> as well as Hillary Clinton's use of a personal email server, as a manifestation of a problem with the way we do security: when IT security restrictions are a pain in the butt to comply with, people are going to try to get around them.

Wasn't that more of an effort to get around government records-retention and transparency laws than an attempt to get around annoying and onerous security requirements?

I can see it being both.

My reading, at the time, led me to believe it was primarily a matter of access and facility, for Clinton. She wanted her email "her way", and State technical resources -- perhaps also dependent on cross-agency resources -- could not easily nor readily make it happen.

So, she had one of her own staffers take it rogue, with this server deployment.

Like a lot of senior executives, Hillary Clinton seems to have a pretty big ego and a commensurate attitude that she knows what she's doing.

In a larger context, something that really bothers me about all this: The Chelsea Manning problem arrived around the start of her tenure at State. State, the President and administration, pretty much all the powers that be were outraged over this event.

Again, from my reading, I gathered that the system these data were in was fundamentally deficient with respect to the security needs that were outline. Basically, two levels of acccess, with no compartmentalization nor, IIRC, active auditing -- perhaps much of any auditing or audit trail at all.

Clinton was head of State for the better part of eight years. They remained outraged at Manning and never ceased their push for punitive action.

But she very apparently never tackled and fixed the systems deficiencies that allowed the problem, in the first place.

As her campaign proceeded, I read numerous stories about its fundamental disorganization and corresponding disfunction.

To speak politically for a moment, I'd take this in a second compared to the malicious disaster that is Trump and his crony clown car of an administration.

But neither did she acknowledge, accept responsibility for, and actually work to fix the very tools her and State's work are now founded upon.

Go back twenty years. The intelligence services had a better scoped information collection and analysis system that showed real promise, while also better respecting privacy. Thin Thread.

Dick Cheney gets into the VP seat, and he wants to steer as much business as possible to his cronies. Thin Thread gets shut down, and in its place we end up with various proposals and tweaked formulations for what is called -- I can't remember the program names, right now -- "total situational awareness". That drowns in its own inefficiency, imprecision, and over-collection.

And in the gap, we also get 9/11 and a mis-lead if not dis-ingenuous ramp up to a multi-front war on the other side of the globe.

These people don't care about good, proper systems. They and their agendas vary; nonetheless, their agenda always takes primacy. And, invariably, the shortcuts or biased choices they force through end up costing, down the line.

“These people” such as Hillary, Bush, Cheney, usually started off a mail service outside the Whitehouse to get their campaigns organised. Over time their entire entourage is using that mail server.

Then they get into Government and we expect them to transplant their entire support network into the new environment. That is not going to happen.

What is needed is for the mail server that someone starts up to support their campaign to be secure be default with Whitehouse-level security made easier than not using it at all.

The hard part is getting people to use S/MIME certificates so that messages are encrypted end to end and you never have to quarantine cleartext on your cloud service.

Surely there is an entrepreneur in the HN crowd ready to take this on?

> A trivial example: IT requires users to change their passwords every N days. So users start with "password", and when they are required to change it, they use "password1", then "password2", and so on.

Fortunately in the latest NIST Digital Identity Guidelines this case is explicitly discouraged [1]: Do not require that memorized secrets be changed arbitrarily (e.g., periodically) unless there is a user request or evidence of authenticator compromise.

[1]: https://pages.nist.gov/800-63-3/sp800-63b.html#usabilitycomm...

First of all, NIST - not saying it's useless worldwide, but we're not bound and so it's probably ignored.

Second, good luck until something like this 2017? guideline makes it into the big non-IT corporations, NGOs and governments. maybe 2022? :)

Unfortunately, those people who have enough power that you can't force them to comply are exactly the same people whose data will do the most damage if it is breached.