Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 



Forgot your password?
typodupeerror
Check out the new SourceForge HTML5 internet speed test! No Flash necessary and runs on all devices. ×
Republicans Security Democrats Government United States Politics

2016 Presidential Candidate Security Investigation (infosecinstitute.com) 97

New submitter Fryan writes: InfoSec Institute has assessed the security posture of 16 of the presidential candidates' websites. This is an indicator of the level of security awareness the candidate and the campaign staff has. The recent breaches and security lapses of high profile individuals highlight the absolute need for everyone to take security awareness seriously. The hacking of the Director of the CIA's (John Brennan) personal email account, and the storage of classified emails on a personal email server with Hillary Clinton, show how damaging a lack of basic good security hygiene can be. In this survey (of only the best known presidential candidates, not the scads of others), the authors give both their highest grade (an A) and lowest (a D) for candidates still in the race to two Republicans, Ben Carson and Jim Gilmore, respectively; surprising for a tech-focused campaign, Lawrence Lessig (who has ended his candidacy since the survey began) ranked even lower, with a D-.

Speaking of presidential candidates, the fourth Republican debate, hosted by Fox Business, will kick off about an hour after this post goes live (9:00 PM Eastern, 0200 GMT). Feel free to discuss it alongside the security report.
This discussion has been archived. No new comments can be posted.

2016 Presidential Candidate Security Investigation

Comments Filter:
  • I'd love to see the site ratings there folks..

    • Never mind.. I found it... Cool PDF with lots of detail... Hacker's dream if you think about it...
  • I know that no one reads TFA, but at least link to the source. I'm assuming it's the following article: http://resources.infosecinstitute.com/doesnt-any-presidential-candidate-know-how-to-secure-wordpress/ [infosecinstitute.com]

    However, that data points to Democratic candidate Jim Webb as having the highest rating with an A- and doesn't include Ben Carson at all.
    • by bws111 ( 1216812 )

      The link [infosecinstitute.com] is right next to the title, like is has been for all Slashdot articles for a while.

      • by DrXym ( 126579 )
        The new design sucks and it's hardly surprising that people don't know where to look for it. It's so anti-intuitive it reminds me of the way Facebook, Google etc. put links they'd rather you didn't use in places where people least expect them to be.
    • by Anonymous Coward

      "Requires HTTPS" as a positive... Site critiquing uses plain HTTP... Try HTTPS and the site is using a certificate for wpengine.com instead of a valid certificate.

      What a joke.

  • The short report claims that username exposure and login page exposure are vulnerabilities. But if you don't expose usernames, how do readers track to whom each comment in the comment section belongs? And if you don't expose a login page, how do posters track which of their comments have been replied to, and how do users manage their subscriptions to various newsletters?

    • Hi, I'm Jonathan Lampe, the author of the original research.

      >> if you don't expose usernames, how do readers track to whom each comment in the comment section belongs? And if you don't expose a login page, how do posters track which of their comments have been replied to, and how do users manage their subscriptions to various newsletters?

      NONE of the presidential campaigns were using any any self-registration or comment features of WordPress. (You'll see "registration" as a column in my WordPress

  • Really? (Score:5, Informative)

    by TWX ( 665546 ) on Tuesday November 10, 2015 @08:56PM (#50906047)
    From TFA:

    InfoSec Institute has assessed the security posture of 16 of the presidential candidates' websites. This is an indicator of the level of security awareness the candidate and the campaign staff has.

    This assertion is false. First, the candidate has other things to be concerned about. His IT staff, who will probably not follow him to the political office if he's elected given the nature of government bureaucracy, handle it. Second, a web site is a glorified poster and graffiti wall. It's there for John Q Public. Media organizations are provided with itineraries and possibly with the contents of speeches and other material directly, they do not have to go to the candidate's website. Third, any maliciousness done to the candidate only serves to strengthen the candidate, as those who were already in-favor of the candidate will not lessen their opinions based on a website hack, and those who were undecided may sympathize with the candidate after such an attack. Fourth, given the propensity for semianonymous abuse of comments sections, the candidate's staff already have to peruse comments to moderate/censor, so long-term abuse that could paint a candidate as something that they don't want to be is unlikely.

