61–70 of 153 posts
https://www.bloomberg.com/opinion/articles/2022-09-20/morgan...
Last year Morgan Stanley got rid of old computers without wiping them, they were auctioned by the moving company, and it ended up costing Morgan Stanley $35 million in fines.
Earlier quoted context omitted.
For an actual HDD, maybe that would work. For any solid state drive, it would definitely not work. SSDs and similar spread writes across pools of blocks for 'endurance', so a 1TB drive might actually have 2TB worth of flash on it.
> For an actual HDD, maybe that would work. It doesn't work as well as you'd think on spinning platters, either. Although it does increase the amount of effort needed to read the data on them.
> The irony is that shredding devices is relatively risky today. The latest drives have 500,000 tracks of data per square inch. A sophisticated data recovery person could take a piece as small as 3mm and read the data off it, Mr Hands says. I call bullshit on this, unless you can show me a single example of this ever happening anywhere.
My friend once worked at a place where the security policy was that every part of the PC including monitors was crushed and shredded. This was a financial services company, but nevertheless totally over the top.
Surprised it doesn't mention compliance frameworks as a culprit. NIST 800-88 calls for destruction if the data is highly sensitive and the drive is leaving the organization. Wrt risk management, it's not worth deviating from NIST. https://tsapps.nist.gov/publication/get_pdf.cfm?pub_id=91793...
This isn't a sarcastic remark: I think a lot of human activity can be explained this way.
Now why don't these companies keep the drives in-house instead of destroying? That, I don't know. But aside that, regarding the encryption... If you used the drive without encryption at any time, then its possible to recover the unencrypted data. You'd need to guarantee that your drives were *always* used with encryption from the start to end. And that's a hard guarantee. So yeah, if they were leaving the org, I'd de…
> Now why don't these companies keep the drives in-house instead of destroying? That, I don't know. Keep them and do what with them? If you're an enterprise running many disks, you're generally replacing them with higher capacity disks and the old disks are less useful. Or maybe you have some policy on retiring drives based on age or ssd wear. Or maybe you eliminated a storage tier for whatever reason.
If we had to replace a drive in a computer (or upgrade it from a HDD to SSD), we had to purchase a new drive. We were not allowed to re-use a drive. However, we could re-issue an entire computer to another user.
Makes zero sense, but that's what the compliance industry came up with. It's a money-making deal for everyone involved, except the companies that need to comply with it.
Earlier quoted context omitted.
Okay, but a single pass of /dev/zero will destroy all the data beyond hope of recovery.
Falsehoods like this spreading through populations that consider themselves technically literate is one reason the NIST standard requires absolute destruction. There are methods available that will allow recovery of second, third or even fourth generation data to be recovered from magnetic disks. Writing /dev/zero "over" an SSD won't necessarily accomplish what you expect either.
The data is *gone*.
There is no way to recover it. If you know anything about how hard disks work, you'll see why.
There's this theoretical idea that you can get a kind of "latent image" of a mark or a space on the platter even if it's been overwritten, but hard disks haven't written things as literal north-to-south or south-to-north flips for 30 years or so. The data is written as changes of level and phase in a signal, and it's thoroughly scrambled to reduce the chances of a long run of patterns of all zeroes or all ones making the signal hard to recover.
Essentially, you'd be taking a list of floating point numbers, multiplying them all by another much smaller floating point number, adding on another floating point number, and trying to imagine what the original was.
It's not possible.
No, the NSA does not have a big magic machine that does it.
Relevant Matt Levine article: https://www.bloomberg.com/opinion/articles/2022-09-20/morgan... Last year Morgan Stanley got rid of old computers without wiping them, they were auctioned by the moving company, and it ended up costing Morgan Stanley $35 million in fines.
Earlier quoted context omitted.
>hardware, or performance, or storage space, or power consumption or whatever are too high I just upgraded my 10 year old laptop because I wanted to do AI Art locally. I ran video games, CAD, cellphone emulators, my programs, etc... on this computer and it still works. Heck, I still use it in a different room now. Its not the 2000s anymore, we don't need tons of processing power to open web browsers and M$ Office. De…
A typical office laptop is pretty useless after about five years. Even if the standard consumer stuff works fine, all the annoying enterprise security and remote management software that you're required to deploy just seems to suck up more and more resources every year. Unless you're lucky enough to work in an industry where that sort of thing isn't needed... But even if you forget the software side, most office work…
As to bloat and performance, the standard amount of RAM in a laptop has barely budged in over 10 years. In 2012, a typical consumer laptop might have had 8G RAM and the higher end models 16G RAM.
In 2023, a quick search shows basic home laptops still for sale with 4G RAM, and typical consumer laptops around the $1000 price mark come with 16G RAM as standard.
CPU performance has increased a bit in that time, but not by a whole lot, especially single-threaded. An old laptop might be a bit slow, but it's usually RAM and operating system support which makes it obsolescent. Apps and web pages either fit in memory or they don't; the OS you're running either supports the latest app / browser (and thus web pages) or it doesn't.
Earlier quoted context omitted.
Okay, but a single pass of /dev/zero will destroy all the data beyond hope of recovery.
Will it though? What if you had some bad sectors which became unwriteable and now contain sensitive data forever?