3 ms·

Anyone who gets control of the live server can still read a database, even if it encrypts its storage.

grogenaut 8y ago
Encryption at rest is still important as it closes off a few attack/loss vectors: mis-disposed hard drives, re-allocated hosts. I'm probably missing a few others.
- AlexCoventry 8y ago
  Yeah, but it doesn't really address my concern.
  - nixgeek 8y ago
    Anyone who can control a server in any environment can potentially interact with the database powering applications running on that server. How is running on AWS different than Guardian Cloud in their basement?
    - AlexCoventry 8y ago
      The level of control over who has physical access, of course. Did reports of the Snowden revelations reside on the CMS?
      - untog 8y ago
        Probably not, no, until they were about to be published. I imagine that the choice between "run an entire data centre ourselves, store everything there" and "use AWS, but keep high sensitivity stories on local machines" is an easy one. After all, the client computer that connects to the CMS is just as, or more likely to be compromised. I wouldn't be surprised if the coverage (or at least parts of it) were edited on airgapped laptops.
        AlexCoventry 8y ago
        > the choice between "run an entire data centre ourselves, store everything there" If those were the only two choices, you might be right. But the resources needed for the actual CMS functionality sound modest enough to run independently of the main website. > the client computer that connects to the CMS is just as, or more likely to be compromised That's faulty reasoning.
        untog 8y ago
        > That's faulty reasoning. Why? It's an obvious potential point of compromise.
        AlexCoventry 8y ago
        Sorry, I misunderstood. I read it as saying "We're going to get hacked via this other vector, anyway, so why bother?" I see your point, now.
      - wftglf 8y ago
        Sadly we don't trust our security practices anywhere enough for that! Secret investigations happen in an air gapped room on computers with their network cards removed then get moved across to the main CMS when they're ready to publish.
hbbio 8y ago
Exactly. As I read the original article, which mentions "encryption-at-rest", there was a voice in my head crying: "No, what they need is E2EE". That would enable the authors to write confidential drafts of the articles, no matter where the data is stored (and AWS would be perfectly fine of course). Disclaimer: The voice is my head does not come out of nowhere. I am building a product which addresses this: https://github.com/wallix/datapeps-sdk-js https://github.com/wallix/datapeps-sdk-js is a API/SDK solution for E2EE. Sample app integration is available at: https://github.com/wallix/notes https://github.com/wallix/notes (you can switch between master and datapeps branches to see the changes of the E2EE integration)
- manigandham 8y ago
  In which case they could've just used a separate encryption layer with any database, including DynamoDB. The HSM security keys available from all the clouds makes this rather simple.
  - hbbio 8y ago
    Yes, any db including Dynamo would have been fine. Our software E2EE solution has advantages over HSM though: Cost obviously, and more features and extensibility.
- AlexCoventry 8y ago
  Great idea.

Encryption at rest is still important as it closes off a few attack/loss vectors: mis-disposed hard drives, re-allocated hosts. I'm probably missing a few others.

AlexCoventry 8y ago
Yeah, but it doesn't really address my concern.
- nixgeek 8y ago
  Anyone who can control a server in any environment can potentially interact with the database powering applications running on that server. How is running on AWS different than Guardian Cloud in their basement?
  - AlexCoventry 8y ago
    The level of control over who has physical access, of course. Did reports of the Snowden revelations reside on the CMS?
    - untog 8y ago
      Probably not, no, until they were about to be published. I imagine that the choice between "run an entire data centre ourselves, store everything there" and "use AWS, but keep high sensitivity stories on local machines" is an easy one. After all, the client computer that connects to the CMS is just as, or more likely to be compromised. I wouldn't be surprised if the coverage (or at least parts of it) were edited on airgapped laptops.
      - AlexCoventry 8y ago
        > the choice between "run an entire data centre ourselves, store everything there" If those were the only two choices, you might be right. But the resources needed for the actual CMS functionality sound modest enough to run independently of the main website. > the client computer that connects to the CMS is just as, or more likely to be compromised That's faulty reasoning.
        untog 8y ago
        > That's faulty reasoning. Why? It's an obvious potential point of compromise.
        AlexCoventry 8y ago
        Sorry, I misunderstood. I read it as saying "We're going to get hacked via this other vector, anyway, so why bother?" I see your point, now.
    - wftglf 8y ago
      Sadly we don't trust our security practices anywhere enough for that! Secret investigations happen in an air gapped room on computers with their network cards removed then get moved across to the main CMS when they're ready to publish.

hbbio 8y ago

Exactly. As I read the original article, which mentions "encryption-at-rest", there was a voice in my head crying: "No, what they need is E2EE". That would enable the authors to write confidential drafts of the articles, no matter where the data is stored (and AWS would be perfectly fine of course). Disclaimer: The voice is my head does not come out of nowhere. I am building a product which addresses this: https://github.com/wallix/datapeps-sdk-js https://github.com/wallix/datapeps-sdk-js is a API/SDK solution for E2EE. Sample app integration is available at: https://github.com/wallix/notes https://github.com/wallix/notes (you can switch between master and datapeps branches to see the changes of the E2EE integration)

manigandham 8y ago
In which case they could've just used a separate encryption layer with any database, including DynamoDB. The HSM security keys available from all the clouds makes this rather simple.
- hbbio 8y ago
  Yes, any db including Dynamo would have been fine. Our software E2EE solution has advantages over HSM though: Cost obviously, and more features and extensibility.
AlexCoventry 8y ago
Great idea.