9 ms·

Why Clinton’s Private Email Server Was Such a Security Fail

91 points by altern8 12y ago

tedunangst 12y ago
I like that Wired takes the AP claim that the server was literally in her home (in a closet? the attic?) at face value.
- skuhn 12y ago
  Whether it was located in her home or not, that building is probably quite secure given who she is and is married to.
lmg643 12y ago
I'm still waiting for the explanation of why this was OK. "Every secretary of state has done this." or, "appropriate and very common among high elected officials." When i think about the email requirements of any corporation, every real job I've had, the use of personal email for company business is against policy and would be a fireable offense. Also interesting to consider the FOIA is more fearful to a politician, than having this private email service hacked by a foreign intelligence service. state department is essentially an adjunct to the CIA at the highest levels, so this is a real risk.
- protomyth 12y ago
  It's ok if it is for personal correspondence, however it is not ok and illegal if used for any government business. All the "where was the server" is irrelevant. This is generally why Presidents hand over their personal accounts and don't use them while in office. Also, the legislative members are under no such requirement. The State Department might want to read the rules, $DIETY knows the Interior Department sure had problems with them.
  - whoopdedo 12y ago
    Correct. In the rush to smear mud on a potential presidential candidate, the media is overlooking why Clinton was probably using her own email address: was the State Department unable to provide her with a properly archived and secure email address? On it's face I find it hard to believe they don't have the ability to do that. But at the same time, considering the cost-cutting, outsourcing, and the political maneuverings of congress that treats the federal budget like the hapless patient in a game of Operation... I wouldn't be too surprised if they weren't.
    - protomyth 12y ago
      My Interior remark stems from their multiple in contempt of court problems with keeping records. If Mrs. Clinton conducted official business on that server, she committed an illegal act. There is no "I knew better" defense. She failed to account for the correspondence as official.
    - A_COMPUTER 12y ago
      So you figure the best explanation is it's Congress's fault that Clinton chose to use a private secret email for her entire tenure at the State department that would just happen to be immune to FOIA if nobody already knew of its existence?
      - deong 12y ago
        It's hard to fathom they thought it wouldn't become public knowledge. I don't think anyone is that stupid. Far more likely, they just didn't think it was a big deal.
    - tedunangst 12y ago
      Surely if the State Dept failed to provide her with an email account, she could have piggy backed on whatever service a different Secretary used? Maybe buddy up with the Secretary of Transportation and direct her email to their server. It didn't have to be her own server.
    - remarkEon 12y ago
      I find it highly unlikely that the department of the federal government charged with corresponding with foreign nations and representing America abroad wouldn't have a satisfactory email system. That just seems dubious at best.
- comrh 12y ago
  As far as I've seen it was only "OK" because it was before they changed the rules to expressly disallow this. So it was technically right, the best kind.
- klodolph 12y ago
  The actual text is something like this: > Agencies that allow employees to send and receive official electronic mail messages using a system not operated by the agency must ensure that Federal records sent or received on such systems are preserved in the appropriate agency recordkeeping system. Also, I've rarely encountered a company that cared about whether C-level employees followed the company rules. A "fireable offense" for a fry cook is another day at work for the COO. If I were her, I would want to personally vet my IT department. I don't know how many Snowdens work at the state department.
- parasubvert 12y ago
  "When i think about the email requirements of any corporation, every real job I've had, the use of personal email for company business is against policy and would be a fireable offense." Rarely enforced. Executives in regulated industries do it all the time. Or (more commonly) when hordes of contractors use their own email systems to discuss client matters -- which is perfectly normal because they are covered by NDA. If someone is fired for using personal email, it's likely because a higher up was looking for an excuse. Of course a contract doesn't cover classified or FOIA material which is where the questions regarding Clinton's setup will go.
  - 001sky 12y ago
