Or it means that the browser doesn't recognise the certificate authority that signed the cert, which is entirely possible. That it works with your browser doesn't mean anything if you aren't replicating…

Depends what else the collective agreement contains, and when it comes into effect. Also, what if a teacher is on parental…

An increasing number of sites (like this one) are going https-only, because it's easier in many ways (and it makes more work for government spy agencies if everything on the net is…

Check if you have a proxy server. Proxies should pass through SSL, if they don't then it's a configuration problem (or a cackhanded attempt to pry).

The MSD…

Anything else I can do to check that, or better, stop it?

The MSD SSL cert looks good today and was renewed on 27th Feb. So somebody is clearly trying to spy on you!

I see other gov't sites had problems…

Surely if the agreement is collective all…

After a little research, looking at Wikipedia, I came up with some interesting facts...
The Ministry of Education's payroll used to be run by Datacom, partly owned partly by NZ Post (35%) until that shareholding was sold to the New Zealand Superannuation Fund for $142m…

#WTFMSD indeed.

found it:
"Trialling it in some schools would have been practically impossible, because of the fact so…

Well that depends! But "I don't want to know!" isn't the head in the sand bit, that's just dealing with shit happening.

I read it as humour. Ministry response, not so much.

Seen several stories now about access permission problems with the system, but not clear if that's technology failure or the human systems around it. Both covered by…

I say that about three times a day. Typically followed by a pause and then figuring out what the problem…

Mr Ng told NBR he has also fired off a series of Official Information Act (OIA) requests in a bid to learn how blogger Cameron Slater got information about the scandal so quickly, and who tipped off Herald journalist Claire Trevett about…

Married to one. That's their default first *answer*.

I understand this is what apple does with its guest account – gets wiped at logout. Ideal for a kiosk type situation.

The best bit is that the specific recommendations from Deloitte will probably be withheld on the grounds that their release would jeopardise the security of the MSD network going forward. Be seen to be Doing Something?…

Then drag on the 'investigation' for as long as possible, and when attention has moved on, possibly to an election, and no leaked…

that has potential

True. I can imagine libraries and other (rare) free public access venues doing the reverse and enabling cloud access but disabling USB ports.

I've seen machines where the state gets cleared down after every user. That would seem more sensible.

There are ways, though only the what to an extent, and very, very little who. Daniel Ayers, who specialises in computer forensics and has been asked in the media about this, has said that he considers my "nuke it from orbit" (love…

Well, the trouble is, anywhere between no-one and zillions of people could have accessed the loose data.…

The speed of the govt's response once they knew publicity was coming suggests they understand…

As one of the "everyone" you're talking about, I hope I haven't posited that I "do know" what happened. I know what could have happened based on what I know did happen and other things I know generally, but I've tried not to…

Review afterwards is sure no substitute for expertise earlier.

and others have said access to that service is blocked anyway. Part of the reason they need USB access for people's CVs I guess.. #doh

Whereas these days Win7 is actually pretty robust. Win95 wasn’t even a proper multi-user OS, which was a huge part of the problems you would’ve faced.
As Paul Craig demonstrates real…

Brings up a good point. Many years ago (10) I worked for IBM as a…

As the push for e-government gathers pace, a basic literacy in the "e" part is a reasonable demand. And literacy is the right word. For people born after the internet, fluency is second-nature.

For many of the more…

that's a software tester. :)

Not even that much. The phrase "grey hat" exists for a reason: they skirt the boundaries of being a black hat while being ostensibly a white-hat. I know more grey-hat testers…

From what I can tell, the basic qualification for…

Classic example where translation would help journos and others. :)

Google. Not so good for context – or technical knowledge.

Network security is not intuitive, which is why what Matthew and others have posted here is so useful. But most of the public…

Even nuking from space doesn't work – the damn taint will cling to the underside as you lift off. You have to actually become the taint, and then kill yourself.

ETA: Oops, correct…

+5 (squizillion)

Replicant mitosis spawn of that pinnacle of Granny Herald journalism Shelley Bridgeman?

In fact, the very fabric of the buildings is probably tainted, they need to rip out the carpets, lino and wallpaper…

That Bennett still retains the confidence of the Prime Minister is…

And ending up with people finding the two indistinguishable?

Not taking drastic action to assure security would be adopting a very hopeful attitude towards reality. Examining 700 kiosks (and that's assuming that none have been…

I know a couple of the security testers who work for DiData, and they enjoy breaking into computers. They're some of the luckiest people…

That would be why security companies spend rather a lot of money to send their employees to hacking conferences, yes. That article is…

I thought DD just did a security audit of the kiosks, and they'd been setup internally. That's stretching my memory of things through this & other comments & articles threads a…

Ugh, beginning to feel all conspiracy theorist or something but again i'm wondering if a big part of the story is where it came from, just like who leaked Ira's name.

The sound of an organisation trying to save both its arse and its face at once.

If that story is the result of a tip from the ministry side, things are getting very shabby indeed.

The vulnerability may have existed for 2 years but that doesn't mean that people have been taking advantage of it since then. Or ever (until now).

Yep, no worries. She's infected me and I can't help but propagate her hambeastery.

No Paula. Average user, with the barest minimum technical skill, from the street can "break" into the MSD internal network. Hacking the kiosks was never required.

The entire MSD infrastructure…

Keith's laptop was a more secure place to have this information than the kiosks. The only thing that was as insecure was probably his memory stick. And he probably tried not to leave that lying around in public areas, unlike the…

Oh, I can imagine. Thanks

The breach is roughly two years old, dating back to when the kiosks were installed. One week is neither here…

The shooting of the messenger? Yes, all over the right wing blogs, sir.

I'm living away from NZ and am late to this news. Firstly, it's of course shocking and great work Kieth for uncovering it.

