4 ms·

I know this might sound political, but I'm still curious if there are enough laws and regulation surrounding digital security. I guess companies are catching u

by jokoon 10y ago

I know this might sound political, but I'm still curious if there are enough laws and regulation surrounding digital security. I guess companies are catching up and implementing good enough measures to protect their users, but sometimes I wonder if there are enough incentives so that companies can really start to invest in security, especially when you hear about big credit card leaks. Of course governments might not be really be able to make the difference between actual security, privacy and consumer rights, but I'm just talking about auditing big companies where the money stakes are high and where damage can happen easily. I mean there already a lot of security measures in the real world, and it doesn't seem there are enough efforts being made in the digital world. Meanwhile you can of course argue that letting systems being insecure can become an asset if your "computer agency" can benefit from it.

daxorid 10y ago
enough laws and regulation surrounding digital security. Many people, particularly those who follow the grugq, regard those who pass and enforce laws and regulation to be the #1 adversary in their threat model. the grugq's writing is heavily influenced by real world tradecraft specifically because his audience's adversary uses it somewhat effectively against other nation states.
Bartweiss 10y ago
> Meanwhile you can of course argue that letting systems being insecure can become an asset if your "computer agency" can benefit from it. At the levels being dealt with here, digital security laws stop being about ensuring good security. They become, almost exclusively, international weapons. The crypto export ban was about ensuring other nations could be monitored. So was the Enigma coverup-and-selloff. So was Dual_EC_DRBG, and so on the flipside are SKIPJACK and other secure products. There's privacy and consumer security, and then there's real security. When some company loses a bunch of unencrypted passwords and credit card numbers, you're right that that should be illegal - just to motivate doing a better job. If you can get fined for obvious screwups then it's easier to justify paying some competent security people (and allowing researchers to help you out). At the "actually secure" levels of operation I'm not sure it makes sense to talk in terms of simple domestic laws. Pretty much everything that gets done there is part of a bigger game.

by jokoon 10y ago

daxorid 10y ago

enough laws and regulation surrounding digital security. Many people, particularly those who follow the grugq, regard those who pass and enforce laws and regulation to be the #1 adversary in their threat model. the grugq's writing is heavily influenced by real world tradecraft specifically because his audience's adversary uses it somewhat effectively against other nation states.

Bartweiss 10y ago

> Meanwhile you can of course argue that letting systems being insecure can become an asset if your "computer agency" can benefit from it. At the levels being dealt with here, digital security laws stop being about ensuring good security. They become, almost exclusively, international weapons. The crypto export ban was about ensuring other nations could be monitored. So was the Enigma coverup-and-selloff. So was Dual_EC_DRBG, and so on the flipside are SKIPJACK and other secure products. There's privacy and consumer security, and then there's real security. When some company loses a bunch of unencrypted passwords and credit card numbers, you're right that that should be illegal - just to motivate doing a better job. If you can get fined for obvious screwups then it's easier to justify paying some competent security people (and allowing researchers to help you out). At the "actually secure" levels of operation I'm not sure it makes sense to talk in terms of simple domestic laws. Pretty much everything that gets done there is part of a bigger game.