4 ms·
> Bank level security and best security practices. > All your data is encrypted with 256-bit encryption at rest and the data exchanged with our servers are enc
by arkadiyt 6y ago
> Bank level security and best security practices.
> All your data is encrypted with 256-bit encryption at rest and the data exchanged with our servers are encrypted with 256-bit SSL.
Stuff like this makes me cringe. If this is the only thing you can talk about for security then you're announcing to the world you have nothing - no security program, no bug bounty, no appsec team, no best practices, no anything. There's not a single mention of HIPAA anywhere on the website even?
Anyone who uses this service is asking to leak their healthcare data.
- Beefin 6y agoHey! I go into a bit more technical details on the bottom of this blog post: https://medium.com/@esteininger/whats-a-paranoid-son-to-do-during-covid-ba529e432f1b https://medium.com/@esteininger/whats-a-paranoid-son-to-do-d...
- Beefin 6y agoYou present valuable arguments, but in this environment shipping is more important than creating an appsec team or bug bounty program as a solo developer. I'm sure you understand :)
- ciarannolan 6y ago>shipping is more important than creating an appsec team or bug bounty program Is it? Isn't "not losing people's personal health data to a breach" more important than shipping?
- Beefin 6y agoHey! all data is encrypted on the client side (https://github.com/esteininger/pymongo-fle-example https://github.com/esteininger/pymongo-fle-example) and wiped after 30 days. if there are any data breaches, it will all be useless
- ciarannolan 6y agoSorry, I didn't see that part.
- alixanderwang 6y agoHe's a security guy at a bank. For the people you're building for, that line is enough. Congrats on shipping!
- Beefin 6y agoYeah I always have to read in between the highly engineering/tech comments on HN. they're super useful but it's always challenging balancing these details /w shipping!
- arkadiyt 6y agoFor personally monitoring his parents' health it works great. For accepting healthcare data from the public it's unacceptable.