41–50 of 53 posts
Earlier quoted context omitted.
Here's the deal -is there an ecryption that's actually secure against state-level actors? Someone with the resources of the FBI etc? Now, before you say "I don't do anything illegal so it doesn't matter, I'm only worried about corporations" think for a minute about how often companies do have ties (even informal ones -like friends) with people who work in agencies with those resources. You still run the very real and…
>is there an ecryption that's actually secure against state-level actors Any modern symmetric encryption is extremely likely to be safe against state-level actors for the observable future assuming your encryption key is not compromised and has enough entropy in it. Even with quantum computers you only need twice longer keys. Roughly, AES-256 would provide AES-128 level of security in the presence of practical quantu…
Earlier quoted context omitted.
> Here's the deal -is there an ecryption that's actually secure against state-level actors? Someone with the resources of the FBI etc? Yes. AES-256. One-Time Pads as well, but of course then you have the problem of how to securely store the pad.
For now
> When it comes to data storage, security is a big concern. No matter what information you store, you want to make sure that it is safe and secure. Even trivial information is now worth a lot of money, and it is used to profile users. So you want to make sure that your data is safe Tracking and profiling is rarely what people mean by data safety and usually instead refer to privacy . Privacy != safety. Beyond that, i…
I think some pre-configured "example projects" could make me more interested. Demo seems mundane, I get the idea but all the required fields are just annoying to get through.
"A little knowledge does much harm" as the saying goes.
You can decide what to do with it including screw up your security. End users, especially power users make the most risky decisions because of over confidence. How do you know I am not accidentally exposing NFS unsecured to the internet or exposing my pc to the internet but forgetting I have elastic search listening in all IPs, install random packages without checking and haven't updated my browser this year? Maybe I do everything right but don't have off-device backups, availability is also a security property.
I am not saying the cloud is better, I am saying the cloud is better depending on the threats you reasonably anticipate. Let's take emails as a common example, everyone and their mother use the cloud (that's where webmail lives), you trust your email provider be it gmail, proton or aol.com to not only access your private information but more or less take over most accounts and do a lot of serious damage to your life. Now if you trust google with gmail, why would you not trust them with gcp? Again, I am not pro-cloud, I am just laying out the concept of having a threat model.
Can you reasonably expect some threat actor to target or opportunistically compromise a security property you value with respect to spcific information? Is it more cost prohibitive for that threat actor to acheive their goals in a cloud VM or on your laptop?
Let's say your threat actor is someone you live with or someone that could harm you physically, that is different than someone doing a perimeter attack which is also different than someone targeting you with exploits and social engineering lures without even bringing up their specific capabilities.
In general, if you are hiding from the government of the cloud provider or you have reason to distrust the employees of the cloud provider (be it intent or competence) your PC might indeed be more secure. But realistically and objectively, a cloud provider will have better security both from defaults and monitoring perspective.
I use to share OPs sentiment but I repeated the terms "reasonably" and "reason" because the more I learned the more I realized how suspicion,intuition and hypotheticals are not enough to measure risk. You need a a vulnerabilty and exposure and you need motives and incentives for humans that will gain from exploiting them.
Yes, the NSA can hack my ec2 using a bunch of 0days but what they have to gain as a result if that is not worth burning a 0day or even the time and effort of a paid human. Even for bored kids showing off it isn't valuable (interesting) enough.
> When it comes to data storage, security is a big concern. No matter what information you store, you want to make sure that it is safe and secure. Even trivial information is now worth a lot of money, and it is used to profile users. So you want to make sure that your data is safe Tracking and profiling is rarely what people mean by data safety and usually instead refer to privacy . Privacy != safety. Beyond that, i…
Being tracked and profiled is both an issue of security AND privacy. Being private (i.e. protecting privacy) ensures a higher level of security. Being secure ensures a higher level of privacy. Under many aspects, these are two very correlated concepts. Say, for example, that a user makes it public where they live and when and where they were born. Now it's easier for a bad actor to perform an attack impersonating tha…
It’s really difficult to guarantee the secrecy of IRL factors. Privacy should be valued, but I think it’s hard to reason about any system that attempts to rely on it for security, so they shouldn’t be considered particularly secure.
The only secure computer is one that's unplugged, locked in a safe,
and buried 20 feet under the ground in a secret location... and I'm
not even too sure about that one
-- Dennis Huges, FBI.
> When it comes to data storage, security is a big concern. No matter what information you store, you want to make sure that it is safe and secure. Even trivial information is now worth a lot of money, and it is used to profile users. So you want to make sure that your data is safe Tracking and profiling is rarely what people mean by data safety and usually instead refer to privacy . Privacy != safety. Beyond that, i…
Being tracked and profiled is both an issue of security AND privacy. Being private (i.e. protecting privacy) ensures a higher level of security. Being secure ensures a higher level of privacy. Under many aspects, these are two very correlated concepts. Say, for example, that a user makes it public where they live and when and where they were born. Now it's easier for a bad actor to perform an attack impersonating tha…
Both of those are only incidentally related for a subset of cases. Literal file storage is where security and privacy align. It’s hard to be secure and not private but it’s possible to be private and not secure.
The problem is that a lot of cases of privacy aren’t applicable to security. Like most tracking isn't targeting your address it’s targeting your purchases preferences. Most of the time you can’t own that data, so security is irrelevant. Most of privacy guidelines shouldn’t be around “save your files on IPFS” like the article said since then it’s literally open to everyone and anyone can see the requests for those files, even if google drive can’t sniff them. Is it secure to keep your files in a public p2p system on your personal desktop (which you have to ensure is virus free and doesn’t burn down) instead of s3/GDrive/etc? It would be less private but I wouldn't make strong security claims towards self hosting your files while opening it to the public internet.
Privacy guidelines should instead be “ad block and block tracking scripts” instead. Or “stop using social media publicly”. Much better privacy wins. But privacy is much more ambiguous what a win is. Most people don’t care about ad tracking. Government tracking is usually not a concern until it’s too late, and much harder. Privacy for most people is not letting grandma see your drunk social media posts in college. Or keeping a stalker from finding you. Despite that, “we” the technical community should push people to stop freely giving away data in return for nothing (eg stop tracking JS but keep using Dropbox because it’s useful). The goal is to minimize the size of the data bases that get built around you passively.
Earlier quoted context omitted.
Being tracked and profiled is both an issue of security AND privacy. Being private (i.e. protecting privacy) ensures a higher level of security. Being secure ensures a higher level of privacy. Under many aspects, these are two very correlated concepts. Say, for example, that a user makes it public where they live and when and where they were born. Now it's easier for a bad actor to perform an attack impersonating tha…
> Being private (i.e. protecting privacy) ensures a higher level of security. Being secure ensures a higher level of privacy. Both of those are only incidentally related for a subset of cases. Literal file storage is where security and privacy align. It’s hard to be secure and not private but it’s possible to be private and not secure. The problem is that a lot of cases of privacy aren’t applicable to security. Like…