Slashdot Mirror


Clinton's Private Email System Gets a Security "F" Rating

Penguinisto writes According to a scan by Qualys, Hillary Clinton's personal e-mail server, which has lately generated more than a little controversy in US political circles, has earned an "F" rating for security from the security vendor. Problems include SSL2 support, a weak signature, and only having support for older TLS protocols, among numerous other problems. Note that there are allegations that the email server was possibly already hacked in 2013. (Note: Mrs. Clinton plans on Giving a press conference to the public today on the issue.)

24 of 315 comments (clear)

  1. Makes sense by Trailer+Trash · · Score: 5, Insightful

    I mean, the only security they seemed to be interested in was keeping the emails out of the hands of people with subpoenas, FOIA requests and such.

    1. Re:Makes sense by bill_mcgonigle · · Score: 5, Informative

      I mean, the only security they seemed to be interested in was keeping the emails out of the hands of people with subpoenas, FOIA requests and such.

      Plus, it's in her house, so she gets 4th Amendment protections as well, which is pretty smart.

      But Qualsys's SSL scan grade is relevant to a server open to the public. Looking at the generated report, the main problem, in a situation where the client software is highly controllable and very likely hand-configured, is the lack of perfect-forward-secrecy ciphersuites. And that only helps prevent future attacks, not past ones (she's "retired" at the moment).

      If somebody wanted to attack this system, attacking TLS would not be the way to do it - the configuration is good enough to make so many other vectors much cheaper attacks. I see the engineer used GoDaddy as the SSL vendor. This doesn't speak well for the budget of the project which has implications for the degree of configuration hardening that was done, which is especially crucial for a Windows machine.

      --
      My God, it's Full of Source!
      OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
    2. Re:Makes sense by sumdumass · · Score: 4, Informative

      http://www.politico.com/story/...

      Actually, that IRS the dog ate my email somewhat failed.

      It turns out that asking IT to look for backups of the email is more productive than looking for it personally. Its just a matter of time needed to sort through it if anyone in government is still interested.

  2. B is the new F? by GAATTC · · Score: 4, Informative

    Funny - I clicked on the link and the rating is a B. No ambiguity about it and not the result of a hasty recent security update (the site was assessed on Sat Mar 07 22:39:37 PST 2015). Where does this headline and summary come from?

    1. Re:B is the new F? by halivar · · Score: 4, Insightful

      IIS with a good config will beat *nix with a terrible config. It's not the tool that the the problem here; it's that the people using it had no clue how.

    2. Re:B is the new F? by Jhon · · Score: 5, Informative

      Interesting. I've got two tabs open -- both to the same URL. I see the following:

      SSL Report: mail.clintonemail.com (64.94.172.146)
      Assessed on: Sat Mar 07 15:10:39 PST 2015 | Clear cache
      RATING: "F"

      SSL Report: mail.clintonemail.com (64.94.172.146)
      Assessed on: Tue Mar 10 09:18:02 PDT 2015 | Clear cache
      RATING "B"

      The difference is Protocol support is zero on the F and notes SSL 2.0 support (automatic "F").

      Looks like somebody fixed something between Saturday and today.

    3. Re:B is the new F? by sycodon · · Score: 4, Funny

      I think Hillary has banned all Blue Dresses from her sight.

      --
      When Fascism comes to America, it will call itself Anti-Fascism, and tell you to give up your guns.
    4. Re:B is the new F? by Penguinisto · · Score: 4, Interesting

      I suspect it was crash-updated recently.

      It was listed as "F" when the story was submitted earlier this morning, but now it's suddenly bumped to a "B" (Assessed on: Tue Mar 10 09:31:29 PDT 2015).

      All it would take is a patch or two to bump it up, I suspect.

      I wonder if one can get the mods to update the submission.

      --
      Quo usque tandem abutere, Nimbus, patientia nostra?
    5. Re:B is the new F? by Just+Some+Guy · · Score: 5, Insightful

      The biggest difference is that no one gives a shit about your toy server, but they might have a fuckload of interest in the personal server of a US Senator and Secretary of State. Yes, I believe that State Department is likely to have better security than the random dipshit she seems to have hired who snagged a cheap GoDaddy cert. It's almost certainly going to have better availability, backup, and disaster recovery.

