I totally agree. I ran into this myself fighting with high-assurance vendors over the tech that was limited to defense only. I said, "We have infrastructure, banks, I.P., and so on to protect. NSA's pentesters & certifications say these are only devices that can stop even them. These are American businesses, not foreign spies. Background check them, whatever, just get them security that works." Replies were always courteous denials on grounds of national security. That's despite that each system usually had tens of millions in taxpayer-funded R&D or nearly guaranteed contracts to get it started.

In all my time studying NSA's IAD, I could never be sure if this was just organizational issues or straight subversion. Snowden leaks made that harder rather than easier. Bell, of Bell-LaPadula fame, has a nice write-up of how they helped create high-assurance security market then destroyed it over time.

http://lukemuehlhauser.com/wp-content/uploads/Bell-Looking-B...

The A1 products he referenced still exist but government doesn't push them for rest of us. A NOBUS thing I guess. SNS Server (MLS LAN) is defense only, not sure about XTS-400 (now XTS-500 w/ Linux apps), and Aesec's GEMSOS might be available to commercial sector. I forgot to ask for clarity on that. Nobody outside high assurance or good CompSci has ever heard of them. Bleak picture for anyone investing in next high-security product, ain't it?

Nice, albeit biased, presentation on methods behind GEMSOS & old school high-assurance.

http://www.iwia.org/2005/Schell2005.PDF

Holistic, pub-subscribe architecture leveraging SNS Server as "impenetrable" component to simplify overall scheme. That's overstating it but it's allegedly unbroken in field since released in early 90's. Embedded firewall is another old trick you can do today w/ Octeon II's or similar PCI card computers.

htttp://www.dtic.mil/cgi-bin/GetTRDoc?AD=ADA425566

When it comes NSA pen testing, its not that some things are "impenetrable" its a question of how far they are willing to go, and who they are willing to p__ off to do it.

There are limits, both legal and political, that the NSA won't cross but a private contractor doing pen testing might try.

Rightly or wrongly, about the only way most US private companies can get a proper grasp of what the NSA is capable of is to hire a senior former NSA officer.

http://ironnetcyber.com/executive-team.html

This is possible. However, I read many of the papers and Final Evaluation Reports from this time period. They usually found the common and some uncommon flaws in systems with feedback to vendors. One of a UNIX aiming for higher assurance heavily criticized its lack of hardware-level enforcement and architectural issues. They also standardized on assurance and design techniques with similar re-applications to ensure what worked before would again. Evaluations were done by people from private labs and NSA's IAD hackers sometimes repeated by other groups.

So, altogether, they probably got plenty of review. They could still use more from independents with great skill. So far, though, solid in review and the field in high risk is saying something.

Re hiring a former NSA officer

Others and I have been telling all of you for years what they're capable of. You just look at each layer or compondnt to see what a subversion/breach would do. Then read years of papers showing how to avoid those. Then notice what each product is or isnt applying. Then you know they were breaking almost all of it. ;)

And now I have a mountain load of further reading :-) thanks!

Any time. It's one of the things I'm good at. :)

> Someone should find who denied Clinton access to a secure BB, then they should be removed from any security related work.

What you are saying is that they should be removed from security related work because they don't understand people.

OK, but that also means Clinton should be removed from security related work because she doesn't understand security.

Can she act as president without any access to anything secret or classified? It would be hard, but that's the standard you are setting.

That's an invalid argument. I am indeed saying that they should be removed from security related work because they don't understand people. However, it doesn't necessarily follow that Clinton doesn't understand security. In fact, it sounds like she was advised that she needed a secure BlackBerry, but was denied it but never given a reason.

All that you have shown here is that the people tasked with securing sensitive information failed to do so.

If Clinton becomes President, then she'll be provided with a secure mode of communication, regardless of what the security person thinks of it. So as President, she'll be able to access secret and classified information.

She has shown she can not be trusted to listen when told "What you are doing is not secure".

Not having what you want, even when you have a right to it, is not an excuse to do it anyway.

