5 ms·

That’s the wrong analogy. If 99% of locks are resistant to picking but yours wasn’t, it’s ridiculous to then say that locks don’t work.

by c0pium 3y ago

JohnFen 3y ago
The analogy isn't that one out of a hundred locks don't work, but the none of the locks work in the face of a skilled attacker that may comprise 1% of the attackers. This isn't saying that locks are worthless, but it is saying that thinking of them as secure is a false confidence. This sort of truth is why there's a saying in the security field that you're at the greatest risk the moment that you think you're secure. In terms of data security, the only way to be actually secure from data leakage is to not be in possession of the data.
- c0pium 3y ago
  That’s simply incorrect. Edit: my source for this is that I have been involved with hundreds of data breaches where the EU was satisfied that the privacy controls were sufficient to say that no personal data was compromised.
  - JohnFen 3y ago
    What part of what I said was incorrect? Your source doesn't make the case that I was incorrect about any of my assertions. That doesn't mean I'm right, of course, but I don't see how examples of privacy controls successfully protecting data disproves them. There can still be cases where the controls failed.
    - c0pium 3y ago
      > What part of what I said was incorrect? All parts of it. You are asserting that a sufficiently skilled attacker can magically overcome all privacy controls. This fundamentally misunderstands how privacy controls work. Don’t make absolute statements, they’re always incorrect (see what I did there?). When data is compliantly anonymized, the ability to deanonymize it has been irrevocably destroyed. When evaluating privacy controls, you evaluate them against a trusted insider with full access and unlimited time. There are lots of organizations whose controls meet this bar.

That’s the wrong analogy. If 99% of locks are resistant to picking but yours wasn’t, it’s ridiculous to then say that locks don’t work.

by c0pium 3y ago

That’s the wrong analogy. If 99% of locks are resistant to picking but yours wasn’t, it’s ridiculous to then say that locks don’t work.

JohnFen 3y ago

The analogy isn't that one out of a hundred locks don't work, but the none of the locks work in the face of a skilled attacker that may comprise 1% of the attackers. This isn't saying that locks are worthless, but it is saying that thinking of them as secure is a false confidence. This sort of truth is why there's a saying in the security field that you're at the greatest risk the moment that you think you're secure. In terms of data security, the only way to be actually secure from data leakage is to not be in possession of the data.

c0pium 3y ago
That’s simply incorrect. Edit: my source for this is that I have been involved with hundreds of data breaches where the EU was satisfied that the privacy controls were sufficient to say that no personal data was compromised.
- JohnFen 3y ago
  What part of what I said was incorrect? Your source doesn't make the case that I was incorrect about any of my assertions. That doesn't mean I'm right, of course, but I don't see how examples of privacy controls successfully protecting data disproves them. There can still be cases where the controls failed.
  - c0pium 3y ago
    > What part of what I said was incorrect? All parts of it. You are asserting that a sufficiently skilled attacker can magically overcome all privacy controls. This fundamentally misunderstands how privacy controls work. Don’t make absolute statements, they’re always incorrect (see what I did there?). When data is compliantly anonymized, the ability to deanonymize it has been irrevocably destroyed. When evaluating privacy controls, you evaluate them against a trusted insider with full access and unlimited time. There are lots of organizations whose controls meet this bar.