    This answer is too flip. In corporate america, you might be able to use a personal e-mail as a stop-gap measure but not as a primary communication. Not in any fortune 50 or whatevr company with compliance and security infrastructure. This is something that has changed drastically in the past 10 years. Most corporate hardware should be presumed "insecure" from the perspective of personal communication, and similarly so shoud any account that is used to co-mingle work and personal communication. In other words, it is with great risk[1] that you don't use company hardware. Unless you have duplicate systems, of course. And if you have a duplicate system that you pay for in lieu of the company, only to for the purpose of subverting company policy, you have an ethics problem. If that makes sense. In any event, the technical issues here about how this was setup are legitimately interesting. It might very well be that the NSA/secret service or whomever set up this system to very secure indeed. I think the jury is out on that, frankly, and I'm not sure I would jump to the conclusion that SOS would be so wreckless as to not have her system vetted. (Or that the secret service or NSA or whomever would be so wreckless to not do it for them). Obviously it was a very carefully considered and pre-meditated decision to set up this system. But then again people do stupid stuff all the time. [1] To your personal life and privacy, not to the corporations per-se.
    - parasubvert 12y ago
      "In corporate america, you might be able to use a personal e-mail as a stop-gap measure but not as a primary communication. Not in any fortune 50 or whatevr company with compliance and security infrastructure. This is something that has changed drastically in the past 10 years." Yes ... towards things like Google Mail for Corporations. If you make your corporate email better than your personal email, people will use it. If not, they just won't, if they have enough political power within the organization. I speak from close exposure to white glove CxO level IT service where we do everything from ensure the biometric reader on the CEO's laptop works, to helping wire the CFO's home theatre system, getting the board chairman's vacation photos printed, and setting up all their personal devices. If these sorts of folks don't like a system, they won't use it. They chucked the Blackberry for an iPhone. One of the reasons I've seen biometrics on a laptop is that a particular leader refused to remember a password longer than 4 digits. That alone made them prefer the corporate Lenovo vs. their personal Macbook Air. "Most corporate hardware should be presumed "insecure" from the perspective of personal communication, and similarly so shoud any account that is used to co-mingle work and personal communication." Bring Your Own Device is becoming popular. Every company I've worked for in the past 8 years (2/3 in the Fortune 100) allows BYOD in some form for executives, where they mix their personal and corporate communication. And sometimes for all employees. The latest thinking in corporate security is not to lock down devices but rather to assume that ALL devices are vulnerable, with no special status for corporate assets. The solution there is to isolate in depth at the service level, with appropriate policy and device management installed for enforcing minimum standards and for emergency remote wipe. Modern apps - email, HR, reporting, order management, etc. are on the Internet, not behind the firewall... unless there's a need for NAT. Legacy can be accessed through VDI. I admit the future here is not evenly distributed yet. But this is the trend that I see. "In other words, it is with great risk[1] that you don't use company hardware. Unless you have duplicate systems, of course. And if you have a duplicate system that you pay for in lieu of the company, only to for the purpose of subverting company policy, you have an ethics problem." I would say corporate IT has a usability problem.
- deleted 12y ago
  [deleted]
- SCAQTony 12y ago
  On prima facie Clinton's private email server, prsuambly immune from NSA spying while she was Secretary of State, is rather aristocratic & highly suspicious. As an attorney, a former Senator, and finally a Secretary of States, she and her staff had to known proper security protocols & transparency laws were not applied.
  - Shivetya 12y ago
    much more likely it was even more susceptible let alone enticing simply from the host name. really if you don't want someone to spy on you use a name which doesn't declare who you are party too. regardless, it was against the law and public officials should always be held to the highest standard, they are not royalty.
groovylick 12y ago
The reporting on this story has been pretty terrible. Wired just running with the AP story without spending the couple of minutes it takes to verify the details is shameful. The clintonemail.com domain was registered by Justin Cooper [1] and the MX records point to mail servers run by mxlogics.net, now owned by McAfee, not some solo server in Clinton's home. The sole evidence from the AP report is: > It was not immediately clear exactly where Clinton's computer server was run, a business record for the Internet connection it used was registered under the home address for her residence as early as August 2010. The customer was listed as Eric Hoteham. A business record for an Internet connection doesn't prove anything, let alone the location of an email server. A history of the MX records [2] is evidence of the location and management of the email server, which has always been set to a mxlogics domain. That it took me only 5 minutes to gather his information but unsourced reporting is being parroted is poor journalism. [1] http://who.is/dns/clintonemail.com http://who.is/dns/clintonemail.com [History & DNS Tabs] [2] https://dnshistory.org/dns-records/clintonemail.com https://dnshistory.org/dns-records/clintonemail.com