Either she does understand security, or she doesn't. Which is it, in your opinion? Genuinely curious.

She doesn't care about it. Which to me means (i.e. is caused by) "doesn't understand [the need] for it".

She probably says things like "it's fine, it's secure enough".

I have a hard believing anyone would understand it and still not care.

>So now those same security people caused a considerably greater threat to national security.

The logic here is that one adult's actions can be blamed on a second adult if the second adult doesn't allow the first one to get their way. Now imagine applying that to other situations.

People really need to stop trying to form syllogisms that, completely devoid of context, are supposed to lead to some sort of useful conclusion.

The world is full of grays, and not everyone's jobs, actions, abilities, and powers are equal.

If the context is relevant, it needs to be explicitly denoted. To otherwise expect context to matter when it cannot be made part of the argument is special pleading. Even if it is popular to use special pleading in day to day life does not mean we should accept it as valid.

That's not a reasonable requirement. You simply can't write rules that apply to every aspect of day to day life that may be relevant for situations you may have not even anticipated might happen.

You can try, and that's typically what organizational policies aim to do. But once you've set a policy, pretending like it's some sort of infallible divine guidance is asking for failure. Good security policy needs to always be reacting, always considering whether the rules they've set are still a net gain in the security of the system, given that they're operating in a real world of real people with real behaviors that may not have been accurately predicted.

It feel the same about these modern chip based credit cards. While giving a totally intangible security benefit these cards have brought great discomfort to everyone. A swipe takes around 1 second to register. Chip based cards take anywhere from 5 to 9 seconds with the message "do not remove card" flashing in between. Machines are designed such that you have to insert card in a slit you cant see, I have seen elderly people struggle to do that and cards falling out on floor creating more delays.

I really wonder if the wasted human time is worth saving handful of frauds.

To be honest: This is more based around the terminal designers, both hardware and software, than anything else. For far too long, the designers have been shit hardware and software while charging an insane premium. The cryptography required for processing chip transactions requires more horsepower yet the exact same hardware specs are being used.

Furthermore, the chip is not only protecting from cloned cards, but also protecting from the vast malware breeches that occurred at Target, Home Depot, and more.

The decision is right. The crap the processors are pulling with their terminal designs is not. The processing market is ripe for someone to break formation and accept smaller margins in return for a well designed and faster terminal.

Are you saying people who designed the secure chip card have no say in the terminal technology. I don't know the details but I suspect that the terminal also needs to have sufficient security mechanism isn't it ?

I still find it bizarre the USA is only just dealing with this - the UK and most of Europe moved to chip and PIN years ago, and are now increasingly rapidly moving to using contactless payments.

I'm American and I find it bizarre too.

What really baffles me is how inconsistent the rollout has been. Chip-capable terminals are everywhere, but maybe 3/4ths of them don't have the chip part enabled. So many times, I've inserted my card only to find that it simply doesn't work. Yesterday I made a purchase where they had taped over the slot so you wouldn't even try.

It seems like once you have the hardware, the rest should just work. I don't know what the hell is going on.

I was at a place the other day with a taped over chip slot, with a little note saying "please swipe". I asked what the deal was, and the guy said all chip purchases were being double billed (apparently due to some software issue). I commented, "at least they were being securely double billed". Chuckles all around.

I was in Iceland 2 years ago, and I could not get fuel for my rental car anywhere with my chipless and PINless card, and had to pay a large amount of money to have the agency fill it. Even though the USA has finally started to roll out chip based cards, half the places I go to have the chip slot, but say to swipe instead. It is confusing. We also still do not have PINs so if your card is lost, it can still be used for fraud.

Australia has had this for the last year or so. It's remarkable how far behind the U.S. has fallen on this issue.

I disagree - I'm in the UK where these have been standard for a long time (I've had cards for around 6 years or so, and I have only ever used the old swipe when travelling).

My experience is that it takes way less time (I'd say 3-4s, maybe it's a connectivity issue?), and (comparing to what I have done travelling and memories from watching my parents in childhood) any time you did save with a swipe is instantly eaten up by signing taking far longer than tapping in a pin (not to mention the magstripes wearing out faster than the pins).

