4 ms·

The last I knew, in the U.S. the fax still carried some legal recognition/privileges that email did not. For example, your doctor can fax a prescription to the

The last I knew, in the U.S. the fax still carried some legal recognition/privileges that email did not. For example, your doctor can fax a prescription to the pharmacist. Or a request for records to another doctor. A faxed copy of a signed contract carries some degree of official legal recognition/status (yeah, go figure). Bog standard email did/does not carry such authority. Maybe closed email interconnects now do. For example, I think our area health care networks (we have 3 big ones, here) now support email requests for some things requiring authorization. But those emails are within their private network, and on private links between their networks where they've agreed to interconnect on such things. Or they should be... Speaking more generally, I observe at least some doctors and offices emailing all sort of stuff on the public, general Internet, that should actually remain protected. (One of the reasons I expect the Internet to continue to be de facto locked down by authority (laws and rubber hoses, as opposed to technically complete "solutions"). People, including authority figures, insist upon using it as if it is secure. They have a lot of power, that will end up enforcing "security" through physical power against those who don't "obey the rules".)

yjftsjthsd-h 8y ago
I wonder if we could actually get gpg in use here; it's already a tightly regulated, controlled environment, so we might be able to push through actually standardizing on it, and being able to verify that something truly was signed by a doctor and then encrypt it in transit would be really useful.
- beojan 8y ago
  The web of trust isn't really helpful here. Ideally we'd have government run certification authorities issuing official X.509 certificates to individuals and corporations.
jessaustin 8y ago
Maybe faxes have legal weight, but that's silly because they are easily spoofed. I agree that HIPAA violation via email is common.
- pasbesoin 8y ago
  Yep, but the parent comment asked: If both are subject to vulnerabilities are there any upsides to continuing to use fax? Like a lot of things in the world, actual use comes down to practicality. There hasn't been a big enough scandal, yet, with regard to legal recognition of faxed documents. And it's a legacy format that remains in place, that allows for immediate communication of same. So, people use it. Thinking of this reminds me of U.S. voter registration and voting. Right now, we have a manufactured political uproar about supposed fraud and abuse of the extant systems. But studies have shown this to be very negligible. Yes, in theory voter registration in the states and municipalities could be further "secured". But, up until this use as a political tool, doing so wasn't viewed as necessary. Localities did a sufficient job of managing registration and identification of their own bases. And actually, the "security" of voter registration had to be forcibly loosened, in order to prevent it from being used as a tool of disenfranchisement (e.g. difficult tests to pass, in order to register -- but only for African Americans). Faxes aren't really "secure". But they are used to put an official, sanctioned imprimatur on what is already understood and happening, anyway, when the parties involved aren't immediately face-to-face. Maybe there are some cases over whether a faxed signature is genuine, but these apparently haven't risen in prominence to the point of derailing the faxed signature as legal mechanism. They would have a lot of convenience and "efficiency" -- these days, "necessity" -- to outweigh, before they would do so.
pwg 8y ago
> The last I knew, in the U.S. the fax still carried some legal recognition/privileges that email did not. Much of this is the direct consequence of fax being carried over the POTS copper telephone network, where there is some belief (not necessarily accurate in today's world) that the link between sender and receiver over a POTS line is free of "men in the middle". Therefore fax is viewed as 'secure' due to this belief.
- ridgeguy 8y ago
  Maybe also a minor consequence of its longevity. Arguably, it's been around since 1843 [1]. [1] https://en.wikipedia.org/wiki/Fax#History https://en.wikipedia.org/wiki/Fax#History
- spacehome 8y ago
  In really olden times, you had to talk to the switchboard operator to connect your call. It was free of men in the middle only by dint of the fact that most operators were women.
- grkvlt 8y ago
  Partly, but also because it is easier to authenticate as not being spoofed or faked. Faxes have a 'sending number' that is transmitted as part of the protocol, and caller ID allows checking the source, whereas email senders can be very easily changed. However, even the fax may not be secure enough - I worked for a gold bullion trading firm in the 90s where they used faxes for secondary trade confirmation, but sent a telex with the data as then main mechanism, because the telex network was considered more secure than the PSTN and relying on fax sender numbers. They also used X.25 a lot, as they didn't trust the fancy new TCP/IP stuff that was around, though, so there's that...
  - rustcharm 8y ago
    Caller ID can be very easily changed today. I can set it to anything I want on my phone system. But when FAX machines first became popular, this was less of a problem
  - u801e 8y ago
EamonnMR 8y ago
This is an unfortunate historical accident of fax and paper coming first. They are not subject to the same security rigor that other IT services are. And a recipe for lost health information and poor patient outcomes.

