative comment! Who do you think should have overall responsibility for campaign security in 2020? The parties? DHS? Some kind of private sector consortium?
- dillondoyle 8y ago
  I mean the government doesn't take on basic IT security responsibilities for corporations. It's up to each campaign. The parties can provide support but there are so many races up and down ballot, plus primaries it's impossible. Plus why should the DCCC or whoever waste resources on some non-winnable tiny race. If say DHS did get involved proactively there would be huge trust and legal issues; any top down direction from govt to politics would be perceived as interfering with political speech/democracy.
  - donaltroddyn 8y ago
    The US government does mandate numerous IT security measures for companies involved in military/defence-related projects, justified by national security concerns. The same argument could be made for regulating private organisations involved in national elections.
  - 394549 8y ago
    > I mean the government doesn't take on basic IT security responsibilities for corporations. It's up to each campaign. Couldn't the DHS provide recommendations (e.g. practices, particular providers and configurations), and the parties provide turnkey solutions to their candidates and elected officials? It seems foolish to leave such decisions up to such small, short-term groups that shouldn't be expected to have the IT expertise to pick a good vendor.
  - rossdavidh 8y ago
    I'm a little conflicted on this. Clearly if we leave security to political parties, for many reasons we can expect poor security in IT, which leaves our very democracy vulnerable. On the other hand, imagine the government mandating "if you run for office, you and everyone in your campaign must use this email for all communications, and if you communicate electronically outside of these approved methods we'll come down on you". The number of ways that could be misused is mind-boggling. Even if it isn't used to sniff on the communications of the opposition, it could simply be raised to higher and higher levels of complexity (and perhaps $$ cost) until new political parties (or insurgencies within a party) cannot afford to compete, because the legal requirements for IT are too stringent.

bsder 8y ago

> We enforce 2fa for our consultancy staff. What kind of 2FA and how are you doing it?

dillondoyle 8y ago
Google authenticator app

idlewords 8y ago

Thank you for this very informative comment! Who do you think should have overall responsibility for campaign security in 2020? The parties? DHS? Some kind of private sector consortium?

dillondoyle 8y ago
I mean the government doesn't take on basic IT security responsibilities for corporations. It's up to each campaign. The parties can provide support but there are so many races up and down ballot, plus primaries it's impossible. Plus why should the DCCC or whoever waste resources on some non-winnable tiny race. If say DHS did get involved proactively there would be huge trust and legal issues; any top down direction from govt to politics would be perceived as interfering with political speech/democracy.
- donaltroddyn 8y ago
  The US government does mandate numerous IT security measures for companies involved in military/defence-related projects, justified by national security concerns. The same argument could be made for regulating private organisations involved in national elections.
- 394549 8y ago
  > I mean the government doesn't take on basic IT security responsibilities for corporations. It's up to each campaign. Couldn't the DHS provide recommendations (e.g. practices, particular providers and configurations), and the parties provide turnkey solutions to their candidates and elected officials? It seems foolish to leave such decisions up to such small, short-term groups that shouldn't be expected to have the IT expertise to pick a good vendor.
- rossdavidh 8y ago
  I'm a little conflicted on this. Clearly if we leave security to political parties, for many reasons we can expect poor security in IT, which leaves our very democracy vulnerable. On the other hand, imagine the government mandating "if you run for office, you and everyone in your campaign must use this email for all communications, and if you communicate electronically outside of these approved methods we'll come down on you". The number of ways that could be misused is mind-boggling. Even if it isn't used to sniff on the communications of the opposition, it could simply be raised to higher and higher levels of complexity (and perhaps $$ cost) until new political parties (or insurgencies within a party) cannot afford to compete, because the legal requirements for IT are too stringent.