Slashdot Mirror
Calif. Attorney General: We Need To Crack Down On Companies That Don't Encrypt
tsamsoniw writes "California Attorney Kamala Harris says her office will start cracking down on companies in the Golden State that don't encrypt customer data and fall victim to data breaches; she's also calling on the state to pass a law requiring companies to use encryption. That's just one of the recommendations in the state's newly released data breach report, which says 131 companies in California suffered data breaches in 2012, affecting 2.5 million residents."
ROT13 FTW!!!
We Need To Crack Down On Companies That Do Encrypt
We have reached the point in time where attorneys general have realized that companies need to encrypt customer data? Either that happened faster than I expected or I'm getting old faster than I realized.
encrypted or the credit card companies won't do business with you. (PCI compliant or something like that)
That leaves social security number and email address/password, but really, you should not use the same password for your Gmail account and Oily Pete's V1agra Online. As for social security, never give it out to anyone under any circumstances unless it's a bank (real one, not a Nigerian prince bank) and you're asking for a loan or opening a checking account.
Just drill that into the head of the IQ challenged members of society and we won't need yet another gov't agency trying to control what people do on the internet.
Server side encryption in could is no good. It prevents Calvin reading Susy's diary, but nothing much more than that.
And no proprietary closed up systems, but publicly verifiable implementations end to end, or it's not even worth trying to get people trust on it.
...and how would provider-side encryption be helpful if keys were needed to be distributed across all of the data backends?
Usually at some point the server needs to be able decrypt the data so it can be displayed to a user, so the key needs to be handy. So if you have the key and data on the same sever it's of little security value.
If you want to have this data in some kind of database, there is a good chance you want to be able to search and index this data. Possible to index and pre-sort encrypted data without giving away the content?
Yes, maybe encrypt some sensitive parts, but encrypting all customer data is counter productive.
Don't just encrypt private details.
Get rid of users private data, so there is nothing to steal in the first place.
Use eccentric authentication*. Replaces passwords with anonymous client certificates.
Check my: http://eccentric-authentication.org/
Create new column types called varhcar2rot13 where the data is inserted it gets a ROT13 encryption applied when read out it automaticly decrypts it.
Sell to California companies for major money.
We need to crack down on government agencies that spy.
The NSA can legally collect encrypted data.
...and in other news, CA police will be cracking down on people who don't lock their house doors and who don't lock their car doors.
Using encryption is easy. Managing the encryption keys, not so much. The number of developers I see posting questions (to StackOverflow) on encryption with NO IDEA on basic key management is very worrying.
Using encryption is easy. Managing the encryption keys however, not so much. The number of developers I see posting questions (to StackOverflow) on encryption with NO IDEA on basic key management is very worrying.
Out of protest I'll change all encryption to SHA-0. Encryption is encryption right? or Perhaps a simple algorithm where reversing characters and letters would work as well. A becomes Z and 1 becomes 9. 0? Well, it has no choice but to become imaginary.
As a web developer pushing out low-cost websites to small businesses that can and do collect sensitive information using COTS software (such as Wordpress etc.), I believe that the relatively high cost of SSL certificates is a big barrier to wide-scale adoption. We can do this stuff easily, but adding another 15-20% for a domain wide SSL certificate is a tough sell in today's market.
If anyone knows of a PROVEN low cost solution, I'd be extremely interested to hear about it.
She seems to make a good point, and according to The Wiki she's pretty hot. I feel bad for her significant other (assuming she has one), I bet she's totally nuts.
I want to delete my account but Slashdot doesn't allow it.
I disagree, a certificate from a US company is necessarily less trustworthy than one from a website. Because the websites, at least the ones not in the US (UK?) are NOT subject to hidden unchallenged orders from secret courts and so their certificates signed by themselves is more trustworthy than the certificate authority in the US jurisdiction that IS subject to these courts.
All that adding a certificate authority to that mix does, is to enable a potential man-in-the-middle-attack. Jitsi does work fine, I sort of wish I didn't have to click to tell it to check the fingerprint, but OTR does work and is better than nothing. LIkewise OTR system should be in place for email where the remote key is known. It's ridiculous that email mostly travels unencrypted!
A self signed cert is better than no encryption. Self signed sites should be the norm now, where an unsigned site would previously be used, we should have a self signed one.
Two things are needed for a HTTPS attack:
First, control of the routing to do a man-in-the-middle attack, NSA clearly has that with direct cooperation of the Telcos thanks to the immunity. The immunity law means Telcos disobey the laws of Congress and States and obey the military orders, with immunity, making them part of the military infrastructure, outside legal boundaries.
Second, cooperation of a certificate authority. Very highly likely given the way the FISA court behaves and the nature of secret laws and secret courts that military can fake certificates. Hence certificates need to be untrusted. If General Alexander gets his way and gets immunity for all companies that do NSA's bidding, you are screwed.
I tried deleting the US cert authorities in Firebox, but it isn't possible. They are built in. Currently I'd like a way to remove all of them, and I'll trust a site based on it's trace-route, so if a connection to a site in Germany starts making a detour via UK or USA, I'll decline the new certificate. Once I accept a cert from them, I'd like to be warned if the cert changes so I can recheck the trustworthiness of the site, by checking if its making any extra detours.
I don't want the over the top warning in Firefox. If you disagree Mozilla fine, but this is what I want and I'm looking for a browser that does it. When one arrives Firefox is gone.
I'm with GP who wants this over the top self signed error removed.
Good laws of this sort are those which do not impose technical solutions but rather provide general systems level requirements.
