4 ms·

Was the server actually at her house or was the domain name just registered with that as an address? Neither option seems even slightly damning.

damoncali 12y ago
I interpreted it as "she's using Google Apps on her own domain, which has a registered address of her house". But it's not exactly clear.
o0-0o 12y ago
Who Is Eric Hoteham? Clinton's private server was registered under his name. Is he real?
joelrunyon 12y ago
I think the bigger issue is that she's skirting rules that the rest of gov't has to follow. Similar to the trend of government setting rules for everyone that they conveniently exempt themselves from.
- davesque 12y ago
  Not necessarily. A much more important issue to me is the fact that top-ranking government officials are using e-mail for official business at all. If there's any reason to be concerned that Clinton was using an insecure account for official e-mails, that implies that other government officials use e-mail to communicate sensitive information. Since e-mail is inherently insecure (unless you're using GPG or PGP or some other kind of message level encryption, which they're probably not), this is the real problem here.
  - Retric 12y ago
    Having worked with / for the US government, encryption and signing email is actually fairly common. For the most part people use a 2+ factor authentication and their smart cards have private keys. EX: http://www.cac.mil/common-access-card/ http://www.cac.mil/common-access-card/ After it's set up Outlook then let's people encrypt with a simple click. The recipient then needs their card + PIN to decrypt. PS: This is one of those cases where the US Government seems to be significantly ahead of the private sector in terms of actual adoption and use.
    - davesque 12y ago
      Thanks for the info. But I'm a bit confused. If government officials have the ability to easily encrypt their messages asymmetrically, AND they're supposed to store all of their messages in some kind of database, that sort of defeats the purpose of the encryption in the first place. Also, having a central store of all that information seems really risky and inherently less secure than a message encrypted asymmetrically. And, for that matter, if they are supposed to encrypt messages with a private key, that means they're not using asymmetric encryption for private communication. I'm not a security expert, but that seems like a bad move.
      - Retric 12y ago
        It's not just about encription it's also a question of varification that the email came from the person that it seems to. That's where the senders smart card comes into play they sign the email and need it to get the recepents public key. Also, the government wants a back door. So, they keep a copy of the private key's and assign them to an employee. The goal is to prevent interception and or data breeches on a lost laptop, not to hide the information from everyone. The same backdoor exits with full disk encryption so internal IT can help users who forgot their password etc.
  - maratd 12y ago
    What would you have them use? Carrier pigeons? E-Mail is universal in both business and government. Using TLS, it is sufficiently secure for most communications. For the rest, I'm sure the CIA and NSA know how to use PGP.
    - davesque 12y ago
      Why the sarcasm? And yes, TLS will securely transmit your message securely from your client (whether it's Outlook or a web browser) to your e-mail server. But you don't have any guarantee that the various relays which transport your message will use TLS.
      - maratd 12y ago
        You do if the email is only going to be on the local network. Most email is sent within the organization. It might not even need to leave the email server. My point is that TLS is good enough for most scenarios.
  - billpg 12y ago
    It is possible that all .gov-to-.gov emails go over a VPN linking all their mail servers together. Having government business conducted on a mail server not on this hypothetical VPN would be a security risk.
tedunangst 12y ago
Almost certainly the domain registration. > Hoteham was listed as the customer at Clinton's $1.7 million home on Old House Lane in Chappaqua in records registering the Internet address for her email server since August 2010. Does that sound like the information you get from running whois on an IP address or on a domain name? > Clinton's private email server was reconfigured again to use a Denver-based commercial email provider, MX Logic How the fuck would anybody know how her private server was reconfigured unless they're talking about mx records?
- nissimk 12y ago
  It's just poor reporting. I think they're misunderstanding their sources. I agree with you that the source is DNS, and they mean, "her email domain" was reconfigured, rather than her server.
- smutticus 12y ago
  > In November 2012, without explanation, Clinton's private email account was reconfigured to use Google's servers as a backup in case her own personal email server failed, according to Internet records. I took "Internet Records" to mean MX record for her domain. I'm assuming there are people keeping track of DNS changes publicly that one can view somewhere. Someone will probably respond to this post with a link.
mayneack 12y ago
The damning part is that her emails weren't stored in State Department records.
antr 12y ago
From my understanding in the Politico article[1], it appears the server was at the Clinton residence: "And since the Secret Service was guarding Clinton’s home, an email server there would have been well protected from theft or a physical hacking." [1] http://www.politico.com/story/2015/03/hillary-clinton-email-server-homebrew-115745.html http://www.politico.com/story/2015/03/hillary-clinton-email-...
- maxerickson 12y ago
  That's a slap up based on the same thin information as all the rest of the reporting. more: The press comments about the location of the server sure do sound a lot more like misunderstanding than they do careful research.
  - antr 12y ago
    You might be right. The other thing that doesn't sound right is how the server runs MX Logic, which is an email service/server run by McAfee. So there is a total misunderstanding by the press of how domains/dns/servers/email services work.
    - maxerickson 12y ago
      This guy is studying the issue: http://thedailybanter.com/2015/03/aps-bombshell-hillary-clinton-email-story-fails-prove-existence-homebrew-server/ http://thedailybanter.com/2015/03/aps-bombshell-hillary-clin... The initial AP article wasn't specific about the server location, but various media outlets omitted that sentence. Later updates to the AP article do state that a business record related to the server has been traced to her home, but the various republished editions of the AP story swamp search, so it is difficult to find any actual analysis of the technical details. A discussion here on HN is the best I've found: https://news.ycombinator.com/item?id=9148730 https://news.ycombinator.com/item?id=9148730 The records for the mail server do point to an ip address from a provider in the area of her home. But there is no further evidence.