- _cudgel 12y ago
  The reporting on this story has been pretty terrible. Wired just running with the AP story without spending the couple of minutes it takes to verify the details is shameful. Agreed. But, in my opinion, the point of the story isn't to prove factually one way or the other whether or not Clinton did anything at all. The point is to put yet another seed of doubt in the collective subconscious of the voting public in the run-up to the 2016 Presidential election. Performing this simple feat simply requires a small group of the right people to parrot the same lines ad nauseam. Then it becomes "fact" in the world of punditry.
  - kevin_thibedeau 12y ago
    I'm waiting for the staging of "Benghazi: The Musical".
  - barney54 12y ago
    This story was only about security, others have been about the legal issues. On Hacker News the security angle is interesting, but the bigger picture is that only using her personal email for State Department business almost inevitably broke the law.
zaroth 12y ago
Also, the bit about self-signed certificates being insecure? Arguably they are the most secure if you pin to them since you are trusting no third parties. Obviously if you keep them untrusted and ignore the validation error every time it's a different story.
- VieElm 12y ago
  How could it be the "most secure"? How do you as a client verify the self signed certificate is the right one? If someone MITM'ed the certificate and you've never used it before how would you know that the certificate was intercepted? Who do you go to verify you've got the right certificate? That doesn't sound secure at all. It's like asking potential a liar to swear to you they aren't lying and not asking someone else if that person is possibly being dishonest. Sure central certificate authorities have their problems as a concept, but at least that someone else verifying the cert is the real one.
  - mrbabbage 12y ago
    In general, you'd be right; in parent's hypothetical scheme, the trust model is different because your systems exist on both sides of the exchange (in normal Web communication, this obviously isn't the case). You simply configure your clients to only trust this single certificate that you yourself created and installed on your server. No one could MITM you unless they recreated an identical certificate from scratch, which is mathematically challenging.
  - vidarh 12y ago
    Note the "if you pin them" part. Pin in this context means you have the identity of the specific certificate stored on your client, and so you are not depending on whether or not it is being declared by some CA to be be valid for the server in question. Instead you are expecting that exact certificate. That it is a private cert does not make it any more secure, but pinning is more secure, and with a pinned cert, having the cert signed by a CA gives no additional security.
    - VieElm 12y ago
gcb0 12y ago
heh. they are probably safe. or should i recall the kind of people the gov gives out money for it security?
jedbrown 12y ago
Interestingly, neither state.gov or clintonemail.com sets SPF records. (Nor does nsa.gov, army.mil, or af.mil, though cia.gov, navy.mil, and whitehouse.gov do.) From personal experience as of a few months ago, state.gov did not use DKIM for outgoing mail.
rrggrr 12y ago
I seem to recall CIA director Deutch keeping highly classified information on his home computer. CIA Director Patraeus giving classified info to his mistress. National Security Director Berger taking national archive info? Snowden. Its alleged Leon Panetta revealed classified info in his biography. Its almost as if some of the intelligence community leadership could, possibly, lack humility and believe they are infallible. There have been one or two cases in history where a lot of power combined with secrecy has led to bad decision-making. Perhaps this is another example.
- bdcravens 12y ago
  Patraeus is facing jail time as a result. (though his plea deal will probably prevent that) led to bad decision-making I think you misspelled "law-breaking"
agwa 12y ago
