4 ms·

my healthcare provider (Anthem) was just hacked, so my SS number and other identifying details are probably being traded on some Russian web site right now. An

my healthcare provider (Anthem) was just hacked, so my SS number and other identifying details are probably being traded on some Russian web site right now. Anthem did not encrypt the data which was stolen. Sony did not show any signs of basic competence in its data security either. a Manhattan Project is useful if you have a really tight deadline, a very specific and achievable goal, and the problem you face is one where the technology you want does not exist yet. but everybody in technology knows that the technology exists, and the problem is widespread incompetence and indifference. the solution for that is not a Manhattan Project. it is class-action lawsuits. think how fucked up this situation is. everybody in infosec knows that Anthem and Sony were ridiculous and 100% at fault in their negligence. yet people who get their info on this from the mainstream media have probably never even heard that point of view. so you get utterly uninformed commentators who think that Anthem and Sony must employ geniuses of the first caliber, and that we need to take the "new" and "unprecedented" step of classified crypto research.

ams6110 12y ago
I don't think the plain text data is the problem. Data has to be in the clear at some point to be usable. That's the point that will be attacked. And it will eventually be compromised.
- fl0wenol 12y ago
  The trick here is to have as _few_ places as possible where that data is operating in the clear as possible, and try to provide as much isolation across them where feasible or where concerns are naturally separated. The problem is that few think like this, except in a few special industries where they live and die by not getting this wrong. Ease of use and whatever gets things working fastest is generally the name of the game (and I don't blame businesses for this attitude, the market punishes anyone who is too careful or slow-moving in almost every industry)

ams6110 12y ago

I don't think the plain text data is the problem. Data has to be in the clear at some point to be usable. That's the point that will be attacked. And it will eventually be compromised.

fl0wenol 12y ago
The trick here is to have as _few_ places as possible where that data is operating in the clear as possible, and try to provide as much isolation across them where feasible or where concerns are naturally separated. The problem is that few think like this, except in a few special industries where they live and die by not getting this wrong. Ease of use and whatever gets things working fastest is generally the name of the game (and I don't blame businesses for this attitude, the market punishes anyone who is too careful or slow-moving in almost every industry)