Local Encryption ... Why Not?
-
@BRRABill said:
@scottalanmiller said:
Here is someone fearful of encryption ending up, by accident, acting like a threat: http://community.spiceworks.com/topic/1357724-de-encrypting-network-shares-server-question
I never said there weren't risks.
You always have to have systems to get around the encryption for your own uses, and also good backups.
But if there are risks, that answers the "why not" question. It's only in cases where there is no or effectively no downsides (good examples are virtualize every server and open sources is always better than closed source for end users) where you don't have to weigh the options. But with encryption, it's not a clear win. The weighting leans heavily towards encryption, I grant you, but there are downsides strong enough to warrant needing to consider if it is truly adding enough to make up for what it takes away. It remains situational.
-
@scottalanmiller said:
But if there are risks, that answers the "why not" question. It's only in cases where there is no or effectively no downsides (good examples are virtualize every server and open sources is always better than closed source for end users) where you don't have to weigh the options. But with encryption, it's not a clear win. The weighting leans heavily towards encryption, I grant you, but there are downsides strong enough to warrant needing to consider if it is truly adding enough to make up for what it takes away. It remains situational.
True, though as I have said (and as the recent article posted from InfoWorld) if we can somehow move to a world where everything is encrypted, and there is little cost, that would be ideal, I think.
-
Considering the current political climate - I'm wondering how long until HIPAA is repealed because of it's leanings toward encryption. LOL
I say this in complete jest, but damn.. those fools!
-
I'm really torn in the discussion of a governmental backdoor to all encryption, as they want.
One one hand, I don't trust the government, and I do think we should be able to protect our data.
On the other hand, people always say "what if your child was abducted and the info was on the person's phone but they couldn't access it", or to be able to intercept terroristic threats.
So I see both sides.
Typically, though, I lean towards encryption.
-
And yet, when pressed for information that was obtained in places where they did manage to solve a crime because they broke/hacked/found password to encrypted files - they remain mute.
I really don't think they get as much as they want us to believe they could by decrypting everything.
Not only that - making the companies do this does NOTHING to actually help against someone who wants a real secure system - they simply will break the law and use products that don't have those back doors.
-
@BRRABill said:
I'm really torn in the discussion of a governmental backdoor to all encryption, as they want.
One one hand, I don't trust the government, and I do think we should be able to protect our data.
On the other hand, people always say "what if your child was abducted and the info was on the person's phone but they couldn't access it", or to be able to intercept terroristic threats.
So I see both sides.
Typically, though, I lean towards encryption.
Problem is that back doors can be used by abductors and terrorists too. It's not just by the government. And which is a bigger threat, terrorists or the government? Terrorists pose practically no threat. They make the news but cause very little damage. The government, however, is a major threat to freedom and safety. Giving the government access to that stuff doesn't only create safety, it takes it away too. The question is, how much does it do of which?
Anything that gives good guys access gives bad guys access. There is no technology that only helps good people.
-
So another question becomes, if you are okay with encryption that has a back door, are you really using encryption?
-
@scottalanmiller said:
So another question becomes, if you are okay with encryption that has a back door, are you really using encryption?
hence my quandary about HIPAA (even though it's not directly encryption related). lol
-
@scottalanmiller said:
So another question becomes, if you are okay with encryption that has a back door, are you really using encryption?
My feeling on encryption is really to prevent against the common thief.
I agree with you, once they have the physical system, you have no protection.
-
@BRRABill said:
@scottalanmiller said:
So another question becomes, if you are okay with encryption that has a back door, are you really using encryption?
My feeling on encryption is really to prevent against the common thief.
I agree with you, once they have the physical system, you have no protection.
But a backdoor is designed to defeat the encryption, it's basically an "off switch." It means that potentially anyone has access and that the encryption wasn't to prevent theft. If there are backdoors, what was the encryption for?
-
@scottalanmiller said:
But a backdoor is designed to defeat the encryption, it's basically an "off switch." It means that potentially anyone has access and that the encryption wasn't to prevent theft. If there are backdoors, what was the encryption for?
My assumption is that only the company itself (such as Apple) and the government have access to this backdoor.
-
@BRRABill said:
@scottalanmiller said:
But a backdoor is designed to defeat the encryption, it's basically an "off switch." It means that potentially anyone has access and that the encryption wasn't to prevent theft. If there are backdoors, what was the encryption for?
My assumption is that only the company itself (such as Apple) and the government have access to this backdoor.
Why would you assume that? What makes that even remotely likely?
-
@scottalanmiller said:
Why would you assume that? What makes that even remotely likely?
You think random people would just have access to it?
-
Backdoors, by their very nature, tend to spread. They are difficult to hide for one thing as the code, even closed code, gives them away if studied. And once exposed they are unstoppable. All it takes is one person being aware of them and telling someone else and all security is disabled almost instantly and automatically. Barracuda tried this, for example, and for a little while only the bad guys knew about it. Now it is public knowledge and anyone can look up how to backdoor through their firewalls.
-
@BRRABill said:
@scottalanmiller said:
Why would you assume that? What makes that even remotely likely?
You think random people would just have access to it?
I think that is effectively certain.
-
Just look at Juniper in the news last week!
Someone put a backdoor in their system - sure it took Juniper 7 years to find it, but that doesn't mean other hackers didn't find it earlier and exploit it.
-
All the more reason not to have backdoors!
-
@BRRABill said:
All the more reason not to have backdoors!
Ding Ding Ding ding ding!
This is what the experts are trying to get the people on capital hill to understand.
and this latest craz - We gotta get our smartest people to find a solution to this problem. But the reality is, there is no solution. Well - actually that's not true.. the solution turns us to the movies with the CIA breaking into secure places and installing taps on devices upstream of the encryption.
-
@Dashrender said:
Just look at Juniper in the news last week!
Someone put a backdoor in their system - sure it took Juniper 7 years to find it, but that doesn't mean other hackers didn't find it earlier and exploit it.
Good timing on that one
And Juniper is a huge enterprise name, not like most that get caught doing this. -
@scottalanmiller said:
@Dashrender said:
Just look at Juniper in the news last week!
Someone put a backdoor in their system - sure it took Juniper 7 years to find it, but that doesn't mean other hackers didn't find it earlier and exploit it.
Good timing on that one
And Juniper is a huge enterprise name, not like most that get caught doing this.Who had the open port earlier this year? and when they released a patch, they didn't close it, instead they just required a knock first to open it.
There are tons of these back doors discovered by security researchers who responsibly report them every month. I can only imagine all the back doors that are discovered by hackers and kept secret. Hell Stuxnet had at least 3 Zero day exploits in it. And that other security company that was hacked and their 4+ GB of data published on the internet - I don't remember how many Flash exploits, etc they were holding onto for their 'customers'.
