Nearly all 2020 presidential candidates aren’t using a basic email security

https://techcrunch.com/2019/04/30/dmarc-presidential-candidates/

by sahin-boydas • 7 years ago

67 46 7 years ago

techcrunch.com

lawlessone• 7 years ago

To be fair i don't think the incumbent needs to be worried about that.

idlewords• 7 years ago

Say what you will about Hillary Clinton—at least that woman could run an email server.

lohszvu• 7 years ago

Do you really think she was the one running it?

AdmiralAsshat• 7 years ago

I'd put this in a different category than 2FA, password manager, or basic "watch out or phishing emails" training. All of those things can be enacted by the individual end-user if the organization doesn't enforce it. But it doesn't look like DMARC is something the individual can turn on or off--it's completely on their IT to set it up.

I'm not sure how easy it is to setup, either. Assuming they're paying for Office 365 or G-Suite for outlook/gmail on campaign domains, is that something that Microsoft and/or Google will turn on automatically for you?

heavymark• 7 years ago

With domains registered at Google Domains it's very easy to enable. All domain registers do not support it. Mayor Pete uses GoDaddy and very easy to setup at that register as well.

jrockway2• 7 years ago

To setup DMARC, you add a text record like _dmarc.example.com with content like "v=DMARC1; p=reject" (or perhaps a more permissive or canaried policy).

I am not sure if Google sets it up automatically. I have no memory of setting it up for my gsuite domain... but the record is there. I probably added it at some point though.

The advantage of DMARC against phishing is that people without access to your email server can't impersonate people in your organization. If you tried sending me an email with a "From: jon@jrock.us" header, it would be rejected by my server and I would never see it. This makes it much more difficult to spearphish someone. If you could send an email "this is your boss, look at the From: field, now click my link!", a lot of people would click that link. If the From: field is "spammer@phishing.invalid", you might think twice.

Every little bit helps.

erichurkman• 7 years ago

If you have the domain through Google Domains and set up email through GSuite, they can set up DMARC automatically.

sokoloff• 7 years ago

Wouldn't someone still be able to send mail from jon@jrơck.us and even have it pass DMARC and DKIM checks if they bought that domain? (last o being a ơ [ơ])

I wrote that fake address, I know where the defect is, and I can't spot the difference on my screen right now. It just looks like the other 50 specks of dirt on my laptop screen.

twunde• 7 years ago

Email security enforcement is not turned on automatically, but is relatively easy to set up for GSuite or Office365. Typically the easiest implementation is to create a DNS validation record. With that caveat, SPF and DKIM are easier to setup, because it's just creating a validation record. DMARC typically means that you're now getting 10-20 emails a day from major email providers all containing XML files that need to be analyzed. There aren't a ton of good solutions to analyze the contents of the XML files

toast0• 7 years ago

I set up dmarc some years ago. The xml files are kind of a pain, but you really only need to look at them for a couple days or weeks, then you can remove the reporting address from your dmarc record, because once you're convinced the config is correct, there is no actionable information in the reports.

medmunds• 7 years ago

Postmark has a free service that will handle the DMARC XML analysis for you, sending you a human-readable summary report once a week. (You don't have to be sending through Postmark to use it; I've been surprised at how many spammers attempt to spoof my personal domains.)

http://dmarc.postmarkapp.com/

JetSpiegel• 7 years ago

I can recommend DMARCIAN, it's free for low volume (100k messages per month) domains. They even have a special GDPR-proof site for EU domains.

https://dmarcian.com/pricing/

tombrossman• 7 years ago

Try an online generator such as https://dmarcian.com/dmarc-record-wizard/ to create one. No affiliation, just a well done generator I have used that walks you through the process.

astazangasta3• 7 years ago

I am sure i will get hundreds of downvotes for this but i still dont accept that the Russians targeted the DNC. Wikileaks says otherwise, the only people who examined the servers are a nakedly anti-Russian security outfit hired by the DNC and to date zero hard evidence has been presented this is true. There are so many holes in this narrative, and given the total lack of credibility the press has after the Russiagate collusion story we shouldnt also allow this piece to slip through as accepted fact.

codezero• 7 years ago

I’m not sure the consensus is that WikiLeaks targeted the DNC (it’s not a hacking organization afaik). I believe that Russia targeted literally everyone and released DNC data through WikiLeaks.