    If you want to know how a candidate handles security, follow how they handle money, and how quickly they return contributions that come from undesirable sources, or how they handle public appearances and interaction with specific persons. At this early stage that's probably more of a tell than any website.

    • Re:Really? (Score:4, Informative)

      by ftexperts ( 2042636 ) on Tuesday November 10, 2015 @10:23PM (#50906349) Homepage
      Hi, I'm Jonathan Lampe, the author of the original article.

      >> If you want to know how a candidate handles security, follow how they handle money

      I started my research after I noticed that most of these sites DO handle money, either through merchandise stores or donations. My original report (http://www2.infosecinstitute.com/l/12882/2015-10-19/zbwt6/12882/121089/2016_Presidential_Hacks.pdf) dug into how the top five candidates handle money on their web sites; it looks like most of the links in this thread are reading my SECOND bit of research about who's using WordPress and how badly it's been configured (http://resources.infosecinstitute.com/doesnt-any-presidential-candidate-know-how-to-secure-wordpress/).

  • by hsmith ( 818216 ) on Tuesday November 10, 2015 @08:57PM (#50906055)
    Why not evaluate the candidate shitty policies on information security? Like Carly who can't grasp math and is in favor of back doors into software and encryption.

    What a stupid "investigation"

    Even their page doesn't have SSL by default, when you go to the HTTPS site, it uses outdated encryption even with a modern browser.

    http://i.imgur.com/de0eBK8.png [imgur.com]
    • by Anonymous Coward

      Why not evaluate the candidate shitty policies on information security? Like Carly who can't grasp math and is in favor of back doors into software and encryption.

      Or Hillary who thinks carrying two phones is so much a hassle, security should take a backdoor.

  • ...the last time I was actually interested in an article on Slashdot. I used to read 4-6 a day... way to go DHI.

  • Donald Trump just said, "Wages are too high."

    Discuss.

    • Re: (Score:3, Funny)

      He's right. Politicians get paid too much

    • and Trump is Right Again. wages ARE too high. reading /., i expect the robotic revolution to reduce wages to 0.
    • Donald Trump just said, "Wages are too high."

      Discuss.

      Whose wages are too high?

      I'm sure he doesn't think his own wage is too high.

    • Re: (Score:1, Troll)

      by OzPeter ( 195038 )

      Donald Trump just said, "Wages are too high."

      Given that the Donald wants to force Christian law the entire USA (EG "If I become president, we're all going to be saying Merry Christmas again, that I can tell you," ) on top of everything else has previously said, I have no idea how anyone can take him seriously anymore.

      • We're not the MSM (Score:5, Insightful)

        by Okian Warrior ( 537106 ) on Tuesday November 10, 2015 @10:32PM (#50906387) Homepage Journal

        Given that the Donald wants to force Christian law the entire USA [...]

        This is what I *hate* about political debate in this country. It's all sock-puppetry by people making unbased predictions about the other candidates. In previous elections, it started about 6 weeks before the election. At 2 weeks before, it reached fever pitch.

        Everyone and their dog argues back and forth "if *the other guy* get elected, they'll eat your babies and cancel Christmas!!!"

        Don't tell me what they *want*, and don't tell me what they'll *do*. Tell me what they *did*. Tell me what they *said*.

        Base your rhetoric on concrete information - what people have *done* and *said* - and maybe I'll listen. Saying that the democrats will raise taxes, that the republicans will kill social security, is simple guesswork by "some dude on the net".

        Trump said "wages too high", that's true - but what were the previous 3 words in that sentence?

        The totality of what he said, all six words and the following words to the end of the sentence, are worthy of discussion. The excised 3-words are not - that's just a childish emotional appeal.

        OH NO!!! Trump wants to reduce our wages!!!

        We're not the mainstream media, we're better than that. Let's have an honest and real discussion instead of childish pot-shots.