      It is absolutely, 100% not acceptable to run state secrets through a personally maintained server that seems to exist only for the legal reason of giving the owner 4th amendment privacy rights. An officeholder acting in official capacity should have zero expectation of privacy from the organizations they work for. I'm "picking on poor ol' Hillary" for having every appearance of attempting to circumvent disclosure laws.

      --
      Dewey, what part of this looks like authorities should be involved?
  3. What difference at this point does it make? by WaffleMonster · · Score: 4, Insightful

    In my view assuming there was a need for security the entire fault should lie with state dept allowing emails to be sent and received to and from any domains outside of their administrative influence when conducting "official business".

    SMTP Email always get an "F" security rating no matter what. Checking whether webmail interface has a secure cert is like making sure the front gate of your castle is locked and secured while east and west gates remain open to the creepers at the gates.

  4. Different rules for the ruling elite by schwit1 · · Score: 5, Insightful

    If you treat federal law the way the secretary of state does, you go to prison.
    If you treat IRS rules the way the IRS treats IRS rules, you go to prison
    If you treat immigration controls the way our immigration authorities do, you go to prison.
    If you’re as careless in your handling of firearms as the ATF is, you go to prison.
    If you cook your business’s books the way the federal government cooks its books, you go to prison.

  5. Re:The Clintons by g0bshiTe · · Score: 4, Insightful

    Yet cited email as a tertiary reason for firing the African ambassador.

    If email truly wasn't that big a deal why was that listed as a reason for his dismissal. I realize you tack on as much as you can to make it stick, but still reflects bad on her now.

    Also it's not what every other Secretary of State did, there's a massive difference in setting up a server you own and are the only one to have 24/7 unfettered access vs using a free email provider.

    I'm sure that doesn't fit your narrative.

    So you are aware there was a memo put out by Pres O. 24 August 2012 concerning use of private email for state business. While I'll agree not illegal and a no-no it does show a disregard for following procedures set out by your superior.

    Next up those emails in your inbox purporting member growth work.

    --
    I am Bennett Haselton! I am Bennett Haselton!
  6. Re:The Clintons by mi · · Score: 5, Insightful

    Did not violate any rules regarding email retention

    Yes, she did. It may not have been against the law just yet, but it was certainly against the State Department's own rules already.

    The stupid arrangement left communications of the top American diplomat vulnerable — something Russia and other enemies would be happy to exploit on any day, but fine, a President is not supposed to be proficient in communication security.

    But we should discard public servants at the first sign of hypocrisy — and that's exactly, what's on display here. And here...

    Did what every other Secretary of State did in regards to email.

    Citations needed.

    Hillary is not a bad choice.

    Lovers gonna love.

    --
    In Soviet Washington the swamp drains you.
  7. Re:The Clintons by Archangel+Michael · · Score: 4, Insightful

    To be fair ... Obama just found out about it via the news media (really!!!)

    “The same time everybody else learned it through news reports,” Obama told CBS News.

    Next up? "I will get to the bottom of this"

    Followed by .. "Not a smidgen of evidence"

    And lastly ... "Phony Scandal"

    --
    Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
  8. Re:No Clinton No Bush by khallow · · Score: 4, Informative

    Nonsense. LBJ, despite getting mired in the Vietnam War, had many effective strengths as a politician. I believe here, Jeb Bush is referring to LBJ's ability to get bipartisan support for his legislation. While I don't have a problem with politicians who can "work across the aisle", I find this suspiciously like George W. Bush, who said much the same thing and then abandoned bipartisanship for a significant part of his tenure.

    In comparison, I find Hillary Clinton's casual and persistent corruption and selective rule breaking to be a worse thing than Jeb Bush's choice of role models. Still I wouldn't be broken up, if neither ever was ever elected president.

  9. Perfect, there is surely a backup by DigitalPagan · · Score: 5, Funny

    Now there's no excuse. The NSA should definitely have backups of those emails. Crisis averted everyone.

  10. Re:The Clintons by ScentCone · · Score: 5, Insightful

    Did not violate any rules regarding email retention

    I'm curious. What is your agenda that you think lying about the situation will improve it? I mean, we know that's the historically Clintonian way of handling things when they get busted, but do you really think it helps when other people do it too, when the lies are so obviously debunked?