> Clintonemail.com currently uses an invalid TLS certificate, another method that a man-in-the-middle might use to intercept or spoof emails from the server; but Stanford researcher Jonathan Mayer points out to WIRED that the State Department’s own TLS certificate is currently invalid, too. The invalid certificates are a red herring. These are certificates used by SMTP servers[1], and since SMTP encryption is currently opportunistic (i.e. completely optional and trivially defeated by an active attacker), it does not matter whether the certificate is valid or not. Virtually no SMTP client validates the certificate presented by an SMTP server on port 25, let alone care if encryption is used. The only reason why SMTP servers present certificates at all, as opposed to using an anonymous TLS ciphersuite, is because some SMTP clients choke on anonymous ciphersuites. [1] https://twitter.com/jonathanmayer/status/572779239281332224 https://twitter.com/jonathanmayer/status/572779239281332224
officer_gotcha 12y ago
The assumption that 'manpower' is somehow equivalent to 'security' is heart-warming, but wrong. The assumption that 'manpower' was insufficient only because it was hired by some Hillary acolyte, and not by her ministry is wrong. Not sure what is 'invalid' about the certificates, but if it is self-signed, it doesn't mean the setup is 'insecure'. Finally, nobody is guaranteed a secure setup, some of us still remember the happy times when the whitehouse.gov's email system was an open relay.
chrissnell 12y ago
Remember this: if you are a run-of-the-mill State Department staffer or a military servicemember and you put classified material on a non-classified network, you might go to prison. Even high-ranking government officials have gotten in serious crap over classified material mismanagement--GEN Petraeus did this and lost his job as a result.
- x0x0 12y ago
  And proceeded to get the biggest sweetheart deal in the world from the feds. It's a miracle they didn't offer him a sex act to go with his plea. Unless you believe some random asshole who shares TS/code word info with a mistress and repeatedly lies to the fbi normally gets the feds to give him a misdemeanor and suggest probation. One law for you and me, one law for them. https://www.popehat.com/2015/03/03/a-few-comments-on-the-david-petraeus-plea-deal-what-money-and-connections-buy-you/ https://www.popehat.com/2015/03/03/a-few-comments-on-the-dav...
- CHY872 12y ago
  Yeah, but it's absolutely apples and oranges. Petraeus didn't just break this rule, he broke others too and became a bit of an embarrassment. With your run-of-the-mill service member, it's more a culture of indoctrination - you train people to never make moves that could be perceived as exfiltrating data so that then if anyone makes them you have better evidence that they're exfiltrating data. I think that when there are allegations being applied of a double standard, it's important to ask why the double standard is being applied. In this case, I think it's pretty fair to assume that a Secretary of State might well have a good reason for a double standard to be applied. It could be that a staffer gave bad advice, or that she'd received advice from security people. Certainly I could believe that she'd be better able to vet her people than the state department. This seems to be a bit of a political crushing, though.
drawkbox 12y ago
I am surprised this is such a big issue considering something very similar happened while Bush was in the White House with outside email under gwb43.com and georgewbush.com and Bush didn't really use email: http://en.wikipedia.org/wiki/Bush_White_House_email_controversy http://en.wikipedia.org/wiki/Bush_White_House_email_controve...
- adventured 12y ago
  That would be like saying it's surprising torture by the Obama Administration is such a big issue, because the Bush Administration did it too (and I'm not implying there is or has been torture under Obama, that's not the point). These things should always be a big deal.
- bdcravens 12y ago
  There was an investigation and a report. The same would be appropriate here.
rebootthesystem 12y ago
This mess is an example of a much larger problem: We are being governed by a bunch of attorneys who do not hesitate to lie, cheat and steal and play all of us for the fools that we are. Recent examples include a President telling lies (keep your insurance and doctor, save $2,500 a year, etc.) without consequences. This is not limited to a single party. It travels equally well on both rails and spans from mayors and governors to senators and, yes, Presidents. Not sure what the solution to this might be. This is the stuff of so-called third world countries. I have long held that we are not far from "them", we just do it differently and don't take to the streets en-masse when we are lied to and royally screwed. Maybe one day we will and things will start to change. A lot of these people belong to jail for what they've done to this country. My guess is that if you are under, say, 30, you are going to have to suffer the consequences of what these people have been doing to the country for, say, 50 years. And your children. Well, there's a school of thought that is of the opinion that your children migt just get to experiencethe US as a near third world country in about 50 years. Our politicians must be accountable for their actions and must have consequences for misleading and manipulating the people. Not sure how that happens. Not sure what laws would deal with this. If there aren't any, there ought to be.
dschiptsov 12y ago
Because it was Windows?)