        • Re: (Score:1, Troll)

          by PopeRatzo ( 965947 )

          Don't tell me what they *want*, and don't tell me what they'll *do*. Tell me what they *did*. Tell me what they *said*.

          Here's exactly what he said:

          "If I become president, we're all going to be saying Merry Christmas again, that I can tell you."

          That is the entirety of the quote.

          Let's have an honest and real discussion instead of childish pot-shots.

          Translation: "It's not fair to quote Republican candidates, because it makes them look stupid."

          And here is the entirety of Trump's quote regarding wages being "t

          • Re:We're not the MSM (Score:4, Informative)

            by Okian Warrior ( 537106 ) on Tuesday November 10, 2015 @11:37PM (#50906649) Homepage Journal

            "If I become president, we're all going to be saying Merry Christmas again, that I can tell you."

            And you translated that to "force Christian law the entire USA".

            Please stop posting political pot-shots. You're not very good at it.

            • by Anonymous Coward

              No, OzPeter did - you got your posters mixed up. PopeRatzo opened the thread with an invitation to discuss Trump's assertion that wages are too high, which doesn't seem like an unreasonable topic, even though I hardly ever agree with PopeRatzo on anything. OzPeter chimed in with a baseless extrapolation of Trump's quip about "Merry Christmas" greetings, which arguably is a political pot-shot.

              With respect to "wages are too high", it came right after "taxes are too high", so most of Trump's supporters will

            • by dywolf ( 2673597 )

              its not the first time he's parroted the 'war on xtians' bullshit

        • by Anonymous Coward

          Trump REALLY REALLY did say that. It REALLY REALLY means what he says.

          Just because it shows the clown up to be the idiotic crazy man he is, YOU have to assume it's unsupported scurrilous attack.

        • by dywolf ( 2673597 )

          you could reduce taxes to zero, and it still wouldnt compensate for "wages too high".
          youre a fool to cheerlead for the fool with the hairdo

    • Can you provide more context for this one sentence quote?

  • I really don't see what this says about the candidates, other than which ones hired better webmasters. If a candidate has a shitty, unsecured website, that doesn't really say they don't understand or care about security, it just shows they didn't pick a webmaster who does. And how knowledgeable on IT security do we expect the POTUS to be? We don't usually blame the CEO of a company when their website is hacked.
    • by AHuxley ( 892839 )
      If the IT staff are internal to the candidate and creating a very good web 2.0 page much could be deduced about the rest of the staff.
      Spending and advance skill sets usually do not occur in just one part of a team.
      ie what will the rest of the campaign staff be like, get-out-the-vote strategy, ability to track big-name donors, finance team database.
      How can computer lists best help supporters and paid staff track voters, ads? That needs a really good, dedicated IT team. How and where to be buying adverti
  • How can this be considered worth reading if it does not even look at Rand Paul. Clearly this was created by the joint Republican/Democratic party.
    • How can this be considered worth reading if it does not even look at Rand Paul. Clearly this was created by the joint Republican/Democratic party.

      I thought Rand Paul was a Republican. I guess you wouldn't know it by his polling numbers, though.

    • Hi - Jonathan Lampe, original research author here.

      Round 1 of my research was about the "top five candidates" and Rand Paul wasn't included. Round 2 was about candidates that ran WordPress, which covered Bush and Sanders from Round 1 again and picked up about a dozen more candidates, but still didn't include Rand Paul. I hope to circle back around to Paul, Cruz, Rubio, Fiorina and anyone else I missed (Christie?) soon in a "not top five, not running WordPress" third round of research soon.

      My initial take?

  • Carly Fiorina just said we need "Uber, but for health care".

    Thoughts?

    • Re: (Score:3, Interesting)

      by Anonymous Coward

      Carly Fiorina just said we need "Uber, but for health care".

      In theory, the Democrats are generally more compassionate so I feel a certain social obligation to vote for them. But, on the personal issues that matter to me, the centrists Democrats have made a lot of unforced errors.

      As a biomedical research scientist who values individual freedom, Obama's stifling of (direct-to-consumer) personal genomics - e.g. what the FDA did to 23andMe - is going to make it very hard for me to vote for any of the "centrist" Democrats.

