6 ms·

A nice thing about paper is it is very hard for hackers to ransom all of the wills.

crazygringo 3y ago
It's hard for hackers to ransom tape backup or cloud backups or versioned cloud storage as well, so that's not really an issue here.
- jl6 3y ago
  Maybe in theory. But a lot of orgs like to automate their backups, meaning their backup infrastructure is online and available and thus exploitable.
  - pavel_lishin 3y ago
    A lot of orgs like to not bother testing their backups as well, meaning that their backup infrastructure functionally doesn't exist.
- gustavus 3y ago
  > It's hard for hackers to ransom ... cloud backups or versioned cloud storage as well, so that's not really an issue here. Until you set the password to Password123! because that's the only password that everyone can remember, and the attackers go in delete the originals and previous versions and then keep all the data only for themselves.
- btown 3y ago
  Under a "right to be forgotten" [0] society there's no such thing as an append-only backup or storage, or even offline snapshots in time. As soon as a mechanism to overwrite all existing records (or, equivalently, to destroy the keys necessary to decrypt those records) exists, a sufficiently determined hacker/ransomeer will be able to compromise that mechanism. Paper, at least in theory, requires noticeable human action to achieve destruction at similar scale. One hopes, of course, that the environmental controls of the archival facilities aren't cloud connected... [0] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
  - pmontra 3y ago
    GDPR doesn't apply to the UK but one of the provisions of GDPR is that it does not apply to deceased people. Recital 27: "This Regulation does not apply to the personal data of deceased persons" Article 17 is "Right to erasure (‘right to be forgotten’)" and even without Recital 27 a deceased person cannot ask anything anymore.
    - multjoy 3y ago
      It very much does apply to the UK.
      - PrimeMcFly 3y ago
        How?
        pmontra 3y ago
        When managing data of EU citizens, but does it still apply to UK companies managing data of UK citizens in the UK?
        PrimeMcFly 3y ago
        EU asserts extrajudicial authority but it's pretty meaningless. Can't see why it would apply to UK citizens in the UK at all.
        pmontra 3y ago
        > EU asserts extrajudicial authority but it's pretty meaningless They can prevent a company to operate in the EU and/or fine them. > Can't see why it would apply to UK citizens in the UK at all. Exactly.
    - extraduder_ire 3y ago
      Did they repeal it after the withdrawal finalized or something? IIRC, it was granted ascent long before they left the EU.
- earthboundkid 3y ago
  Ransoming cloud storage is just a matter of finding a dev who has production keys on their laptop and getting them to install some CLI that promises to butter toast or whatever.
- count 3y ago
  Except, you're assuming extreme competence here, when, if govt and hospital IT systems are to be any indicator, it's the exact opposite position.
red-iron-pine 3y ago
all the more reason for the 3-2-1 backup approach. there should at least be 1 paper copy somewhere

It's hard for hackers to ransom tape backup or cloud backups or versioned cloud storage as well, so that's not really an issue here.

jl6 3y ago
Maybe in theory. But a lot of orgs like to automate their backups, meaning their backup infrastructure is online and available and thus exploitable.
- pavel_lishin 3y ago
  A lot of orgs like to not bother testing their backups as well, meaning that their backup infrastructure functionally doesn't exist.
gustavus 3y ago
> It's hard for hackers to ransom ... cloud backups or versioned cloud storage as well, so that's not really an issue here. Until you set the password to Password123! because that's the only password that everyone can remember, and the attackers go in delete the originals and previous versions and then keep all the data only for themselves.
btown 3y ago
Under a "right to be forgotten" [0] society there's no such thing as an append-only backup or storage, or even offline snapshots in time. As soon as a mechanism to overwrite all existing records (or, equivalently, to destroy the keys necessary to decrypt those records) exists, a sufficiently determined hacker/ransomeer will be able to compromise that mechanism. Paper, at least in theory, requires noticeable human action to achieve destruction at similar scale. One hopes, of course, that the environmental controls of the archival facilities aren't cloud connected... [0] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/right-to-erasure/ https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...
- pmontra 3y ago
  GDPR doesn't apply to the UK but one of the provisions of GDPR is that it does not apply to deceased people. Recital 27: "This Regulation does not apply to the personal data of deceased persons" Article 17 is "Right to erasure (‘right to be forgotten’)" and even without Recital 27 a deceased person cannot ask anything anymore.
  - multjoy 3y ago
    It very much does apply to the UK.
    - PrimeMcFly 3y ago
      How?
      - pmontra 3y ago
        When managing data of EU citizens, but does it still apply to UK companies managing data of UK citizens in the UK?
        PrimeMcFly 3y ago
        EU asserts extrajudicial authority but it's pretty meaningless. Can't see why it would apply to UK citizens in the UK at all.
        pmontra 3y ago
        > EU asserts extrajudicial authority but it's pretty meaningless They can prevent a company to operate in the EU and/or fine them. > Can't see why it would apply to UK citizens in the UK at all. Exactly.
  - extraduder_ire 3y ago
    Did they repeal it after the withdrawal finalized or something? IIRC, it was granted ascent long before they left the EU.
earthboundkid 3y ago
Ransoming cloud storage is just a matter of finding a dev who has production keys on their laptop and getting them to install some CLI that promises to butter toast or whatever.
count 3y ago
Except, you're assuming extreme competence here, when, if govt and hospital IT systems are to be any indicator, it's the exact opposite position.

red-iron-pine 3y ago

all the more reason for the 3-2-1 backup approach. there should at least be 1 paper copy somewhere