    The 2009 National Archives regulation requires federal officials to use each agency's established communication archiving systems to retain secured copies of all communication. This federal requirement was very much in effect when she was Secretary of State. She never made arrangements to have her official communications mirrored onto State's servers, and when she left, SHE DID NOT PROVIDE COPIES. She only provided a pile of hardcopies of cherry-picked email printouts once congress discovered that she'd been holding out in violation of the Archives requirement. She got busted, and so she put employees of her family business to the task of pawing through records kept on an unsecure server in her house to decide, with her review, what to pass along. And what a shocker, there are gaps of weeks and months in the records they turned over. This is plain violation of the letter and spirit of the 2009 regulation.

    She went out of her way to avoid keeping public records available while being the second person in line to the presidency, and while roaming the world accomplishing almost nothing as SoS, except for soliciting hundreds of millions of dollars for her family's enterprise from people who are the antithesis of what she weakly proclaims are her main ideological grounds for wanting now to be the president. So even if you still think that makes her a good choice, that doesn't change her deliberate violating of federal regulations - and that doesn't even get into whether or not even ONE email on that system included the receipt or transmission of even one classified item - what do you think are the odds that the Secretary of State, in exchanging email with her counterparts overseas, and with senior officials in the White House (including the president) never addressed even one classified issue?

    --
    Don't disappoint your bird dog. Go to the range.
  11. Re:The Clintons by halivar · · Score: 4, Informative

    I'd say leaving office apparently broke and then making shitloads-times-fuckloads of money later, is a sign of a successful president.

    Well, then President Clinton neatly skirts any accusation of being successful by that metric: http://www.washingtonpost.com/...

    They left office not just with millions, but also with the White House dinnerware: http://abcnews.go.com/Politics...

  12. Re:The Clintons by danbert8 · · Score: 4, Funny

    What about those with a last name and no first? Teller? First president who won't utter a lie?

    --
    Yes it's an anecdote! Were you expecting original research in a Slashdot comment?
  13. Re:I Disagree by Just+Some+Guy · · Score: 5, Informative

    He data also remains under HER control, HER ownership

    That's cute, except that it's not her data. That data is owned by the American people via its government, as are all official communications. When you're an officeholder, you don't "own" your official email.

    --
    Dewey, what part of this looks like authorities should be involved?
  14. Re:The Clintons by WebCrapper · · Score: 4, Interesting

    Looks like news came out today that the White House knew of the private domain issue.

    "Press Secretary Josh Earnest corrected the statement, saying that the president must have known about Clinton’s private account because he [POTUS] had emailed that account for four years while Clinton served as his Secretary of State."

    So, now we have another agency that knows that did nothing as well.

  15. But where is the SECRET-level physical security? by bfwebster · · Score: 5, Interesting

    I had someone who did SECRET-grade e-mails setup in the military write the following to me:

    So, if for example Clinton only dealt with SECRET materials and they were sent or received in her email, all of the equipment (routers, switches, etc.) would have to be rated for that SIPRNet connection. Also, the space in which the equipment and servers and client computers resided in would also have to meet the specifications for SECRET material. This would include various forms of physical access to the space in the form of secure cards, biometrics, etc. No space rated for SECRET opens with a key from the local hardware store. . . .

    The biggest issue I see here would be is if the server was connected to the public Internet and it resided in a non-DoD-approved space.

    Not sure there are biometrics installed in the Clinton home in Chappaqua. ..bruce..

    --
    Bruce F. Webster (brucefwebster.com)
  16. Re:No Clinton No Bush by khallow · · Score: 4, Insightful

    he was as nutty on fiscal policy as modern teabaggers

    What makes fiscal responsibility "nutty"? I find the real nuts to be the crowd who thinks we can borrow as much as we like, while completely ignoring inflation.

  17. Re:No Clinton No Bush by Penguinisto · · Score: 4, Insightful

    ...only $200m from Soros? May want to count MoveOn.org, DU, Being Liberal, and a whole host of other endeavors he and his buddies have been dumping way more money into... not even counting MSNBC, a goodly chunk of CNN, Verio, et al. Also, check in with Warren Buffett; he's good for (probably) at least a few hundred million or more (probably way, way more.)

    Fact is, the system is soaked with money on both sides, so your original point (shitloads of money corrupting/clouding the election process) is valid, but honestly, they *both* suck.

    --
    Quo usque tandem abutere, Nimbus, patientia nostra?