damoncali 12y ago

I interpreted it as "she's using Google Apps on her own domain, which has a registered address of her house". But it's not exactly clear.

o0-0o 12y ago

Who Is Eric Hoteham? Clinton's private server was registered under his name. Is he real?

joelrunyon 12y ago

I think the bigger issue is that she's skirting rules that the rest of gov't has to follow. Similar to the trend of government setting rules for everyone that they conveniently exempt themselves from.

davesque 12y ago
Not necessarily. A much more important issue to me is the fact that top-ranking government officials are using e-mail for official business at all. If there's any reason to be concerned that Clinton was using an insecure account for official e-mails, that implies that other government officials use e-mail to communicate sensitive information. Since e-mail is inherently insecure (unless you're using GPG or PGP or some other kind of message level encryption, which they're probably not), this is the real problem here.
- Retric 12y ago
  Having worked with / for the US government, encryption and signing email is actually fairly common. For the most part people use a 2+ factor authentication and their smart cards have private keys. EX: http://www.cac.mil/common-access-card/ http://www.cac.mil/common-access-card/ After it's set up Outlook then let's people encrypt with a simple click. The recipient then needs their card + PIN to decrypt. PS: This is one of those cases where the US Government seems to be significantly ahead of the private sector in terms of actual adoption and use.
  - davesque 12y ago
    Thanks for the info. But I'm a bit confused. If government officials have the ability to easily encrypt their messages asymmetrically, AND they're supposed to store all of their messages in some kind of database, that sort of defeats the purpose of the encryption in the first place. Also, having a central store of all that information seems really risky and inherently less secure than a message encrypted asymmetrically. And, for that matter, if they are supposed to encrypt messages with a private key, that means they're not using asymmetric encryption for private communication. I'm not a security expert, but that seems like a bad move.
    - Retric 12y ago
      It's not just about encription it's also a question of varification that the email came from the person that it seems to. That's where the senders smart card comes into play they sign the email and need it to get the recepents public key. Also, the government wants a back door. So, they keep a copy of the private key's and assign them to an employee. The goal is to prevent interception and or data breeches on a lost laptop, not to hide the information from everyone. The same backdoor exits with full disk encryption so internal IT can help users who forgot their password etc.
- maratd 12y ago
  What would you have them use? Carrier pigeons? E-Mail is universal in both business and government. Using TLS, it is sufficiently secure for most communications. For the rest, I'm sure the CIA and NSA know how to use PGP.
  - davesque 12y ago
    Why the sarcasm? And yes, TLS will securely transmit your message securely from your client (whether it's Outlook or a web browser) to your e-mail server. But you don't have any guarantee that the various relays which transport your message will use TLS.
    - maratd 12y ago
      You do if the email is only going to be on the local network. Most email is sent within the organization. It might not even need to leave the email server. My point is that TLS is good enough for most scenarios.
- billpg 12y ago
  It is possible that all .gov-to-.gov emails go over a VPN linking all their mail servers together. Having government business conducted on a mail server not on this hypothetical VPN would be a security risk.

tedunangst 12y ago

Almost certainly the domain registration. > Hoteham was listed as the customer at Clinton's $1.7 million home on Old House Lane in Chappaqua in records registering the Internet address for her email server since August 2010. Does that sound like the information you get from running whois on an IP address or on a domain name? > Clinton's private email server was reconfigured again to use a Denver-based commercial email provider, MX Logic How the fuck would anybody know how her private server was reconfigured unless they're talking about mx records?

nissimk 12y ago
It's just poor reporting. I think they're misunderstanding their sources. I agree with you that the source is DNS, and they mean, "her email domain" was reconfigured, rather than her server.
smutticus 12y ago
> In November 2012, without explanation, Clinton's private email account was reconfigured to use Google's servers as a backup in case her own personal email server failed, according to Internet records. I took "Internet Records" to mean MX record for her domain. I'm assuming there are people keeping track of DNS changes publicly that one can view somewhere. Someone will probably respond to this post with a link.

mayneack 12y ago

The damning part is that her emails weren't stored in State Department records.

antr 12y ago

From my understanding in the Politico article[1], it appears the server was at the Clinton residence: "And since the Secret Service was guarding Clinton’s home, an email server there would have been well protected from theft or a physical hacking." [1] http://www.politico.com/story/2015/03/hillary-clinton-email-server-homebrew-115745.html http://www.politico.com/story/2015/03/hillary-clinton-email-...

maxerickson 12y ago
That's a slap up based on the same thin information as all the rest of the reporting. more: The press comments about the location of the server sure do sound a lot more like misunderstanding than they do careful research.
- antr 12y ago
  You might be right. The other thing that doesn't sound right is how the server runs MX Logic, which is an email service/server run by McAfee. So there is a total misunderstanding by the press of how domains/dns/servers/email services work.
  - maxerickson 12y ago
    This guy is studying the issue: http://thedailybanter.com/2015/03/aps-bombshell-hillary-clinton-email-story-fails-prove-existence-homebrew-server/ http://thedailybanter.com/2015/03/aps-bombshell-hillary-clin... The initial AP article wasn't specific about the server location, but various media outlets omitted that sentence. Later updates to the AP article do state that a business record related to the server has been traced to her home, but the various republished editions of the AP story swamp search, so it is difficult to find any actual analysis of the technical details. A discussion here on HN is the best I've found: https://news.ycombinator.com/item?id=9148730 https://news.ycombinator.com/item?id=9148730 The records for the mail server do point to an ip address from a provider in the area of her home. But there is no further evidence.