5 ms·
I think the only concern here is that the plain-text csv file containing these 20 rows was sent via email to his attorney, which was probably forwarded on to th
by kefs 14y ago
I think the only concern here is that the plain-text csv file containing these 20 rows was sent via email to his attorney, which was probably forwarded on to the requesting detective. That file is in no way encrypted and is essentially sitting in two email servers, two desktop machines, and possible mobile devices.. all of which are vulnerable to attack from multiple vectors. The file should have, at the least, been encrypted.
- rmc 14y agoYou think all the police and courts and attorneys and judges and clerks and secretaries have a completely set up, and working private key infrastructure? You know that the police routinely handle & store information that people would kill to get at (hint: mobsters)? Do you not think they know how to protect information like this? If you were to email it encrypted, you'd have to send a follow email with the decryption key. Encryption would only be a inconvience and would not protect this information at all.
- morsch 14y agoThe fact that they don't have anything more secure than unencrypted email gives reason to doubt that they know how to protect information like that. An encrypted mail attachment would be a start -- if you use a second channel to deliver the secret key, e.g. call them up to tell them the password.
- rmc 14y agoOK so you doubt their means. Look at the ends. Have there been many security breeches from the police/courts? Is this a large threat to personal security? I don't think so. Hence I think they must be doing something right here.
- kefs 14y agoThe following is just one group's public releases, spanning about 5 months, at approx 20gb. https://thepiratebay.se/user/AntiSecurity/ https://thepiratebay.se/user/AntiSecurity/ Just because you don't hear about vulnerabilities and attacks, doesn't mean they don't happen.
- anigbrowl 14y agoWhat basis do you have to conclude that? The subpoena doesn't even include an email address. It is far more likely that the data were sent on a CD-R by registered mail, or printed out and transmitted by fax. Many court systems allow information to be submitted electronically now, but only by the attorney for the presenting side.