3 ms·
I’m still not totally convinced that the HSMs are tamper evident. I’ve read (ok perused) the compliance reports, and they just say ‘yeah we have HSMs and they’r
by greggsy 3y ago
I’m still not totally convinced that the HSMs are tamper evident. I’ve read (ok perused) the compliance reports, and they just say ‘yeah we have HSMs and they’re secure’, but what assurances can consumers have with the integrity of the hardware, short of being able to walk into a datacentre (never going to happen), install their own product, and lock the rack with their own key?
It’s unreasonable, expensive, and probably unnecessary and irrational for the vast majority of customers, but it still niggles at me from time to time.
- alfanick 3y agoI lately dealt with some infrastructure issue, involving HSM. Literally "we have HSMs and they're secure", except they don't work, and audit logs are non-existing. And if you enable them, they sometimes work (mostly not), and give output in some undocumented binary format. Not fun experience.