6 ms·
Reflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing. Similar to how Stripe handles payments wit
by plasma 7y ago
Reflecting on this, I wonder if a PaaS solution that is a "vault" of confidential information would be a good thing.
Similar to how Stripe handles payments with a token, we could all store tokens for User information (eg the Id) and query the vault (or operate on the vault, eg, validate login, or return email, etc) using keys.
The service could be hardened (like Stripe) to ensure the data is stored securely, and detect ex-filtration attempts (eg, queries for multiple customers at once being abnormal) and automatically block that.
- pavanagrawal123 7y agoWouldn't this really just turn into a database as a service?
- sroussey 7y agoNo. It should prevent something like "SELECT * FROM users WHERE sex="F" and age=18".
- viraptor 7y agoSince it's users, maybe call it a directory... And since it's changing, maybe even an Active Directory? Like this https://aws.amazon.com/directoryservice/ https://aws.amazon.com/directoryservice/ ?
- majewsky 7y agoBut then we need some sort of Protocol to Access the Directory. It should be something Lightweight, ideally. ;)
- anticensor 7y agoLDAP?
- toyg 7y agoA single target for all gangsters on the planet? A convenient one-stop-shop, as opposed to having to penetrate multiple different services with vastly different technology stacks and protections and to then normalize data stored in a multitude of different formats? Sounds great, for attackers.
- abraae 7y agoThis is a great idea and someone should do it. Specialize in storing personal data (name, address etc.) Provide APIs that only allow gentle exfiltration of data. e.g. < 10K queries per minute/hour/day whatever. Have alternate paths (e.g. manual procedures) when greater volumes are required (e.g. for disaster recovery testing). Then get it audited to death by some serious security firms.
- toomuchtodo 7y agoWould this be something companies would pay for?
- abraae 7y agoA FAANG wouldn't, but a corporate building e.g. a second-tier system holding customer data might.
- mehrdadn 7y agoOff-topic, but why is there no M in FAANG?
- nlawalker 7y agoRejected due to poor culture fit.
- dodobirdlord 7y agoThe term was originally coined in order to talk about stock price behavior.
- paxys 7y agoSo, a database?
- interwho 7y agoThere's a group out of the University of Warwick that's trying to commercialize a similar idea. https://www.hubofallthings.com/main/what-is-the-hat https://www.hubofallthings.com/main/what-is-the-hat
- bigiain 7y agoYou've just invented from first principles Single Sign On, OAuth, SAML, and Identity Providers. You can rent it from AWS, of course. It's called Cognito. https://aws.amazon.com/cognito/ https://aws.amazon.com/cognito/ You can also offload that responsibility for user data/credentials to Google/Facebook et al as you see many places with "Login with Facebook", making your users pay in privacy-invasion instead of bearing the burden of properly securing your user's PII yourself...
- mehrdadn 7y agoNot just a privacy invasion but also a single point of failure/an account shutdown.
- jimbo1qaz 7y agoMozilla Persona was deaigned so "the identity provider does not know which website the user is identifying on." But it did nto catch on. As a user, it seemed like "so i need to login to Google on Mozilla.org... it's just a wrapper for my Gmail and/or Mozilla account?"
- rblatz 7y agoLike azure Key Vault? I’m sure AWS and google have something similar. Or host your own by using Hashicorp Vault.
- louis-paul 7y agohttps://www.verygoodsecurity.com https://www.verygoodsecurity.com