4 ms·

If one server queries a MySQL database on another server inside my network (using private IP addresses), I don't encrypt what's transmitted between the two serv

by r-shirt 13y ago

If one server queries a MySQL database on another server inside my network (using private IP addresses), I don't encrypt what's transmitted between the two servers any more than what's done by default. And that default isn't SSL or anything of the sort because I'm expecting that my network admin knows what they're doing with firewalls to keep the unwanted packet sniffers out of the private network. Besides, I don't want to spend the extra CPU cycles on encrypting when I can just fortify the firewall.

thrownaway2424 13y ago
That seems pretty reasonable within a datacenter. Nobody(?) would encrypt traffic from local client to local mysql server. But accessing remotely over network links that could be tapped by governments or other antagonists? If you had dedicated netsec and infosec departments as big as Facebook's, you might encrypt that. Some of the companies named in the PRISM slide deck are in a state of constant information warfare with hostile governments (like China) and governments openly desirous of tapping all networks (like India). They are also continuously beset by piratical criminals from all over the world. It seems unreasonable to assume that they would transmit data over long-distance links in the clear. I'm not saying they do encrypt everything or even most things. But as the basis of one's theories about PRISM, it doesn't seem like a good assumption.
- r-shirt 13y ago
  Email sent from mail server to mail server on port 25 is unencrypted. It's in the mail exchange spec. The only way email is secure is if it never leaves your internal network, and that's because of the network architecture, not encryption (which might include VPNs).
  - thrownaway2424 13y ago
    I don't imagine that hotmail or gmail move data from one server to another using SMTP. It's designed to exchange mail with external parties at arm's length. There are far more efficient ways to move data.

by r-shirt 13y ago

thrownaway2424 13y ago

That seems pretty reasonable within a datacenter. Nobody(?) would encrypt traffic from local client to local mysql server. But accessing remotely over network links that could be tapped by governments or other antagonists? If you had dedicated netsec and infosec departments as big as Facebook's, you might encrypt that. Some of the companies named in the PRISM slide deck are in a state of constant information warfare with hostile governments (like China) and governments openly desirous of tapping all networks (like India). They are also continuously beset by piratical criminals from all over the world. It seems unreasonable to assume that they would transmit data over long-distance links in the clear. I'm not saying they do encrypt everything or even most things. But as the basis of one's theories about PRISM, it doesn't seem like a good assumption.

r-shirt 13y ago
Email sent from mail server to mail server on port 25 is unencrypted. It's in the mail exchange spec. The only way email is secure is if it never leaves your internal network, and that's because of the network architecture, not encryption (which might include VPNs).
- thrownaway2424 13y ago
  I don't imagine that hotmail or gmail move data from one server to another using SMTP. It's designed to exchange mail with external parties at arm's length. There are far more efficient ways to move data.