91 points by altern8 12y ago

tedunangst 12y ago

I like that Wired takes the AP claim that the server was literally in her home (in a closet? the attic?) at face value.

skuhn 12y ago
Whether it was located in her home or not, that building is probably quite secure given who she is and is married to.

lmg643 12y ago

I'm still waiting for the explanation of why this was OK. "Every secretary of state has done this." or, "appropriate and very common among high elected officials." When i think about the email requirements of any corporation, every real job I've had, the use of personal email for company business is against policy and would be a fireable offense. Also interesting to consider the FOIA is more fearful to a politician, than having this private email service hacked by a foreign intelligence service. state department is essentially an adjunct to the CIA at the highest levels, so this is a real risk.

protomyth 12y ago
It's ok if it is for personal correspondence, however it is not ok and illegal if used for any government business. All the "where was the server" is irrelevant. This is generally why Presidents hand over their personal accounts and don't use them while in office. Also, the legislative members are under no such requirement. The State Department might want to read the rules, $DIETY knows the Interior Department sure had problems with them.
- whoopdedo 12y ago
  Correct. In the rush to smear mud on a potential presidential candidate, the media is overlooking why Clinton was probably using her own email address: was the State Department unable to provide her with a properly archived and secure email address? On it's face I find it hard to believe they don't have the ability to do that. But at the same time, considering the cost-cutting, outsourcing, and the political maneuverings of congress that treats the federal budget like the hapless patient in a game of Operation... I wouldn't be too surprised if they weren't.
  - protomyth 12y ago
    My Interior remark stems from their multiple in contempt of court problems with keeping records. If Mrs. Clinton conducted official business on that server, she committed an illegal act. There is no "I knew better" defense. She failed to account for the correspondence as official.
  - A_COMPUTER 12y ago
    So you figure the best explanation is it's Congress's fault that Clinton chose to use a private secret email for her entire tenure at the State department that would just happen to be immune to FOIA if nobody already knew of its existence?
    - deong 12y ago
      It's hard to fathom they thought it wouldn't become public knowledge. I don't think anyone is that stupid. Far more likely, they just didn't think it was a big deal.
  - tedunangst 12y ago
    Surely if the State Dept failed to provide her with an email account, she could have piggy backed on whatever service a different Secretary used? Maybe buddy up with the Secretary of Transportation and direct her email to their server. It didn't have to be her own server.
  - remarkEon 12y ago
    I find it highly unlikely that the department of the federal government charged with corresponding with foreign nations and representing America abroad wouldn't have a satisfactory email system. That just seems dubious at best.
comrh 12y ago
As far as I've seen it was only "OK" because it was before they changed the rules to expressly disallow this. So it was technically right, the best kind.
klodolph 12y ago
The actual text is something like this: > Agencies that allow employees to send and receive official electronic mail messages using a system not operated by the agency must ensure that Federal records sent or received on such systems are preserved in the appropriate agency recordkeeping system. Also, I've rarely encountered a company that cared about whether C-level employees followed the company rules. A "fireable offense" for a fry cook is another day at work for the COO. If I were her, I would want to personally vet my IT department. I don't know how many Snowdens work at the state department.
parasubvert 12y ago
"When i think about the email requirements of any corporation, every real job I've had, the use of personal email for company business is against policy and would be a fireable offense." Rarely enforced. Executives in regulated industries do it all the time. Or (more commonly) when hordes of contractors use their own email systems to discuss client matters -- which is perfectly normal because they are covered by NDA. If someone is fired for using personal email, it's likely because a higher up was looking for an excuse. Of course a contract doesn't cover classified or FOIA material which is where the questions regarding Clinton's setup will go.
- 001sky 12y ago