Edit: I think OP edited their message.

belltaco2• 7 years ago

There's some substantial evidence.

https://nos.nl/nieuwsuur/artikel/2213767-dutch-intelligence-...

https://arstechnica.com/tech-policy/2018/03/dnc-lone-hacker-...

astazangasta3• 7 years ago

I've read both those accounts. The Dutch intelligence bit is unrelated to the DNC; they claim the same outfit they were surveilling is involved. They did not observe the Russians hacking the DNC. Read the story carefully to see the timing.

As for Guccifer, the evidence indicates he operates out of CST (based on tweets and uploaded file timestamps), hardly where a Russian hacker would be situated.

These are both pretty weak as evidence, not what i'd call substantial.

andjd• 7 years ago

just one presidential hopeful — Democratic candidate Elizabeth Warren — uses domain-based message authentication, reporting, and conformance policy — or DMARC.

Another reason that Warren is my favorite of the democratic candidate right now. It's telling that the candidate with the most tech savvy is also the one proposing to break up the FAANGs for antitrust abuses.

simonh2• 7 years ago

I'm not at all clear what a break up means. How do you break up a monolithic single platform like Facebook? Maybe spin off the messaging stuff but who cares about that? Google is tricky too, you could separate ad-driven search from everything else, but then the everything else bits would just die. How would that benefit users?

Basically picking off bits of the edges of these services is just pointless, but splitting up the core service also seems crazy. It's like splitting up a car company by separating out the bit that makes the engines from the bit that makes the chassis.

I can see it with Amazon splitting AWS from the store, but in that case both would just do fine thank you very much. Again, I'm not seeing any material benefits to anybody. I suppose it's possible profits from the store would be prevented from subsidising AWS, which might benefit competition. This is the only one that makes a lick of sense but it's not really a big problem to fix IMHO.

So what are the actual proposals, or are they just vague pontificating at this stage?

torstenvl• 7 years ago

How is the amalgamation of Instagram, WhatsApp, Facebook.com, Facebook Messenger, Oculus, etc. a "monolithic single platform"?

I don't quite understand how you've come to your "who cares about that?"/"How would that benefit users?" stance. If you're genuinely curious about how preventing monopolies can benefit consumers/users, and not just being rhetorical, I suggest:

https://en.wikipedia.org/wiki/Competition_law

https://en.wikipedia.org/wiki/United_States_antitrust_law

https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3247362

throwbobaway313• 7 years ago

The obvious targets are Instagram and WhatsApp, followed by splitting out the ad network, and any other functionality where Facebook unfairly competes with their customers and locks out competition.

WhatsApp & Instagram should be split out not only due to anti-competition, but for the protection of the general public. WhatsApp's founder(s?) walked away from almost $1bn because they couldn't look themselves in the mirror and keep working for Zucky after his blatant lies about not violating peoples' privacy with WhatsApp. That alone warrants investigation, since Money is the only thing Americans care about.

kristianc• 7 years ago

I'm not at all clear what a break up means. How do you break up a monolithic single platform like Facebook? Maybe spin off the messaging stuff but who cares about that?

Facebook's platform is already pretty well broken up: you have IG, WhatsApp, the core News Feed, Messenger.

Warren's argument isn't so much that breaking the big tech companies up would benefit consumers in itself, but that breaking them up would enable competing services to emerge (in the same way, she argues, that breaking up Microsoft enabled Facebook and Google to emerge).

