5 ms·

I think the bigger issue is that she's skirting rules that the rest of gov't has to follow. Similar to the trend of government setting rules for everyone that

I think the bigger issue is that she's skirting rules that the rest of gov't has to follow. Similar to the trend of government setting rules for everyone that they conveniently exempt themselves from.

davesque 12y ago
Not necessarily. A much more important issue to me is the fact that top-ranking government officials are using e-mail for official business at all. If there's any reason to be concerned that Clinton was using an insecure account for official e-mails, that implies that other government officials use e-mail to communicate sensitive information. Since e-mail is inherently insecure (unless you're using GPG or PGP or some other kind of message level encryption, which they're probably not), this is the real problem here.
- Retric 12y ago
  Having worked with / for the US government, encryption and signing email is actually fairly common. For the most part people use a 2+ factor authentication and their smart cards have private keys. EX: http://www.cac.mil/common-access-card/ http://www.cac.mil/common-access-card/ After it's set up Outlook then let's people encrypt with a simple click. The recipient then needs their card + PIN to decrypt. PS: This is one of those cases where the US Government seems to be significantly ahead of the private sector in terms of actual adoption and use.
  - davesque 12y ago
    Thanks for the info. But I'm a bit confused. If government officials have the ability to easily encrypt their messages asymmetrically, AND they're supposed to store all of their messages in some kind of database, that sort of defeats the purpose of the encryption in the first place. Also, having a central store of all that information seems really risky and inherently less secure than a message encrypted asymmetrically. And, for that matter, if they are supposed to encrypt messages with a private key, that means they're not using asymmetric encryption for private communication. I'm not a security expert, but that seems like a bad move.
    - Retric 12y ago
      It's not just about encription it's also a question of varification that the email came from the person that it seems to. That's where the senders smart card comes into play they sign the email and need it to get the recepents public key. Also, the government wants a back door. So, they keep a copy of the private key's and assign them to an employee. The goal is to prevent interception and or data breeches on a lost laptop, not to hide the information from everyone. The same backdoor exits with full disk encryption so internal IT can help users who forgot their password etc.
- maratd 12y ago
  What would you have them use? Carrier pigeons? E-Mail is universal in both business and government. Using TLS, it is sufficiently secure for most communications. For the rest, I'm sure the CIA and NSA know how to use PGP.
  - davesque 12y ago
    Why the sarcasm? And yes, TLS will securely transmit your message securely from your client (whether it's Outlook or a web browser) to your e-mail server. But you don't have any guarantee that the various relays which transport your message will use TLS.
    - maratd 12y ago
      You do if the email is only going to be on the local network. Most email is sent within the organization. It might not even need to leave the email server. My point is that TLS is good enough for most scenarios.
- billpg 12y ago
  It is possible that all .gov-to-.gov emails go over a VPN linking all their mail servers together. Having government business conducted on a mail server not on this hypothetical VPN would be a security risk.

davesque 12y ago

Not necessarily. A much more important issue to me is the fact that top-ranking government officials are using e-mail for official business at all. If there's any reason to be concerned that Clinton was using an insecure account for official e-mails, that implies that other government officials use e-mail to communicate sensitive information. Since e-mail is inherently insecure (unless you're using GPG or PGP or some other kind of message level encryption, which they're probably not), this is the real problem here.

Retric 12y ago
Having worked with / for the US government, encryption and signing email is actually fairly common. For the most part people use a 2+ factor authentication and their smart cards have private keys. EX: http://www.cac.mil/common-access-card/ http://www.cac.mil/common-access-card/ After it's set up Outlook then let's people encrypt with a simple click. The recipient then needs their card + PIN to decrypt. PS: This is one of those cases where the US Government seems to be significantly ahead of the private sector in terms of actual adoption and use.
- davesque 12y ago
  Thanks for the info. But I'm a bit confused. If government officials have the ability to easily encrypt their messages asymmetrically, AND they're supposed to store all of their messages in some kind of database, that sort of defeats the purpose of the encryption in the first place. Also, having a central store of all that information seems really risky and inherently less secure than a message encrypted asymmetrically. And, for that matter, if they are supposed to encrypt messages with a private key, that means they're not using asymmetric encryption for private communication. I'm not a security expert, but that seems like a bad move.
  - Retric 12y ago
    It's not just about encription it's also a question of varification that the email came from the person that it seems to. That's where the senders smart card comes into play they sign the email and need it to get the recepents public key. Also, the government wants a back door. So, they keep a copy of the private key's and assign them to an employee. The goal is to prevent interception and or data breeches on a lost laptop, not to hide the information from everyone. The same backdoor exits with full disk encryption so internal IT can help users who forgot their password etc.
maratd 12y ago
What would you have them use? Carrier pigeons? E-Mail is universal in both business and government. Using TLS, it is sufficiently secure for most communications. For the rest, I'm sure the CIA and NSA know how to use PGP.
- davesque 12y ago
  Why the sarcasm? And yes, TLS will securely transmit your message securely from your client (whether it's Outlook or a web browser) to your e-mail server. But you don't have any guarantee that the various relays which transport your message will use TLS.
  - maratd 12y ago
    You do if the email is only going to be on the local network. Most email is sent within the organization. It might not even need to leave the email server. My point is that TLS is good enough for most scenarios.
billpg 12y ago
It is possible that all .gov-to-.gov emails go over a VPN linking all their mail servers together. Having government business conducted on a mail server not on this hypothetical VPN would be a security risk.