5 ms·

Looking at the screenshots, there is no evidence of government business there. She's bitching a bit about Dan Fagan (a repub. commentator in AK) in the one ema

Looking at the screenshots, there is no evidence of government business there. She's bitching a bit about Dan Fagan (a repub. commentator in AK) in the one email, but everything looks pretty personal. I have a work and personal account... 99% of the time I manage to keep my personal account personal-- occasionally I don't. I'd be stunned if there weren't occasional transgressions on this front in any governor's office. I'd expect that security tightens up a bit in the Executive branch. (disclaimers: I lived in Alaska until 2 years ago and know how utterly wrong the national media is about what goes on up there. I am not a republican, but don't really consider myself a democrat, either.)

tptacek 18y ago
I'm not going to repost stuff from Wikilinks here, but it looks like you're not correct: there's a transcript of the screenshots that includes things like, "CONFIDENTIAL ETHICS INVESTIGATION" and "REQUEST FOR DOCUMENTS". In addition to being a fuckup of spectacular proportions, it also corroborates an earlier news report of leaked emails that included specific instructions not to send sensitive government mails to Palin's work account. Of course, none of this has been authenticated. It looks credible, but there's plenty of incentive to make something look credible in this political and news climate. The interesting story here is the trend story. It applies to companies as well as government officials. People will attempt to use personal email accounts to avoid subpoenas. But nobody knows enough to keep those accounts secure, and the growing insecurity of the web guarantees most hosted mail accounts will eventually get popped. Meanwhile, it's hard for executives and officials to find "secure" mail providers without tacitly confirming that they're conducting business in secret. It's an interesting problem. [Late edit: Time: it's probably real.]
- webwright 18y ago
  Ah, I'd just looked at the screenshots, not the text "log". Interesting that they'd screenshot all of the subjects that are totally personal/innocuous but the text log has all of the potentially damning subjects... Hrm. Why wouldn't you just scroll down and take a few screenies to prove the evil? I've worked on the technology side of a few candidates and politicians-- they are almost without fail moronic about technology. I can imagine accidental sends to Palin's personal account. For all we know, the content of those emails are "You dumbass. How many times do I have to tell you that stuff like this should go to my work account?!", right? I agree that the trend is interesting, tho.
  - tptacek 18y ago
    (a) Because the people who pulled off the attack are stupid. (b) Because the people who pulled off the attack somehow lost access after getting the account but before archiving all the mail, and so made up the good stuff. (c) Because the people who pulled off the attack are very smart, and are going to slow-drip this out to the media over the next month. I know where my bet's at now.
    - hugh 18y ago
      If the people who pulled off this attack are very smart, then they'll be shutting up about it. The US Secret Service has a lot of resources and a pretty limited mission statement. It's not a good idea to attract their attention.
      - tptacek 18y ago
        Give me a break. There are very few organizations less well equipped to respond to computer attacks than US law enforcement. It takes years to convict on computer crime cases, and almost every one of them is front page news in the trade press. You know how many we've had in the past decade? Trivia question: which law enforcement agency was primarily responsible for responding to computer incidents throughout the 80s and 90s?
        tptacek 18y ago
        (Of course, it's always possible that the person who did this was stunningly dumb about it.)
    - rms 18y ago
      I'd go with a combination of (a) and (b) Seems like it was 4chan/Anonymous, unless it started in a super elite IRC channel and was slowly leaked to 4chan.
      - tptacek 18y ago
        You underestimate the cleverness and persistence of a large group of bored internet trolls at your own peril. I am not kidding. Either that, or you've drastically overestimated the security of the Internet at large.
- hugh 18y ago
  Startup idea: ultra-secure webmail (accessed via one of those little physical key-generating token thingies). None of this "I've forgotten my password but here's my mother's maiden name" crap.
  - tptacek 18y ago
    A startup that does no-frills, genuinely secure mail on hardened servers might in fact do pretty well. I've wanted one a lot lately. It's not an easy problem though; you're going to deliberately sacrifice features for security, a tradeoff most customers won't get. It won't solve this problem though; funnelling mail through Yahoo comes with plausible deniability. Funneling it through the email security vault, not so much.
    - quasimojo 18y ago
      doesn't change the vector of this attack one bit: weak password
      - tptacek 18y ago
        Weak password wasn't the vector. Weak password reset feature was.
      - hugh 18y ago
        Yes it does change that vector. I'm talking about the physical tokens which generate a new key every 30 seconds, like: http://www.rsa.com/node.aspx?id=1156 http://www.rsa.com/node.aspx?id=1156 This way you need to know the password _and_ have the physical token in your hand to know the current key. On the downside, it's also a hassle to carry it around and use it (I have a couple of 'em for access to various supercomputers), so I wouldn't bother doing it for my own email, but if you're a public figure or otherwise sufficiently paranoid it might be worthwhile.
    - rbanffy 18y ago
      For just a couple bucks a month you buy a virtual server you can install your IMAP server and do VPN or SSL (or both, just in case).
- hugh 18y ago
  I'm not sure whether "Request for documents" and "Confidential ethics investigation" are really there, but even if they are, they may still be personal email. "Request for documents" could be any kind of request for documents. Maybe it's the McCain campaign doing some vetting. Maybe it's some journalist requesting a copy of Trig's birth certificate. I actually think it's unlikely to be official business -- if you need documents from the governor's office you probably request them from a low-level official, not from the governor herself. "Confidential: ethics investigation" could be personal too -- if she's under investigation and has hired a lawyer, for instance, then communications with that lawyer should be protected under client/lawyer privilege and shouldn't be a matter of public record. I"m not sure exactly where the dividing line is between personal and official email for government officials -- I expect it's blurry, having been defined in a law somewhere but never tested in court.