  This answer is too flip. In corporate america, you might be able to use a personal e-mail as a stop-gap measure but not as a primary communication. Not in any fortune 50 or whatevr company with compliance and security infrastructure. This is something that has changed drastically in the past 10 years. Most corporate hardware should be presumed "insecure" from the perspective of personal communication, and similarly so shoud any account that is used to co-mingle work and personal communication. In other words, it is with great risk[1] that you don't use company hardware. Unless you have duplicate systems, of course. And if you have a duplicate system that you pay for in lieu of the company, only to for the purpose of subverting company policy, you have an ethics problem. If that makes sense. In any event, the technical issues here about how this was setup are legitimately interesting. It might very well be that the NSA/secret service or whomever set up this system to very secure indeed. I think the jury is out on that, frankly, and I'm not sure I would jump to the conclusion that SOS would be so wreckless as to not have her system vetted. (Or that the secret service or NSA or whomever would be so wreckless to not do it for them). Obviously it was a very carefully considered and pre-meditated decision to set up this system. But then again people do stupid stuff all the time. [1] To your personal life and privacy, not to the corporations per-se.
  - parasubvert 12y ago
    "In corporate america, you might be able to use a personal e-mail as a stop-gap measure but not as a primary communication. Not in any fortune 50 or whatevr company with compliance and security infrastructure. This is something that has changed drastically in the past 10 years." Yes ... towards things like Google Mail for Corporations. If you make your corporate email better than your personal email, people will use it. If not, they just won't, if they have enough political power within the organization. I speak from close exposure to white glove CxO level IT service where we do everything from ensure the biometric reader on the CEO's laptop works, to helping wire the CFO's home theatre system, getting the board chairman's vacation photos printed, and setting up all their personal devices. If these sorts of folks don't like a system, they won't use it. They chucked the Blackberry for an iPhone. One of the reasons I've seen biometrics on a laptop is that a particular leader refused to remember a password longer than 4 digits. That alone made them prefer the corporate Lenovo vs. their personal Macbook Air. "Most corporate hardware should be presumed "insecure" from the perspective of personal communication, and similarly so shoud any account that is used to co-mingle work and personal communication." Bring Your Own Device is becoming popular. Every company I've worked for in the past 8 years (2/3 in the Fortune 100) allows BYOD in some form for executives, where they mix their personal and corporate communication. And sometimes for all employees. The latest thinking in corporate security is not to lock down devices but rather to assume that ALL devices are vulnerable, with no special status for corporate assets. The solution there is to isolate in depth at the service level, with appropriate policy and device management installed for enforcing minimum standards and for emergency remote wipe. Modern apps - email, HR, reporting, order management, etc. are on the Internet, not behind the firewall... unless there's a need for NAT. Legacy can be accessed through VDI. I admit the future here is not evenly distributed yet. But this is the trend that I see. "In other words, it is with great risk[1] that you don't use company hardware. Unless you have duplicate systems, of course. And if you have a duplicate system that you pay for in lieu of the company, only to for the purpose of subverting company policy, you have an ethics problem." I would say corporate IT has a usability problem.
deleted 12y ago
[deleted]
SCAQTony 12y ago
On prima facie Clinton's private email server, prsuambly immune from NSA spying while she was Secretary of State, is rather aristocratic & highly suspicious. As an attorney, a former Senator, and finally a Secretary of States, she and her staff had to known proper security protocols & transparency laws were not applied.
- Shivetya 12y ago
  much more likely it was even more susceptible let alone enticing simply from the host name. really if you don't want someone to spy on you use a name which doesn't declare who you are party too. regardless, it was against the law and public officials should always be held to the highest standard, they are not royalty.

groovylick 12y ago

The reporting on this story has been pretty terrible. Wired just running with the AP story without spending the couple of minutes it takes to verify the details is shameful. The clintonemail.com domain was registered by Justin Cooper [1] and the MX records point to mail servers run by mxlogics.net, now owned by McAfee, not some solo server in Clinton's home. The sole evidence from the AP report is: > It was not immediately clear exactly where Clinton's computer server was run, a business record for the Internet connection it used was registered under the home address for her residence as early as August 2010. The customer was listed as Eric Hoteham. A business record for an Internet connection doesn't prove anything, let alone the location of an email server. A history of the MX records [2] is evidence of the location and management of the email server, which has always been set to a mxlogics domain. That it took me only 5 minutes to gather his information but unsourced reporting is being parroted is poor journalism. [1] http://who.is/dns/clintonemail.com http://who.is/dns/clintonemail.com [History & DNS Tabs] [2] https://dnshistory.org/dns-records/clintonemail.com https://dnshistory.org/dns-records/clintonemail.com