The problem with "duh use encryption" there is no guarantee of any kind simply applying encryption makes a system more secure against a specific threat.
Every time you get into the weeds you are guaranteed to codify errors and hurt those who choose to innovate using different but better or equally valid approaches.
I've dealt with cleaning up some nasty data breaches over the years, I've had conversations with Attorney Generals when the breaches were bad enough. Companies fear Attorney Generals about as much as they fear being on the wrong end of the international news.
I've been involved with companies where data breaches happen where Attorney Generals while and while not get involved. The difference is night and day for things like encryption, notification of consumers, risk mitigation and other such steps. Pause and think about it for a moment, do you really think California is breached that much more often than other locations, or do people simply find out because the companies fear being on the wrong end of the Attorney Generals pointy stick?
Attorney Generals that give a damn are good things, they give the security professionals at the companies in their states the leverage they need to actually do the things that they want to do (encryption etc).
He was given the questions a day in advance. Sorry, lying to congress is a felony.
Tradition normally holds that a person who does a bad act is the guilty party. These days that is becoming rather twisted. If a person steals data then doesn't the guilt fall upon the thief? What they are doing is similar to the rather absurd gun law that can find a person negligent for simply using one lock to secure a gun. A home owner locks his windows and doors and drives off to the market. Mr. bad guy breaks in the back door and steals the gun and later that day shoots someone. Out of the blue the law also comes down hard on the home owner for not using enough security of that firearm. Frankly it is not good policy. All of the guilt falls upon the bad guy who broke in according to me. If anything the police department shares some of the guilt as they failed to protect my home. The general public also shares the guilt when they pass laws that make it next to impossible to deal with bad people. But whether it is data or guns I think the thief is the one who should pay.
If there is room for guilt it would be in situations such as a finance company dumping records in a dumpster completely neglecting to shred the records. As it is understood that dumpster diving is legal and a common practice.
Society seems to avoid punishing the guilty.
We need to make companies liable for any information they are so careless as to lose. Intruding on their business process is the wrong way to go about it: punitive liability judgements (and tighter disclosure laws) are the right way.
Part of the problem here is this horribly mistaken meme that everyone and everything is hackable. It makes people feel not responsible, and it's only true in the sense that evert newborn baby has started dying, or that the universe will cool/stop. Not concerned with this meme? Well, your country is spending billions on stupid and futile "cyber-warfare" efforts, rather than simply buttoning up the security of the electrical grid, banking network, etc.
Our goal should be for companies to think of sensitive customer data like radioactive waste: they want to ship it elsewhere, not have it sitting around in unsealed, leaky barrels in their offices. Secure access to data is obviously a specialized skill, so why not have companies devoted to doing that alone?
thanks.
If the server gets physically stolen its likely the crypto hardware will be stolen with it. If you store the key somewhere it can be automatically obtained and used then the key can be stolen too, if you enter the key manually on bootup (ie how you would on a laptop) then you require physical intervention if the server reboots for any reason.
Unless you use a mechanism to store the key/s seperately from the dat:
http://en.wikipedia.org/wiki/Key_Management_Interoperability_Protocol
It is certainly a trick problem, but I think that if you pass a law that mandates things with a decent time frame (18 months?), then you'll see that people will find solutions. California is the home of Silicon Valley after all, and I'm sure there are plenty of egg heads that can deal with this. It may be that the entire industry will benefit, as those same egg heads will start providing the solution else where (either as products or open source).
... are essential to the servers that handle the data. They can't actually operate on the encrypted data. They have to UN-encrypted it first (and RE-encrypted it to put it back if there any changes). So what does this mean to me? It means I have to grab the encryption key(s) when I break in to get the data.
This reminds me of an incident with a state web site. Someone broke in and did some defacing. The state's top IT director answered a reporter's query with "This needs to be investigated because we bought a top of the line firewall that should have blocked the hacker".
now we need to go OSS in diesel cars
.... nothing to the NSA
How many mails have you received that were official and digitally signed (not a signature)?
I work in a company where people are pretty security savy, but email somehow is an exception.. When I ask how they know the mail came from John Doe, they tell it is sure because the email address is John.Doe@example.com.
When I ask them how person X knows that it came from our company, the answer is "Because the email address is info@example.com.". So while IT enjoys themselves to add useless disclaimers (I AM the intended person to receive it. Otherwise I would not have gotten it. It might that you did not intend it on your end, but that is YOUR problem.) instead of adding digital signatures, I must change my password every 37 minutes, so I must write it down and the whole thing becomes LESS secure.
As long as IT people treat security as a technical and not a social issue, this will never be solved.
Don't fight for your country, if your country does not fight for you.
It's not the governments place to decide how a company handles data. They should encourage them and even provide a few tools (think DES and AES) but it's up to the organization to do their own risk analysis. If they fail to protect the right stuff, they should be shunned by consumers.
This is something that would greatly hurt small businesses with small IT budgets, they have it hard enough already.
Governemnt has their paws in too much already. Companies need to encrypt, and if they fail, Anonymous will expose them, but government goons best stay out of our business because we are sick and tired of your antics.
This is way, way, way overdue. Due diligence is what it is. And not encrypting sensitive data is not due diligence.
In SOVIET RUSSIA... erm...NSA AMERICA, the Internet logs onto YOU!
How many people call their bank and check the SSL's fingerprint? Nope, we just trust the CAs. How weird.
It's the Riddle of the Correct CA.
The CAs have neglected to create a solution for that. Now we are left to trust them. Trust that gets abused by the least secure of the bunch...
See: http://eccentric-authentication.org/eccentric-authentication/threat_model.html at threat #2.