Post #1769327

2026-04-29 07:41 UTC

@s4mmy @radieschen @davep @ahltorp @jtb honestly, I find it unreasonable to *not* set higher standards for people in such an exposed office. Again: I am all for structurally preventing attacks where possible. But at the same time, these are not random people, they are under far more scrutiny and are much higher value targets for attacks like these. IMO this needs to be part of their threat model. I don't think we'll reach a consensus, here if we can't agree on that.

Replies (2)

@radieschen@climatejustice.social 2026-04-29 08:26

@claudius the only thing I'm disagreeing with in your reply above is that I don't think they should get help, I think they should be trained. Because people like that need to have better than average op-sec, it *must* not be their responsibility. The problem is so huge, *everyone* needs to be made aware of common threats. Structural problems need structural solutions. Relying on individuals to be aware they have to educate themselves can only go wrong. It's only a matter of when, IMO. @s4mmy @davep @ahltorp @jtb

Open ##1769328
@davep@infosec.exchange 2026-04-29 11:19

@claudius It's definitely part of their threat model, whether they recognise that or not. Frankly, due to this, they should be using a modified version of Signal for government officials that removes the risk of this sort of account takeover. @s4mmy @radieschen @ahltorp @jtb

Open ##1774100