3 ms·

If you encrypt the data coming from the client all the way to the database or any other persistence mechanism, then it doesn't matter if the company is obliged

If you encrypt the data coming from the client all the way to the database or any other persistence mechanism, then it doesn't matter if the company is obliged to forward your data to a gov database. It would be encrypted, hence not easily readable. In my case, as a service provider, we are encrypting as much as we can, so that we can't even read the data even if obliged to. It becomes troublesome for some pieces of data because we need to decrypt it so that it can be displayed in the website. So if we can decrypt it, as a provider, then we would be obliged to decrypt it for government agencies. It would be interesting to see what can we do as a provider, to protect our own customers without breaking the law.

straight_talk 14y ago
You can't do anything. The complete system is corrupted to the bone. If you are a successful company someday somebody with very deep pockets or a huge bank credit will show and buy you up. A few days later the encryption will start to disappear (e.g. Skype). If you don't sell your competitor will get the money and drive you out of business by the sheer force of money - pay higher salaries and get better ppl, better locations, more ads, etc.
frankydp 14y ago
If the person you get your encryption keys from is "voluntarily" helping protect the nation what is really secure.
- drawkbox 14y ago
  The voluntarily part is also shaky. Eventually not 'volunteering' to do it will be too costly. The systems, rewards, costs will be rigged so that volunteering is the only way to play, but not required. Also, the so called protections that it must be a cyber-security threat also hold little check and balance, how about an attack just happening when an agency needs information, or waiting for an attack by baiting it, any protection against creating honeypots to bait certain services? Probably not. Everyday servers and systems are attacked, so it is pretty much open season for getting information. There are no checks and balances and 'volunteering' means nothing. Try getting a gov't contract or deflecting problems without volunteering. I am glad all these freedom giving up people have nothing to hide such as their business ideas, sites they visit, downloads, emails etc will all be tracked now. I am sure they have something to hide from then. All of this will now be stored not only on their computers and their services, but at the ISP and the NSA now as well. Lots more chances, especially at the ISP level, of identity theft and threats. Crypto products might be a big market after this.
nine_k 14y ago
If possible, you, the provider, can claim zero knowledge and walk away free. For instance, SpiderOak makes a point of not knowing what their clients store on their servers, because all encryption happens on the client side, and the key never reaches the server side.
- aespinoza 14y ago
  But is Javascript encryption really that good ? Our site is basically Javascript only.
  - deleted 14y ago
    [deleted]
  - nine_k 14y ago
    If the algorithm is correctly implemented, Javascript encryption is no worse than any other. The problem with JS is that the browser may be not good enough, failing to prevent certain attacks from other tabs. The OS may be compromised, too, so that the data is available before encryption, or the key phrase gets stolen and siphoned out by a keylogger. However good your software is, you can't fight against it. As memory is getting cheaper, running each domain in a different process in a different container or VM becomes more feasible (see Qubes OS). In a well-insulated environment, JS encryption should be as safe as any other.
    - aespinoza 14y ago
      True. But if what you say is true, that the encryption in javascript is good enough or comparable to their desktop counterparts, then it is a step in the right direction. Nothing is 100% secure, specially in the web, but anything is better that what we have today. I will start doing some research on the solutions to this. We are going to do for our clients, what I expect my providers do for me.

straight_talk 14y ago

You can't do anything. The complete system is corrupted to the bone. If you are a successful company someday somebody with very deep pockets or a huge bank credit will show and buy you up. A few days later the encryption will start to disappear (e.g. Skype). If you don't sell your competitor will get the money and drive you out of business by the sheer force of money - pay higher salaries and get better ppl, better locations, more ads, etc.

frankydp 14y ago

If the person you get your encryption keys from is "voluntarily" helping protect the nation what is really secure.

drawkbox 14y ago
The voluntarily part is also shaky. Eventually not 'volunteering' to do it will be too costly. The systems, rewards, costs will be rigged so that volunteering is the only way to play, but not required. Also, the so called protections that it must be a cyber-security threat also hold little check and balance, how about an attack just happening when an agency needs information, or waiting for an attack by baiting it, any protection against creating honeypots to bait certain services? Probably not. Everyday servers and systems are attacked, so it is pretty much open season for getting information. There are no checks and balances and 'volunteering' means nothing. Try getting a gov't contract or deflecting problems without volunteering. I am glad all these freedom giving up people have nothing to hide such as their business ideas, sites they visit, downloads, emails etc will all be tracked now. I am sure they have something to hide from then. All of this will now be stored not only on their computers and their services, but at the ISP and the NSA now as well. Lots more chances, especially at the ISP level, of identity theft and threats. Crypto products might be a big market after this.

nine_k 14y ago

If possible, you, the provider, can claim zero knowledge and walk away free. For instance, SpiderOak makes a point of not knowing what their clients store on their servers, because all encryption happens on the client side, and the key never reaches the server side.

aespinoza 14y ago
But is Javascript encryption really that good ? Our site is basically Javascript only.
- deleted 14y ago
  [deleted]
- nine_k 14y ago
  If the algorithm is correctly implemented, Javascript encryption is no worse than any other. The problem with JS is that the browser may be not good enough, failing to prevent certain attacks from other tabs. The OS may be compromised, too, so that the data is available before encryption, or the key phrase gets stolen and siphoned out by a keylogger. However good your software is, you can't fight against it. As memory is getting cheaper, running each domain in a different process in a different container or VM becomes more feasible (see Qubes OS). In a well-insulated environment, JS encryption should be as safe as any other.
  - aespinoza 14y ago
    True. But if what you say is true, that the encryption in javascript is good enough or comparable to their desktop counterparts, then it is a step in the right direction. Nothing is 100% secure, specially in the web, but anything is better that what we have today. I will start doing some research on the solutions to this. We are going to do for our clients, what I expect my providers do for me.