4 ms·

Looks like they're doing our job. First, the message was "backup your data". Now, they also added "encrypt your data"!

by tomp 7y ago

jfengel 7y ago
Does encryption really help? If they've compromised your system well enough to lock you out of it, aren't they likely to have nabbed your passwords in the process? Even if you were incredibly careful, there's not much you can do about a keylogger. If you could prevent a keylogger, you could lock them out entirely.
- tomp 7y ago
  Maybe? AFAIK having more walls will result in less intrusions... Like, I imagine that you can delete/encrypt all the files simply by having a local username / network filesystem accesss. Doesn't necessarily mean you also managed to hack usernames/passwords/databases/source code... Each wall is another barrier to pass/hack!
  - cosmodisk 7y ago
    You can have 25 walls if you want but all it takes is Sally in accounts who thinks it's a good idea to open this one email attachment...If went rogue I'd probably be able to hack my company left and right and I'm not even remotely someone with those skills.
    - tomp 7y ago
      Relying on every employee to not do something "stupid" (i.e. stupid to us but how would a non-programmer know without extensive training) is a fundamentally flawed approach... Companies need to think about this, need to adapt processes to account for failure at as many levels as possible. "bus factor" and so on.
    - seventhtiger 7y ago
      If you're letting arbitrary attachments in and allowing arbitrary executables to run then Sally is the victim of gross incompetence. Everyone has jobs to do and they can't do them effectively if you need them to think through information security for every interaction. You have to build the rails and create a safe work area. User education is truly the last layer because if everything fails maybe the user will remember something we said. Rogue employees require a lot more traditional security and trust. Someone could always just physically destroy company property, and Sally could always approve fraudulent transactions, so you have to start there and it'll get you pretty far.
- Nasrudith 7y ago
  It does but it isn't a panacea, if you leave the keys accessible or the wrong subsystems vulnerable it won't save you but a properly isolated encrypted repository greatly mitigates the damage possibilities to 'rendered inaccessible' or 'exposed but it will take decades before they can even think about decrypting it with a multi-billion dollar budget'.
- elliekelly 7y ago
  > there's not much you can do about a keylogger How come keystrokes aren't encrypted yet? I don't really have the foggiest idea how my computer interprets the data that comes from me turning on and off a bunch of switches in rapid succession but it's odd to me that we all kind of accept that we're screwed if a bad actor starts logging our keystrokes.
  - seventhtiger 7y ago
    Wouldn't that be impossible? One time pad and E2E wouldn't work because the pad and both ends would be on the same compromised machine. In the end you need info to get from the user to the infected machine and at some it will be unencrypted. It's the equivalent of having a camera above the keyboard. Really not much you can do there.
    - elliekelly 7y ago
      I guess encrypt isn’t really the right word but I was imagining something similar to how you can program autocorrect and autocomplete on the iPhone. So when I log go to gmail.com and go to the password box I’d type “gmailP@ssword” (and presumably any keyloggers on my machine would capture gmailP@ssword) and then the computer would correct it to the real password. But like I said, I know nothing about the computer magic behind my keystrokes.
WalterBright 7y ago
There's also "compartmentalize your data", so that one breach doesn't get it all. Compartmentalization is a guiding principle for things like spy networks. It's also how you make critical equipment able to survive failures.
deleted 7y ago
[deleted]

Looks like they're doing our job. First, the message was "backup your data". Now, they also added "encrypt your data"!

by tomp 7y ago

Looks like they're doing our job. First, the message was "backup your data". Now, they also added "encrypt your data"!

Does encryption really help? If they've compromised your system well enough to lock you out of it, aren't they likely to have nabbed your passwords in the process? Even if you were incredibly careful, there's not much you can do about a keylogger. If you could prevent a keylogger, you could lock them out entirely.

tomp 7y ago
Maybe? AFAIK having more walls will result in less intrusions... Like, I imagine that you can delete/encrypt all the files simply by having a local username / network filesystem accesss. Doesn't necessarily mean you also managed to hack usernames/passwords/databases/source code... Each wall is another barrier to pass/hack!
- cosmodisk 7y ago
  You can have 25 walls if you want but all it takes is Sally in accounts who thinks it's a good idea to open this one email attachment...If went rogue I'd probably be able to hack my company left and right and I'm not even remotely someone with those skills.
  - tomp 7y ago
    Relying on every employee to not do something "stupid" (i.e. stupid to us but how would a non-programmer know without extensive training) is a fundamentally flawed approach... Companies need to think about this, need to adapt processes to account for failure at as many levels as possible. "bus factor" and so on.
  - seventhtiger 7y ago
    If you're letting arbitrary attachments in and allowing arbitrary executables to run then Sally is the victim of gross incompetence. Everyone has jobs to do and they can't do them effectively if you need them to think through information security for every interaction. You have to build the rails and create a safe work area. User education is truly the last layer because if everything fails maybe the user will remember something we said. Rogue employees require a lot more traditional security and trust. Someone could always just physically destroy company property, and Sally could always approve fraudulent transactions, so you have to start there and it'll get you pretty far.
Nasrudith 7y ago
It does but it isn't a panacea, if you leave the keys accessible or the wrong subsystems vulnerable it won't save you but a properly isolated encrypted repository greatly mitigates the damage possibilities to 'rendered inaccessible' or 'exposed but it will take decades before they can even think about decrypting it with a multi-billion dollar budget'.
elliekelly 7y ago
> there's not much you can do about a keylogger How come keystrokes aren't encrypted yet? I don't really have the foggiest idea how my computer interprets the data that comes from me turning on and off a bunch of switches in rapid succession but it's odd to me that we all kind of accept that we're screwed if a bad actor starts logging our keystrokes.
- seventhtiger 7y ago
  Wouldn't that be impossible? One time pad and E2E wouldn't work because the pad and both ends would be on the same compromised machine. In the end you need info to get from the user to the infected machine and at some it will be unencrypted. It's the equivalent of having a camera above the keyboard. Really not much you can do there.
  - elliekelly 7y ago
    I guess encrypt isn’t really the right word but I was imagining something similar to how you can program autocorrect and autocomplete on the iPhone. So when I log go to gmail.com and go to the password box I’d type “gmailP@ssword” (and presumably any keyloggers on my machine would capture gmailP@ssword) and then the computer would correct it to the real password. But like I said, I know nothing about the computer magic behind my keystrokes.

WalterBright 7y ago

There's also "compartmentalize your data", so that one breach doesn't get it all. Compartmentalization is a guiding principle for things like spy networks. It's also how you make critical equipment able to survive failures.

deleted 7y ago

[deleted]