Hacker News new | past | comments | ask | show | jobs | submit login

it seems we need better safeguards for personal data for elected officials. I think the government could do it easily:

1. Issue iPhone with finger scanner for MFA for all important access. This works so easy that it would be hard for someone to screw it up.

2. Setup home networks to always use secure tunnels ( custom routers with openvpn settings, Etc).

3. MFA all accounts.

The key is to make it so easy to do things the right way that it's hard to mess it up.





Everything is always a trade off. Finger prints offer considerable convenience, especially when they work in tandem with something like a secure HSM.

For example, on an iPhone 5s and beyond, the fingerprint doesn't decrypt the phone, it unlocks the secure enclave which decrypts the phone.


I suggest that you read this article on identity, authn & authz.

https://technet.microsoft.com/en-us/library/cc512578.aspx

Also, AFAIK, you cannot be compelled at this point to provide a PIN/password (short of the rubber hose) but someone can just use your finger to unlock a phone. Yes, tradeoffs but the convenience factor is not worth it IMO.


> The key is to make it so easy to do things the right way that it's hard to mess it up.

Before you roll out any tech fix, you need a policy fix:

"If you use you personal accounts for any official business, you will be terminated and held criminally liable."

EDIT: If someone from the USDS sees this, perhaps mention it to the US CTO and POTUS. I hear executive orders are a big thing for the next 12 months.


Good grief what a terrible policy!


Why is it bad policy to demand accountability from those who work for us?


The problem is that it's personal email, therefore, not the governments business or problem. That's why they aren't allowed to use their personal email for work purposes.

For the really important stuff, they don't even cell remote access. You have to do everything at a secure location.


> That's why they aren't allowed to use their personal email for work purposes

Since when?

I agree it should be the policy, but it's not. Evidenced by Hillary Clinton's scandal[1], as well as the recent Director of the CIA[2]. In neither case (so far) has the individual been punished. In Hillary's case, the State Department is even siding with her use of private email for official business (including recently discovered classified documents with the header deleted [3]).

[1] http://www.businessinsider.com/fbi-hillary-clinton-email-inv...

[2] http://fortune.com/2015/10/22/cia-aol-email-hack/

[3] http://hotair.com/archives/2016/01/11/hillary-by-ordering-id...


It is policy and Clinton broke the policy. That is why it's a scandal. The Brenner Scandal was overblown. There wasn't any secret info in there.


Why only elected officials and not everyone?


For non-personal accounts they already use multi-factor auth. And adding more authentication and tunnels doesn't defeat all the other attack vectors.

Honestly, do you think these people really care if their Facebook gets hacked or the chain letters passed around by their family members get leaked?


It's easy to dismiss the contents of their personal email and social media as irrelevant but surely they represent possible attack vectors for extortion or worse.


The finger scanner makes me think of a funny story: http://www.bbc.com/news/world-latin-america-21756709



they don't deserve more privacy than what we get


What they need is to blacklist personal email so a compromise there doesn't grant the keys to the cattle. It shouldn't be possible for any government employee to correspond through their private a accounts.


> 1. Issue iPhone with finger scanner for MFA for all important access. This works so easy that it would be hard for someone to screw it up.

Yes. Lets use a closed platform controlled by a single private entity to ensure the safety of all sensitive government data.

Or how about not. Open-source must be a requirement, and then (sadly) Android is the only option.

That said, it does support full disk encryption and use of finger-scanners too, so it's not like you would lose security capabilities.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: