Hacker News new | ask | show | jobs
by rmrfstar 1994 days ago
These responses are over the top. The photo of the congressional office that is circulating shows a wireless Logitech keyboard and mouse, and an unlocked workstation. That tells a pretty damning story about the ambient level of security awareness in congressional offices. Congress has a very serious technology competence problem. Probably a better long term strategy to focus on that.
3 comments

I agree. The risk from this intrusion is not a whole lot different (and considerably more overt) than from the access that any number of other people have had to this building in the past. (Tour guides, visiting civilians, contractors, cleaners, ...).

Professional attackers were not waiting to follow a Jamiroquai knock-off around during an event whose CCTV footage will be heavily scrutinized.

(See for example (50 years ago) https://www.nytimes.com/1988/11/15/world/the-bugged-embassy-...).

This may be a good incentive to review policies such as full disk encryption and proximity-card workstation lock/unlock but pulling miles of CAT-6 from this building is not a sensible response: defenses _should_ already account for this sort of threat. If purple team has not already "what if"'ed this particular variant of the evil maid problem then that's a serious issue but clearly weak physical security was already a known feature of the threat model.

What makes you so sure said workstations had any significant value or access worth locking it down like it held the launch codes or something? According to one of the replies in the tweets you linked, pretty much everything would have been open information anyway.

All this talk from random internets about how "terrible" their infosec is strikes me as a bunch of armchair quarterbacking by people who think they know a lot more than they do... so basically your typical tech worker I guess.

I'd rather they not focus on security. I'd rather everything they do with their computers is live streamed all the time really.

Their incompetence isn't any different than the average person in the work force, and they shouldn't be keeping secrets anyway.

I'm sure some replies and downvotes to this will think I am crazy because they have important secrets like terrorism intel etc, and yes I understand that, but continue to disagree. I believe a nation could function just fine without secrets. It would simply be different. We don't a good job with the secrets anyway.

Terrorism intel is the least of my concerns with your proposal.

IMHO, privacy is a key part of negotiation, creativity, and planning. Lack of privacy would make it difficult for them do their jobs well or (more likely) drive them to use unofficial, private channels.

Sometimes a deal or a new idea needs a "safe space" to grow.

I assume you are a programmer (this is HN). Do you think operations at your company would improve if everyone's screen was constantly broadcast to management? Personally, I'd prefer to be judged on my job performance, rather than having some non-engineer decide if I'm doing a good job based on their impression of what's on my screen.

The legislative record and public statements of our congressmen are almost always enough to evaluate their competence.