_cudgel 12y ago
The reporting on this story has been pretty terrible. Wired just running with the AP story without spending the couple of minutes it takes to verify the details is shameful. Agreed. But, in my opinion, the point of the story isn't to prove factually one way or the other whether or not Clinton did anything at all. The point is to put yet another seed of doubt in the collective subconscious of the voting public in the run-up to the 2016 Presidential election. Performing this simple feat simply requires a small group of the right people to parrot the same lines ad nauseam. Then it becomes "fact" in the world of punditry.
- kevin_thibedeau 12y ago
  I'm waiting for the staging of "Benghazi: The Musical".
- barney54 12y ago
  This story was only about security, others have been about the legal issues. On Hacker News the security angle is interesting, but the bigger picture is that only using her personal email for State Department business almost inevitably broke the law.

zaroth 12y ago

Also, the bit about self-signed certificates being insecure? Arguably they are the most secure if you pin to them since you are trusting no third parties. Obviously if you keep them untrusted and ignore the validation error every time it's a different story.

VieElm 12y ago
How could it be the "most secure"? How do you as a client verify the self signed certificate is the right one? If someone MITM'ed the certificate and you've never used it before how would you know that the certificate was intercepted? Who do you go to verify you've got the right certificate? That doesn't sound secure at all. It's like asking potential a liar to swear to you they aren't lying and not asking someone else if that person is possibly being dishonest. Sure central certificate authorities have their problems as a concept, but at least that someone else verifying the cert is the real one.
- mrbabbage 12y ago
  In general, you'd be right; in parent's hypothetical scheme, the trust model is different because your systems exist on both sides of the exchange (in normal Web communication, this obviously isn't the case). You simply configure your clients to only trust this single certificate that you yourself created and installed on your server. No one could MITM you unless they recreated an identical certificate from scratch, which is mathematically challenging.
- vidarh 12y ago
  Note the "if you pin them" part. Pin in this context means you have the identity of the specific certificate stored on your client, and so you are not depending on whether or not it is being declared by some CA to be be valid for the server in question. Instead you are expecting that exact certificate. That it is a private cert does not make it any more secure, but pinning is more secure, and with a pinned cert, having the cert signed by a CA gives no additional security.
  - VieElm 12y ago

gcb0 12y ago

heh. they are probably safe. or should i recall the kind of people the gov gives out money for it security?

jedbrown 12y ago

Interestingly, neither state.gov or clintonemail.com sets SPF records. (Nor does nsa.gov, army.mil, or af.mil, though cia.gov, navy.mil, and whitehouse.gov do.) From personal experience as of a few months ago, state.gov did not use DKIM for outgoing mail.

rrggrr 12y ago

I seem to recall CIA director Deutch keeping highly classified information on his home computer. CIA Director Patraeus giving classified info to his mistress. National Security Director Berger taking national archive info? Snowden. Its alleged Leon Panetta revealed classified info in his biography. Its almost as if some of the intelligence community leadership could, possibly, lack humility and believe they are infallible. There have been one or two cases in history where a lot of power combined with secrecy has led to bad decision-making. Perhaps this is another example.

bdcravens 12y ago
Patraeus is facing jail time as a result. (though his plea deal will probably prevent that) led to bad decision-making I think you misspelled "law-breaking"

agwa 12y ago

> Clintonemail.com currently uses an invalid TLS certificate, another method that a man-in-the-middle might use to intercept or spoof emails from the server; but Stanford researcher Jonathan Mayer points out to WIRED that the State Department’s own TLS certificate is currently invalid, too. The invalid certificates are a red herring. These are certificates used by SMTP servers[1], and since SMTP encryption is currently opportunistic (i.e. completely optional and trivially defeated by an active attacker), it does not matter whether the certificate is valid or not. Virtually no SMTP client validates the certificate presented by an SMTP server on port 25, let alone care if encryption is used. The only reason why SMTP servers present certificates at all, as opposed to using an anonymous TLS ciphersuite, is because some SMTP clients choke on anonymous ciphersuites. [1] https://twitter.com/jonathanmayer/status/572779239281332224 https://twitter.com/jonathanmayer/status/572779239281332224