There are now 22 pages of comments and I am not going to wade through them but I guess someone has already asked some questions…

If you look in a mirror, and say her name three times...

You don't feel like some sport?
:-)
Thinks... fish in barrel

Please don't bring her here

Nah, sorry, removed the link. I don't think I really want us joining the game here.

I was going to say shoes – but there is muach more like attending gatherings of the Clans Bogan, great pairs of Ugg Boots, Distressed Denim and leather jackets with and tassels and so on and such forth.

A walking embodiment of Poe's Law.

Ah. Not a unique thought then.

Omigod.

Actually, you're right and I'm dropping it.

Shitting me. She'd be interesting to interview. #challenge

Kind of a reverse Borat.

http://www.youtube.com/watch?v=IOIRMe17imo

on this MSD debacle, to Keith: fantastic work, what you've lifted the lid on is mind-boggling, thank you.

Again?

No! She'd get confused about the X and do the wrong kind of audition. No one need ever see that again.

Press Secretary in waiting?

I had not encountered Liz Shaw before. She’s amazing!

She seems to have the ability to get the wrong end of the stick on pretty much any issue you care to choose.

On child poverty:

Child poverty – how about getting people employed and off welfare rather than wasting…

Better than that, how about The Running Man (and Woman)?

http://www.youtube.com/watch?v=bwOOkb-FyU8

you got her

I can (almost) accept contrary opinions as long as the facts are kept straight but no:

It's also been revealed that Ira Bailey (from the Uruwera 17) bribed the Ministry. In what world do people…

I've seen far, far too much of her. I have managed to blank it out, though.

good for the sanity

she's always been completely un-self-aware on Twitter, so no

Wow. Just. Wow.

She's taking the piss, right? Satire, yeah? Please tell me she's doing a kind of Colbert Report type of thing...

...isn't she?

Oh, dear . The stupid. It burns. Make it stop. MAKE IT STOP!

Perhaps they were using the Kiosks before. ;) hey the Police are always head hunting, guess they got a bit more than they bargained for.

coat,
getting.....

I have, but not the WPA key, which is printed on the router.

Heh!
Gets ready to watch a family video (from an Aussie cuzzie who doesnt do Skype)-

Ouch. Mind you, I feel like I've been waiting 20 years for this.

My comment to Ben goes just as much to you, then >-|

Gah! 30Mbps = normal here...o goodness! Ire-understanding activcated-

I was puzzled as to how more money would help. They do background checks on applicants now.

Considering the Police have been told they aren't allowed extra money, even though they have gang members trying to join up. It must be starting to look like Police Academy 3 down there in Porirua...

Heh heh. He said "extra money".

Yeah, well, screw you. I have UFB fibre running right past my house, courtesy of the school that's three doors up the road, and Chorus' map shows that we're one intersection (about 150 metres)…

And if it's not about doing more with less – which is on shaky ground given the false economy from replacing public servants with consultants – then it's about installing yes-men in…

Yup, a reasonable usage thingo. I'm on the very, very cheapest plan in the long haul, so it doesn't apply to me, since I've got a bandwidth cap. I'm not a big volume downloader,…

That's where Keith may have done us all a huge favour – more likely now that Cabinet will approve extra money before all the other cross-agency systems are in place, especially Health ones.

exactly

Yeah those are some sharp plans they've just pushed out. However did you read the T&C's !?:

"If, in Orcon's sole opinion, your usage is so heavy that it materially exceeds estimated use patterns…

A rock even less ;p

Come now surely you've changed the default password on your router Ben!

p.s. lucky living in UFB zone bastard

... or a wrench

Copper cable running out of property that carries the call to the provider...not very secure. I'd be glad I've finally got fiber, if I had anything to hide. Then again, breaking in through a window and looking at the…

He attempted it multiple times, something that may not have…

I think the problem was what happened after that. The condition where someone says a Jaffa packet is a million dollars was sufficiently wtf that the next step was unclear. My guess is several people…

Did you add the text "I can edit this file.." and save successfully?

Listening in on analogue was/is literally childs play ("lets keep pressing the 'Channel' button until we hear the neighbours")

DECT (compromised but very specialist) and DSS (secure if implemented correctly)

Classic. So the protocol wasn't "someone opened the envelope to see if…

If I remember correctly…

Yeah, you're right, it's a foolish thing to talk about on the internet, even 26 years after the fact, with the bank no longer in existence.

NZ is a trifle slacker. I've seen cordless phones being used in defence establishments.

Well, there were quite a few people who saw the money, myself included. I also saw the deposits being made. I predicted that it would not work. But truth is stranger than fiction.

Sure, and they didn't then either. The plot thickens, eh?

It could always be worse. I'm just not sure you can show that it would be likely to be worse. Currently, thousands of people could have…

Tempest specced?

Yeah, nah. The story is well known (in banking…

We’ll never, ever know how bad (or otherwise) it is currently, but the vulnerable children database being attached to such an insecure system would have made it more bad. I don’t need to be able to quantify “bad” to…

Whilst at the same time not knowing how bad it is.

Given that I've been broadcast on radio as saying I believe the entire network should be treated as though the ne'er-do-wells have been running rampant since the kiosks were installed, I'm hardly ruling it out.…

This thing has been hanging wide open to all comers for a couple of years. It doesn't really get much worse. You can't rule out that "ne'er do wells" could have done a whole lot already.

In many ways that would have been worse. The illusion of security would have been preserved, Keith would never…

The MSD are spending >$1billion on IT between 2010 and 2014

http://www.msd.govt.nz/about-msd-and-our-work/publications-resources/corporate/statement-of-intent/2011/our-capital-intentions.html

Maybe that's a Programmer / SysAdmin perspective.

Like "how many syllables in coax?"

I can see how that would be the case where physical access…