Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Encryption at Rest a Scam?

evervault.com

Post reply on HN
Print view View original

11–15 of 15 posts

Re: Is Encryption at Rest a Scam?

#11

Post by ghusto »

dizhn wrote: post #7
fenollp wrote: post #3

Earlier quoted context omitted.

From the article: > Nothing in this diatribe argues that encryption at rest is creating a net negative, outside of it being represented as a be-all and end-all security measure. When I say encryption at rest is a scam, I’m talking about it from the eyes of the purchaser. And given that it’s their data at risk, this is the standpoint that matters.

"not creating a net negative". Blog author doesn't want to commit to anything. What's the point if they're not going to make a point?

The point I read (though he was preaching to the choir) is that

> developers often rely on encryption at rest as a gold standard security measure

and they shouldn't.

Security isn't a list of checkboxes to tick.

Re: Is Encryption at Rest a Scam?

#12

Post by MattPalmer1086 »

The title is a bit click baity. I agree with the basic premise that people and companies often think that encryption at rest provides more protection than it really does.

We should however distinguish between encryption at rest for storage devices and other forms of encryption at rest.

You can also encrypt data at rest at the application or database layers too, and they provide protection against more than just physical access to the storage device.

Like all encryption, it's all about who can get the keys.

Re: Is Encryption at Rest a Scam?

#13

Post by dspillett »

dizhn wrote: post #7
fenollp wrote: post #3

Earlier quoted context omitted.

From the article: > Nothing in this diatribe argues that encryption at rest is creating a net negative, outside of it being represented as a be-all and end-all security measure. When I say encryption at rest is a scam, I’m talking about it from the eyes of the purchaser. And given that it’s their data at risk, this is the standpoint that matters.

"not creating a net negative". Blog author doesn't want to commit to anything. What's the point if they're not going to make a point?

The point is that while “not creating a net negative”, is it still creating the net positive that providers claim and in some cases want you to pay for.

Significantly: there are a whole host of risks that is doesn't mitigate, that it is not intended at all to mitigate, that people who don't know any better might assume are dealt with when things are pushed as secure “because the data is encrypted at rest”. If you read TFA you'll see that it details some of these concerns.

Re: Is Encryption at Rest a Scam?

#15

Post by CodexArcanum »

Seems like a fine point, I guess, but this article exists mainly as a Trojan horse for that nerd-sniping "encryption by proxy" link. You go "Never heard of that, what is it?" And click and surprise! It's the thing they're selling to you!

Which is, hilariously, send us your data and we'll encrypt it for you! Very secure, much privacy.

Post reply on HN