      There are other countries in the world where spee

      • by drinkypoo ( 153816 ) <martin.espinoza@gmail.com> on Wednesday November 11, 2015 @06:37AM (#50907467) Homepage Journal

        As a biomedical research scientist who values individual freedom, Obama's stifling of (direct-to-consumer) personal genomics - e.g. what the FDA did to 23andMe - is going to make it very hard for me to vote for any of the "centrist" Democrats.

        As a person concerned with privacy, I cannot imagine why anyone would use 23andMe.

        One of the reasons I voted for Obama was that he was billed as a scholar of constitutional law - who would presumably believe in freedom of speech

        Don't presume.

        Supposedly Obama deserves all kinds of credit for reforming healthcare in the USA, but all he really did was layer on additional bureaucracy

        That's what government does.

        Would the Republicans be better? Probably not. But the centrist Democrats sure ain't heroes either.

        Correct. They're mostly a bunch of assholes. People with the courage to actually be far-left (or even far-right) are typically drummed out of government in a hot second.

  • Is Jim Gilmore really a candidate? He seems to be the only one who believes that.

  • Rand Paul but nobody is going to vote for him because they're obsessed with pop culture relics telling them otherwise. Weeeeeelp!

    • by dywolf ( 2673597 )

      not going to vote for him because he's a libertarian of principle when convenient,
      and a serial flipflopper that abandons those principles when pressured.

      • by dywolf ( 2673597 )

        explaining why he was wrong about why i wouldnt vote for Rand Paul isnt trolling.

        and neither is pointing out that he's pretty much like every other politician ever,
        despite his 'libertarian' label.

      • by dywolf ( 2673597 )

        here's a (woefully incomplete) list of said flipflops:

        Rand Paul, serial panderer: 5 major flip-flops that reveal his brazen hypocrisy
        http://www.salon.com/2015/05/2... [salon.com]

        • Hypocrisy is not going away as long as there are politicians, much less from anyone under pressure but he is still the least hostile towards civil liberties than any of the other candidates.

          Hilary is just going to continue the problems Obama started. Donald trump is going to give to big business and screw the average worker and one of those two are the most likely to be elected.

  • I pulled up the report and saw Carson had an 'A' site. Out of curiosity, I found the site. they stated it had no store. What thu heck is this: http://store.bencarson.com/ [bencarson.com]
    • Hi - I'm Jonathan Lampe, the author of the original research.

      >> they stated it had no store. What thu heck is this: http://store.bencarson.com/ [bencarson.com]

      That's new to me; I did the research a full month ago and there was no store on Carson's page then.

      A quick look at Carson's store shows he's using a skinned instance of Shopify. Security-wise, I still think Carson's approach (brand a white-labeled version of an established ecommerce store) is a wise choice vs. the approach that some campaigns seem to have made

      • How is that not the same as:

        Meanwhile, a different candidate rapidly built a large and complex web application that could have several undiscovered vulnerabilities (security experts call this a “large attack surface”). And not a single candidate returned my attempts to contact them about possible security vulnerabilities.

        ?

        Isn't Shopify a large an complex web application. Has anyone done a security audit on shopify or reviewed its source code?

        • Jonathan Lampe (research author) again. These are good questions.

          >> Isn't Shopify a large an complex web application.

          Yes, like Hillary's site, Shopify is large and complex.

          >> Has anyone done a security audit on shopify or reviewed its source code?

          At the risk of sounding like a shill, I feel better about Shopify's security than Hillary's because:
          1) Shopify has a process to contact them about vulnerabilities (https://www.shopify.com/security-response) - Hillary didn't respond to my inquiry
          2) Shop

  • When you think about it, the government email servers are giant targets for hacking. Its not often reported, but the government systems get hit and experience a lot of downtime. A private, properly secured email server would get far fewer attacks and could be more stable. Just sayin'

"Never face facts; if you do, you'll never get up in the morning." -- Marlo Thomas

Working...