tptacek 18y ago

I'm not going to repost stuff from Wikilinks here, but it looks like you're not correct: there's a transcript of the screenshots that includes things like, "CONFIDENTIAL ETHICS INVESTIGATION" and "REQUEST FOR DOCUMENTS". In addition to being a fuckup of spectacular proportions, it also corroborates an earlier news report of leaked emails that included specific instructions not to send sensitive government mails to Palin's work account. Of course, none of this has been authenticated. It looks credible, but there's plenty of incentive to make something look credible in this political and news climate. The interesting story here is the trend story. It applies to companies as well as government officials. People will attempt to use personal email accounts to avoid subpoenas. But nobody knows enough to keep those accounts secure, and the growing insecurity of the web guarantees most hosted mail accounts will eventually get popped. Meanwhile, it's hard for executives and officials to find "secure" mail providers without tacitly confirming that they're conducting business in secret. It's an interesting problem. [Late edit: Time: it's probably real.]

webwright 18y ago
Ah, I'd just looked at the screenshots, not the text "log". Interesting that they'd screenshot all of the subjects that are totally personal/innocuous but the text log has all of the potentially damning subjects... Hrm. Why wouldn't you just scroll down and take a few screenies to prove the evil? I've worked on the technology side of a few candidates and politicians-- they are almost without fail moronic about technology. I can imagine accidental sends to Palin's personal account. For all we know, the content of those emails are "You dumbass. How many times do I have to tell you that stuff like this should go to my work account?!", right? I agree that the trend is interesting, tho.
- tptacek 18y ago
  (a) Because the people who pulled off the attack are stupid. (b) Because the people who pulled off the attack somehow lost access after getting the account but before archiving all the mail, and so made up the good stuff. (c) Because the people who pulled off the attack are very smart, and are going to slow-drip this out to the media over the next month. I know where my bet's at now.
  - hugh 18y ago
    If the people who pulled off this attack are very smart, then they'll be shutting up about it. The US Secret Service has a lot of resources and a pretty limited mission statement. It's not a good idea to attract their attention.
    - tptacek 18y ago
      Give me a break. There are very few organizations less well equipped to respond to computer attacks than US law enforcement. It takes years to convict on computer crime cases, and almost every one of them is front page news in the trade press. You know how many we've had in the past decade? Trivia question: which law enforcement agency was primarily responsible for responding to computer incidents throughout the 80s and 90s?
      - tptacek 18y ago
        (Of course, it's always possible that the person who did this was stunningly dumb about it.)
  - rms 18y ago
    I'd go with a combination of (a) and (b) Seems like it was 4chan/Anonymous, unless it started in a super elite IRC channel and was slowly leaked to 4chan.
    - tptacek 18y ago
      You underestimate the cleverness and persistence of a large group of bored internet trolls at your own peril. I am not kidding. Either that, or you've drastically overestimated the security of the Internet at large.
hugh 18y ago
Startup idea: ultra-secure webmail (accessed via one of those little physical key-generating token thingies). None of this "I've forgotten my password but here's my mother's maiden name" crap.
- tptacek 18y ago
  A startup that does no-frills, genuinely secure mail on hardened servers might in fact do pretty well. I've wanted one a lot lately. It's not an easy problem though; you're going to deliberately sacrifice features for security, a tradeoff most customers won't get. It won't solve this problem though; funnelling mail through Yahoo comes with plausible deniability. Funneling it through the email security vault, not so much.
  - quasimojo 18y ago
    doesn't change the vector of this attack one bit: weak password
    - tptacek 18y ago
      Weak password wasn't the vector. Weak password reset feature was.
    - hugh 18y ago
      Yes it does change that vector. I'm talking about the physical tokens which generate a new key every 30 seconds, like: http://www.rsa.com/node.aspx?id=1156 http://www.rsa.com/node.aspx?id=1156 This way you need to know the password _and_ have the physical token in your hand to know the current key. On the downside, it's also a hassle to carry it around and use it (I have a couple of 'em for access to various supercomputers), so I wouldn't bother doing it for my own email, but if you're a public figure or otherwise sufficiently paranoid it might be worthwhile.
  - rbanffy 18y ago
    For just a couple bucks a month you buy a virtual server you can install your IMAP server and do VPN or SSL (or both, just in case).
hugh 18y ago
I'm not sure whether "Request for documents" and "Confidential ethics investigation" are really there, but even if they are, they may still be personal email. "Request for documents" could be any kind of request for documents. Maybe it's the McCain campaign doing some vetting. Maybe it's some journalist requesting a copy of Trig's birth certificate. I actually think it's unlikely to be official business -- if you need documents from the governor's office you probably request them from a low-level official, not from the governor herself. "Confidential: ethics investigation" could be personal too -- if she's under investigation and has hired a lawyer, for instance, then communications with that lawyer should be protected under client/lawyer privilege and shouldn't be a matter of public record. I"m not sure exactly where the dividing line is between personal and official email for government officials -- I expect it's blurry, having been defined in a law somewhere but never tested in court.