<story><title>Email security on Democratic campaigns is as bad as 2016</title><url>https://www.washingtonpost.com/outlook/2018/09/04/im-teaching-email-security-democratic-campaigns-its-bad/</url></story><parent_chain></parent_chain><comment><author>dillondoyle</author><text>I work in digital D politics professionally. I can&amp;#x27;t tell you how many Congressman use multiple @yahoo or whatever personal email accounts, social, and wordpress accounts with very guessable and repeated passwords. Even the young &amp;#x27;savvy&amp;#x27; ones.&lt;p&gt;And I know this because the creds are shared in plain text with multiple people over email (like me) or put into a shared google doc.&lt;p&gt;We enforce 2fa for our consultancy staff. I would love to enforce it for campaigns but I can guarantee endless problems and troubleshooting especially needy candidates calling because they can&amp;#x27;t figure out how to get their email.&lt;p&gt;Another big problem is shitty wordpress sites filled with plugins. Literally I see $10k sites (FEC reports!) designed using a $100 paid drag and drop theme with even more plugins thrown on top. It&amp;#x27;s a big pet peeve of mine and when I can I move clients to a static plain html site hosted on s3 or similar.&lt;p&gt;My big concern here is if you have write access to wordpress I could see a scenario where you could upload say verification-hash.html and then reclaim ownership of a domain or regain access to email. Or perhaps some turst attack domain.com&amp;#x2F;my-innocent-file-has-virus.file&lt;p&gt;The main D voter file GUI (votebuilder) which all campaigns use to contact voters and work with voterfile data does have 2fa but it&amp;#x27;s still only SMS. This is my real name so I don&amp;#x27;t want to throw too much public shade, but let&amp;#x27;s just say when I have to work with campaign data stored in van first thing I do is export out.&lt;p&gt;ActBlue which is increasingly the monopoly online fundraising app in my experience has good engineering and for me personally they are the only &amp;#x27;tech&amp;#x27; provider for Dems that I jive with (don&amp;#x27;t get me started on NGPVAN or maybe do, but over PM). AB has 2fa token support, though they should make it mandatory given that if you have AB login access you can do a lot of damage (I&amp;#x27;ve actually had this conversation with them about campaign provided js that shows up on donate pages, putting on separate cookie domain, iframe etc).</text></comment>
<story><title>Email security on Democratic campaigns is as bad as 2016</title><url>https://www.washingtonpost.com/outlook/2018/09/04/im-teaching-email-security-democratic-campaigns-its-bad/</url></story><parent_chain></parent_chain><comment><author>matt4077</author><text>Note the plural: &lt;i&gt;campaigns&lt;/i&gt;, hinting at the explanation: There are many campaigns, and they operate entirely independent from each other, at least when it comes to technology infrastructure.&lt;p&gt;The reason for that is something that HN would usually respect, namely the attempt to keep ownership of information. So of course the old discussion about cloud services is being replayed here: &amp;quot;Why would you trust Google?&amp;quot; &amp;#x2F; &amp;quot;Why do you think my small company has better security than Google&amp;quot; &amp;#x2F; ...&lt;p&gt;I&amp;#x27;m pretty sure their next presidential candidate will activate 2-factor authentication etc.</text></comment>