As to 'saving a handful of frauds' - I was shocked at the ease of fraud in the old system. When I was in the US, I felt uncomfortable with the staff taking my card (here in the UK, it's always in my hands) - often taking it out of my sight, and a colleague had 'Please ask for ID' rather than a signature on his card - he never once got asked for it, implying that the signature check is valueless, because apparently no one does it.

The US doesn't have chip-and-pin, we have "chip-and-sign", plus the older magstripe system (and the CC number is still necessary for online purchases).

As of this spring update I'd estimate vendor uptake is about 30-50%. So half the time you either swipe and wait 2 seconds for it to beep that you need to insert, or you insert and wait a couple seconds for nothing to happen and be told to swipe. The chip mode is poorly integrated into many POS systems - at most local groceries even if you tap "card" and insert the card it will make you go back to the screen and push "card" again, or take several seconds before it accepts it. Then it processes for ~5 seconds, then you need to sign.

Some of this is teething issues with rollout and POS integration, but the signature is unfortunately not going away.

I'm sorry, but I'm having a hard time relating to this. In Sweden, we have had chip cards for a very long time (it feels like), and I've never heard anyone complain that it takes so much longer than swiping. I guess you're in a country where it is relatively new?

Could it be that your card readers are somehow worse compared to the ones we have here, which makes it more painful to use? Could it be that here we always use a PIN code as well, so that takes a bit of time anyway, and you do not?

GP is probably in the US, like me, where chip and PIN is pretty new. I can confirm that it tends to take a lot longer than swiping; I still do a lot of both swiping and chipping, so it's easy to compare.

In other countries, chip based credit cards have reduced in store fraud by about 75%. This is a lot more than a "handful of frauds".

That said, make one thing harder, they find another avenue in. I'm voting for cameras that read your physical card while it is in, then the fraud is conducted online. (Downside of that for thieves being that now they have to give out a working address.)

Does it allow the credit issuers just to shift the blame to the end-users and deny 75% of fraud claims where the user could not adequately prove they were not present at the time and place of the fraud?

No. The default in the USA is that consumers are not liable for anything that consumers claim they didn't buy, and the company can't prove they did.

The reason it reduces crime is that you can't make fake credit cards with data collected from a skimmer, and use them in stores. Your fake credit cards fail because they can't do the chip interaction. Therefore in store fraud is reduced to people physically stealing your credit card.

Why is this comment being down voted? This system is an embarrassment. The improved security measures are important but there's no excuse for it to come at a cost of a worsened user experience.

> Someone should find who denied Clinton access to a secure BB, then they should be removed from any security related work. I almost feel sorry for them if Clinton becomes President, because their days will hopefully be numbered. But I don't feel sorry, because their short-sightedness caused a greater risk to U.S. National Security.

If you'd like to fire your security people who are too paranoid and obstinate, you'll find yourself without a National Security Agency. You should give them a manager who does understand people.

No, Clinton's reaction caused a threat to national security.

"Mr. President, those NSA guys won't give me a BlackBerry like yours."

"Hillary, that's ridiculous. I'll have someone call Admiral Bigwig right away so you can get some BlackBerry."

And if the President doesn't help you, you had better learn to sit in the SCIF or, better, do whatever previous Secretaries did to keep informed without BlackBerries. Clinton is responsible for her actions. Nobody made her set up her own email server.

> do whatever previous Secretaries did to keep informed without BlackBerries

Which was probably about as insecure.

There's nothing quite like neutering the Secretary of State to improve National Security.

You're still missing the point. She may have gotten the job, but she didn't manage to get any love her new boss. When he got the new toy, he made sure the ID department told her to go pound sand.

I sincerely hope he hasn't changed his mind, and will not stand in the way of her indictment.

I would hope you'd also agree that if the people who didn't give Secretary Clinton the specific mobile device she wanted should be removed from security-related work, then so also should Secretary Clinton.