officer_gotcha 12y ago

The assumption that 'manpower' is somehow equivalent to 'security' is heart-warming, but wrong. The assumption that 'manpower' was insufficient only because it was hired by some Hillary acolyte, and not by her ministry is wrong. Not sure what is 'invalid' about the certificates, but if it is self-signed, it doesn't mean the setup is 'insecure'. Finally, nobody is guaranteed a secure setup, some of us still remember the happy times when the whitehouse.gov's email system was an open relay.

chrissnell 12y ago

Remember this: if you are a run-of-the-mill State Department staffer or a military servicemember and you put classified material on a non-classified network, you might go to prison. Even high-ranking government officials have gotten in serious crap over classified material mismanagement--GEN Petraeus did this and lost his job as a result.

x0x0 12y ago
And proceeded to get the biggest sweetheart deal in the world from the feds. It's a miracle they didn't offer him a sex act to go with his plea. Unless you believe some random asshole who shares TS/code word info with a mistress and repeatedly lies to the fbi normally gets the feds to give him a misdemeanor and suggest probation. One law for you and me, one law for them. https://www.popehat.com/2015/03/03/a-few-comments-on-the-david-petraeus-plea-deal-what-money-and-connections-buy-you/ https://www.popehat.com/2015/03/03/a-few-comments-on-the-dav...
CHY872 12y ago
Yeah, but it's absolutely apples and oranges. Petraeus didn't just break this rule, he broke others too and became a bit of an embarrassment. With your run-of-the-mill service member, it's more a culture of indoctrination - you train people to never make moves that could be perceived as exfiltrating data so that then if anyone makes them you have better evidence that they're exfiltrating data. I think that when there are allegations being applied of a double standard, it's important to ask why the double standard is being applied. In this case, I think it's pretty fair to assume that a Secretary of State might well have a good reason for a double standard to be applied. It could be that a staffer gave bad advice, or that she'd received advice from security people. Certainly I could believe that she'd be better able to vet her people than the state department. This seems to be a bit of a political crushing, though.

drawkbox 12y ago

I am surprised this is such a big issue considering something very similar happened while Bush was in the White House with outside email under gwb43.com and georgewbush.com and Bush didn't really use email: http://en.wikipedia.org/wiki/Bush_White_House_email_controversy http://en.wikipedia.org/wiki/Bush_White_House_email_controve...

adventured 12y ago
That would be like saying it's surprising torture by the Obama Administration is such a big issue, because the Bush Administration did it too (and I'm not implying there is or has been torture under Obama, that's not the point). These things should always be a big deal.
bdcravens 12y ago
There was an investigation and a report. The same would be appropriate here.

rebootthesystem 12y ago

This mess is an example of a much larger problem: We are being governed by a bunch of attorneys who do not hesitate to lie, cheat and steal and play all of us for the fools that we are. Recent examples include a President telling lies (keep your insurance and doctor, save $2,500 a year, etc.) without consequences. This is not limited to a single party. It travels equally well on both rails and spans from mayors and governors to senators and, yes, Presidents. Not sure what the solution to this might be. This is the stuff of so-called third world countries. I have long held that we are not far from "them", we just do it differently and don't take to the streets en-masse when we are lied to and royally screwed. Maybe one day we will and things will start to change. A lot of these people belong to jail for what they've done to this country. My guess is that if you are under, say, 30, you are going to have to suffer the consequences of what these people have been doing to the country for, say, 50 years. And your children. Well, there's a school of thought that is of the opinion that your children migt just get to experiencethe US as a near third world country in about 50 years. Our politicians must be accountable for their actions and must have consequences for misleading and manipulating the people. Not sure how that happens. Not sure what laws would deal with this. If there aren't any, there ought to be.

dschiptsov 12y ago

Because it was Windows?)