Slashdot Mirror
Clinton's Private Email System Gets a Security "F" Rating
Penguinisto writes According to a scan by Qualys, Hillary Clinton's personal e-mail server, which has lately generated more than a little controversy in US political circles, has earned an "F" rating for security from the security vendor. Problems include SSL2 support, a weak signature, and only having support for older TLS protocols, among numerous other problems. Note that there are allegations that the email server was possibly already hacked in 2013. (Note: Mrs. Clinton plans on Giving a press conference to the public today on the issue.)
Funny - I clicked on the link and the rating is a B. No ambiguity about it and not the result of a hasty recent security update (the site was assessed on Sat Mar 07 22:39:37 PST 2015). Where does this headline and summary come from?
I mean, the only security they seemed to be interested in was keeping the emails out of the hands of people with subpoenas, FOIA requests and such.
Plus, it's in her house, so she gets 4th Amendment protections as well, which is pretty smart.
But Qualsys's SSL scan grade is relevant to a server open to the public. Looking at the generated report, the main problem, in a situation where the client software is highly controllable and very likely hand-configured, is the lack of perfect-forward-secrecy ciphersuites. And that only helps prevent future attacks, not past ones (she's "retired" at the moment).
If somebody wanted to attack this system, attacking TLS would not be the way to do it - the configuration is good enough to make so many other vectors much cheaper attacks. I see the engineer used GoDaddy as the SSL vendor. This doesn't speak well for the budget of the project which has implications for the degree of configuration hardening that was done, which is especially crucial for a Windows machine.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
Did not violate any rules regarding email retention - rules were created after. Did what every other Secretary of State did in regards to email. Bush was president - so no, Hillary is not a bad choice.
I just checked and it says "F" in a bright red box.
SSL Report: mail.clintonemail.com (64.94.172.146)
What IP address did YOU see? Maybe there's more than one server being polled?
The Qualsys SSL scan only scans the web server front-end. (Which shouldn't even exist, in my opinion. Use a mail program, not a browser.)
But this is a mail server too, with its own security implications, and those have not been scrutinized, as far as I can tell.
Mrs. Clinton broke no laws at all. The laws requiring saving of emails by officials were passed after Mr. Clinton left office.
Nice attempt at obfuscation there. This has nothing to do with when Bill Clinton was President. This is about how Hillary Clinton handled her email while she was Secretary of State under President Obama.
#DeleteChrome
It isn't the voting public, it is the very wealthy and well connected power brokers that have anointed these two. The voting public are sheeple, easily manipulated with FUD.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
I will be very disappointed if Clinton opponents don't use some version of an ad that highlights this.
And following that, the Democrats will put up the exact same ad, but featuring Jeb Bush.
There have been a bunch of Republicans who have admitted to using their own (non-governmental) email systems, two of which were also former secretaries of state:
Condoleezza Rice
Colin Powell
Jeb Bush
Bobby Jindal
Rick Perry
Sarah Palin
And that' most likely not all of them. But don't take this as GOP bashing, I'm pretty sure that this sort of thing is rampant on both sides of the aisle. But once one side lifts the veil on it, the other side will respond in kind.
I am Slashdot. Are you Slashdot as well?
Nonsense. LBJ, despite getting mired in the Vietnam War, had many effective strengths as a politician. I believe here, Jeb Bush is referring to LBJ's ability to get bipartisan support for his legislation. While I don't have a problem with politicians who can "work across the aisle", I find this suspiciously like George W. Bush, who said much the same thing and then abandoned bipartisanship for a significant part of his tenure.
In comparison, I find Hillary Clinton's casual and persistent corruption and selective rule breaking to be a worse thing than Jeb Bush's choice of role models. Still I wouldn't be broken up, if neither ever was ever elected president.
I'd say leaving office apparently broke and then making shitloads-times-fuckloads of money later, is a sign of a successful president.
Well, then President Clinton neatly skirts any accusation of being successful by that metric: http://www.washingtonpost.com/...
They left office not just with millions, but also with the White House dinnerware: http://abcnews.go.com/Politics...
Yet cited email as a tertiary reason for firing the African ambassador.
Installing a private Internet connection in your Dept. Of State office bathroom, in order to bypass the government link is a far cry from running a mail server out of your home.
There's a massive difference in setting up a server you own and are the only one to have 24/7 unfettered access vs using a free email provider.
That's for sure! We've all seen how secure Yahoo, AOL and Google email accounts are. That is not to say running a private email server is a walk in the park. Just because someone uses a free email provider doesn't mean they'll have a more secure server.
So you are aware there was a memo put out by Pres O. 24 August 2012 concerning use of private email for state business.
You do realize she'd set this server up in 2009 and left in Feb 2013? So she continued to use her own server her last five months, rather than do a disruptive move to the State server, when she already knew she was leaving in a few months. Your point?
He[r] data also remains under HER control, HER ownership, and if any of you idiots think your "cloud" data is safe, it just proves how inept you are.
You are right but not for the reasons you believe. By owning the server she controls who can get the emails, and that includes from government investigators. When they review the emails she turns over, what proof is there that any problematic emails were not first erased? If it was in a "cloud" system, including a government system, then she would have lost the ability to sanitize the email trove before investigators get access. Regarding your calling people idiots who think differently than you and for trusting cloud systems, I guess it depends on against whom you are trying to protect the data.
http://www.politico.com/story/...
Actually, that IRS the dog ate my email somewhat failed.
It turns out that asking IT to look for backups of the email is more productive than looking for it personally. Its just a matter of time needed to sort through it if anyone in government is still interested.
He data also remains under HER control, HER ownership
That's cute, except that it's not her data. That data is owned by the American people via its government, as are all official communications. When you're an officeholder, you don't "own" your official email.
Dewey, what part of this looks like authorities should be involved?
hilary isnt the second in line. the vice president is. :/
The VP is first in line. :/
But then it goes to the speaker of the house, president pro tempore and then secretary of state.
"A plan fiendishly clever in its intricacies"- Homer Simpson
" in or next to the Big Chair."
SecState counts as "next to"