It's easy to forget now but in 1998 Windows was pushing Active Desktop pretty hard and MSFT were making a big play to make the Internet something which you consumed via the Windows desktop and via Microsoft owned products.

It's not clear that competition neccesarily _would_ emerge from more constraints on large tech companies, but it's probably true that Facebook making a "WeChat" type play would not be a good thing for the Open Web or competition in any way.

SolaceQuantum• 7 years ago

The problem with large tech markets is that they control every aspect of a single industry in of themselves, which allows them to define and change the market to suit themselves best. In the shortrun this is good for the user as Facebook can offer instagram, whatsapp, facebook, messenger, etc. for free- a price that competitors cannot beat with all those features at once.

On the other hand, now Facebook has all of our data and the bar to enter the market to compete with facebook also must apply to all the corollary markets- in other words, there's no qay to have equivalent services without paying the high cost Facebook demands (which is massive user data).

This is similar to when an oil company purchases the means to refine and produce the oil. So an ewuivalent separation would be breaking up the highly integratedness of all to benefit the market by increasing competition on every level of Facebook monolith.

Yes, infact, much of the arguments here is the arguments made when one broke up Standard Oil for example. "But how will this benefit the consumer" is one the biggest arguments against the breaking up Standard Oil.

dsfyu404ed3• 7 years ago

I really like Warren for her anti-trust message and her record of acting on behalf of consumers but I just can't get past a couple deal breakers that are a non-negotiable part of the DNC platform that she has to act toward as part of being a democrat senator and serious democratic presidential candidate. I wish politicians weren't so dependent on the national parties for funding their election campaigns. I would gladly vote for pre-senator Warren.

qzw• 7 years ago

I think it would help if you named your dealbreakers. Imagine if in an OS discussion you said that you like Linux but won’t adopt it due to a couple of unspecified dealbreakers and just left it at that. Most people here would probably consider it borderline FUD.

js2• 7 years ago

I enabled dmarc for my domain about a year ago enabling just reporting. So I get a dmarc report or two emailed to me daily. I have yet to actually check the reports.

Can anyone recommend a free or cheap service or something I can run myself to summarize dmarc reports?

edit: this Quora mentions some free services:

https://www.quora.com/What-is-the-best-way-to-make-an-analys...

And I found this on Github:

https://github.com/techsneeze/dmarcts-report-viewer

Any other recs?

jeffreyrogers• 7 years ago

This stuff is easy to setup (in G suite you can do in in a hour or two if you know what needs to be done), but like most computer security best practices, the knowledge is out there but not well distributed, and not in the hands of the people who need to know it.

lostphilosopher• 7 years ago

I see this as a reflection of the candidates ability to find and listen to experts. I don't expect a candidate to understand how to do tech "right" - I'm in the industry and still get half of it wrong! However, when you're running a multi million dollar campaign you can afford to bring in experts to set this stuff up and audit your practices. In fact, I assume these candidates are already doing this and that if they are still not following some basic best practices it's because they are actively ignoring the experts they brought on to help them. That's what worries me. If they can't find or listen to these people now, what makes me think they'll be able to in office? (Related: "The internet is not a big truck...")

dontbenebby• 7 years ago

I see this as a reflection of the candidates ability to find and listen to experts.

The problem isn't finding experts. There's a lot of smart, well intentioned people in DC. (For example, everyone I met from 18F impressed me greatly, and nonprofit organizations like Mozilla have a presence in DC)

The problem is that both congressional offices and political campaigns are extremely hierarchical.

The culture in a political campaign or senate office is that junior staffers are supposed to be given orders and figure out how to implement them - not suggest different sets of orders.

daveFNbuck• 7 years ago

It's easy to find experts, but not everyone does. Some politicians prefer loyalty to expertise. At least one candidate was able to overcome the hierarchy of her campaign and get basic email security.

bluGill2• 7 years ago

Was that luck though, or active intent.

Nearly all 2020 presidential candidates aren’t using a basic email security

Related Stories