5 ms·

When do we get to blame the DNC for having horrible netsec practices in place? Podesta was 'hacked' with a phishing email? Are they absolved from all responsibi

When do we get to blame the DNC for having horrible netsec practices in place? Podesta was 'hacked' with a phishing email? Are they absolved from all responsibility for basic tech competency?

alphabettsy 8y ago
It get your point, but that’s similar to blaming someone that has their house broken into because they only had a standard knob with lock instead of a deadbolt. Sure they could’ve done better, but locks only slow down a determined intruder.
- squish78 8y ago
  Would you hold Equifax to that same standard?
  - flashgordon 8y ago
    Ah but I have absolutely no choice in Equifax getting their grubby fingers on my data (and then charging me for it). So Equifax should at the very least build itself like fort Knox!
krapp 8y ago
If I leave my front door open, sure, that's stupid, but it's still robbery if you come in and take my television.
- squish78 8y ago
  You would blame the criminal for you leaving your front door open?
  - krapp 8y ago
    No, I would blame the criminal for stealing my stuff despite the front door being left open.
AndrewDucker 8y ago
You can absolutely say they should have had better security, but that doesn't remove responsibility from the hackers.
meowface 8y ago
Just because the DNC are incompetent doesn't mean this isn't a really big deal. Also, most high-profile organization breaches start with phishing emails, exactly like the one sent to Podesta.
dredmorbius 8y ago
Podesta had a security and support team fronting his access. He got phished anyway.[1] Podesta was using Gmail, which has (or should have) its own world-class account security features. Numerous people, myself included, give Google no end of grief for their failures here. To their credit, Google have vastly enhanced their barn door locks now that the horses are freed. This includes identifying PEPs (politically exposed persons), and physical-token based security (Yubikey), but not additional-factor end-to-end encryption.[2] Phishing has been a known threat since the 1980s.[3] Google failed to defend against it desspite numerous previous attacks.[4] The GOP saw multiple accounts and entire emailsystems (SmarTech) compromised, leading to deep questions of compromise and exposure,though relatively little media coverage.[5] Additional successful attacks were made against politicians, political parties, voter registration data, election officials, and quite possibly voting machines and systems themselves.[6] The fact is that the US election and political system has been subject to massive, pervasive advanced persistent threat attacks consistent with state-level actor for years, with multiple independent systems on all sides failing. Your question and framing are exceedingly disingenuous. Sources: 1. https://www.nytimes.com/2016/12/13/us/politics/russia-hack-election-dnc.html https://www.nytimes.com/2016/12/13/us/politics/russia-hack-e... 2. https://gizmodo.com/google-employees-secret-to-never-getting-phished-is-usi-1827833717 https://gizmodo.com/google-employees-secret-to-never-getting... 3. Felix, Jerry & Hauck, Chris (September 1987). "System Security: A Hacker's Perspective". 1987 Interex Proceedings. 8:6. 4. https://www.theguardian.com/technology/2011/jun/01/google-hacking-chinese-attack-gmail https://www.theguardian.com/technology/2011/jun/01/google-ha... 5. https://www.nytimes.com/2017/01/10/us/politics/russia-hack-hearing-clapper-rogers-brennan.html https://www.nytimes.com/2017/01/10/us/politics/russia-hack-h... 6. https://www.nbcnews.com/news/us-news/russians-hacked-two-u-s-voter-databases-say-officials-n639551 https://www.nbcnews.com/news/us-news/russians-hacked-two-u-s... https://abcnews.go.com/US/russian-hackers-targeted-half-states-voter-registration-systems/story?id=42435822 https://abcnews.go.com/US/russian-hackers-targeted-half-stat...
happytoexplain 8y ago
Who is stopping "us"? As far as I can tell, we do get to place that blame, and many of us frequently do. I hear extremely few voices claiming the DNC was totally secure or had no responsibility to secure itself. The topic doesn't HAVE to be a combative battlefield where you are either allowed to blame one thing entirely or the other, depending on your political leanings.