yjftsjthsd-h 8y ago

I wonder if we could actually get gpg in use here; it's already a tightly regulated, controlled environment, so we might be able to push through actually standardizing on it, and being able to verify that something truly was signed by a doctor and then encrypt it in transit would be really useful.

beojan 8y ago
The web of trust isn't really helpful here. Ideally we'd have government run certification authorities issuing official X.509 certificates to individuals and corporations.

jessaustin 8y ago

Maybe faxes have legal weight, but that's silly because they are easily spoofed. I agree that HIPAA violation via email is common.

pasbesoin 8y ago
Yep, but the parent comment asked: If both are subject to vulnerabilities are there any upsides to continuing to use fax? Like a lot of things in the world, actual use comes down to practicality. There hasn't been a big enough scandal, yet, with regard to legal recognition of faxed documents. And it's a legacy format that remains in place, that allows for immediate communication of same. So, people use it. Thinking of this reminds me of U.S. voter registration and voting. Right now, we have a manufactured political uproar about supposed fraud and abuse of the extant systems. But studies have shown this to be very negligible. Yes, in theory voter registration in the states and municipalities could be further "secured". But, up until this use as a political tool, doing so wasn't viewed as necessary. Localities did a sufficient job of managing registration and identification of their own bases. And actually, the "security" of voter registration had to be forcibly loosened, in order to prevent it from being used as a tool of disenfranchisement (e.g. difficult tests to pass, in order to register -- but only for African Americans). Faxes aren't really "secure". But they are used to put an official, sanctioned imprimatur on what is already understood and happening, anyway, when the parties involved aren't immediately face-to-face. Maybe there are some cases over whether a faxed signature is genuine, but these apparently haven't risen in prominence to the point of derailing the faxed signature as legal mechanism. They would have a lot of convenience and "efficiency" -- these days, "necessity" -- to outweigh, before they would do so.

pwg 8y ago

> The last I knew, in the U.S. the fax still carried some legal recognition/privileges that email did not. Much of this is the direct consequence of fax being carried over the POTS copper telephone network, where there is some belief (not necessarily accurate in today's world) that the link between sender and receiver over a POTS line is free of "men in the middle". Therefore fax is viewed as 'secure' due to this belief.

ridgeguy 8y ago
Maybe also a minor consequence of its longevity. Arguably, it's been around since 1843 [1]. [1] https://en.wikipedia.org/wiki/Fax#History https://en.wikipedia.org/wiki/Fax#History
spacehome 8y ago
In really olden times, you had to talk to the switchboard operator to connect your call. It was free of men in the middle only by dint of the fact that most operators were women.
grkvlt 8y ago
Partly, but also because it is easier to authenticate as not being spoofed or faked. Faxes have a 'sending number' that is transmitted as part of the protocol, and caller ID allows checking the source, whereas email senders can be very easily changed. However, even the fax may not be secure enough - I worked for a gold bullion trading firm in the 90s where they used faxes for secondary trade confirmation, but sent a telex with the data as then main mechanism, because the telex network was considered more secure than the PSTN and relying on fax sender numbers. They also used X.25 a lot, as they didn't trust the fancy new TCP/IP stuff that was around, though, so there's that...
- rustcharm 8y ago
  Caller ID can be very easily changed today. I can set it to anything I want on my phone system. But when FAX machines first became popular, this was less of a problem
- u801e 8y ago

EamonnMR 8y ago

This is an unfortunate historical accident of fax and paper coming first. They are not subject to the same security rigor that other IT services are. And a recipe for lost health information and poor patient outcomes.