When do we get to blame the DNC for having horrible netsec practices in place? Podesta was 'hacked' with a phishing email? Are they absolved from all responsibility for basic tech competency?

alphabettsy 8y ago

It get your point, but that’s similar to blaming someone that has their house broken into because they only had a standard knob with lock instead of a deadbolt. Sure they could’ve done better, but locks only slow down a determined intruder.

squish78 8y ago
Would you hold Equifax to that same standard?
- flashgordon 8y ago
  Ah but I have absolutely no choice in Equifax getting their grubby fingers on my data (and then charging me for it). So Equifax should at the very least build itself like fort Knox!

krapp 8y ago

If I leave my front door open, sure, that's stupid, but it's still robbery if you come in and take my television.

squish78 8y ago
You would blame the criminal for you leaving your front door open?
- krapp 8y ago
  No, I would blame the criminal for stealing my stuff despite the front door being left open.

AndrewDucker 8y ago

You can absolutely say they should have had better security, but that doesn't remove responsibility from the hackers.

meowface 8y ago

Just because the DNC are incompetent doesn't mean this isn't a really big deal. Also, most high-profile organization breaches start with phishing emails, exactly like the one sent to Podesta.

dredmorbius 8y ago

Podesta had a security and support team fronting his access. He got phished anyway.[1] Podesta was using Gmail, which has (or should have) its own world-class account security features. Numerous people, myself included, give Google no end of grief for their failures here. To their credit, Google have vastly enhanced their barn door locks now that the horses are freed. This includes identifying PEPs (politically exposed persons), and physical-token based security (Yubikey), but not additional-factor end-to-end encryption.[2] Phishing has been a known threat since the 1980s.[3] Google failed to defend against it desspite numerous previous attacks.[4] The GOP saw multiple accounts and entire emailsystems (SmarTech) compromised, leading to deep questions of compromise and exposure,though relatively little media coverage.[5] Additional successful attacks were made against politicians, political parties, voter registration data, election officials, and quite possibly voting machines and systems themselves.[6] The fact is that the US election and political system has been subject to massive, pervasive advanced persistent threat attacks consistent with state-level actor for years, with multiple independent systems on all sides failing. Your question and framing are exceedingly disingenuous. Sources: 1. https://www.nytimes.com/2016/12/13/us/politics/russia-hack-election-dnc.html https://www.nytimes.com/2016/12/13/us/politics/russia-hack-e... 2. https://gizmodo.com/google-employees-secret-to-never-getting-phished-is-usi-1827833717 https://gizmodo.com/google-employees-secret-to-never-getting... 3. Felix, Jerry & Hauck, Chris (September 1987). "System Security: A Hacker's Perspective". 1987 Interex Proceedings. 8:6. 4. https://www.theguardian.com/technology/2011/jun/01/google-hacking-chinese-attack-gmail https://www.theguardian.com/technology/2011/jun/01/google-ha... 5. https://www.nytimes.com/2017/01/10/us/politics/russia-hack-hearing-clapper-rogers-brennan.html https://www.nytimes.com/2017/01/10/us/politics/russia-hack-h... 6. https://www.nbcnews.com/news/us-news/russians-hacked-two-u-s-voter-databases-say-officials-n639551 https://www.nbcnews.com/news/us-news/russians-hacked-two-u-s... https://abcnews.go.com/US/russian-hackers-targeted-half-states-voter-registration-systems/story?id=42435822 https://abcnews.go.com/US/russian-hackers-targeted-half-stat...

happytoexplain 8y ago

Who is stopping "us"? As far as I can tell, we do get to place that blame, and many of us frequently do. I hear extremely few voices claiming the DNC was totally secure or had no responsibility to secure itself. The topic doesn't HAVE to be a combative battlefield where you are either allowed to blame one thing entirely or the other, depending on your political leanings.