* It has been shown to be theoretically possible under the right conditions to recover data from "shadow bits"-- detectable differences in over all magnetic moment from a bit on the disk. This was demonstrated in 1995 by Peter Gutman.
* It is widely believed that modern disk technologies and densities make such methods much more difficult. However, Heise Security demonstrated that it is still a theoretical possibility, at least for single bytes, though very difficult.
* There are sector remapping technologies which throw all of this out the window. Blindly following the "multi-overwrite" mantra is also ineffective on non-magnetic media.
* For reasons unknown, DoD, NSA, and NIST, as well as the UK's ICO all require varying degrees of overwrite and / or destruction. The NSA / DoD specifically indicate that overwrites are OK only when the disks will be repurposed in the same security area. I'll leave it to you to determine if you know more than they do.
Security is highly based upon theory. That is, we trust encryption schemes like AES because there is a strong degree of confidence that it will remain very difficult to crack for many years to come. When "theoretical" holes are discovered, they are treated very seriously because the entire point of such security is to defeat a determined, well funded attacker. Security schemes which do not defeat determined attackers are little better than "do not burgle" signs on your door.
With that in mind, it is incredible that people would suggest things like drilling a hole through a drive when it is clear that that would not prevent a determined attacker from recovering data Worst case, fill the hole with epoxy and sacrifice that quarter of the platter, you can still recover ~75% of the data. Appeals to the difficulty or expense of the recovery are not statements on security, and when a degausser can guarantee security in roughly the time it would take to drill press the drive, its astonishing that people would even suggest it.
Some of the suggestions here are akin to recommending turning off WiFi beacons or using MAC security on your AP. They sound cool, they have the appearance of working, but they are in reality snake oil; a determined attacker will simply ignore them.
Not everyone agrees with Stallman's theory that he should get to dictate what license developers use, but then you knew that when you dropped that bit of trollbait.
IMO, freedom means you can choose not to use Skype, or Windows, or OSX, or anything else, and since Skype is both free and available with alternatives, its really no skin off anyones back whether you use it or some XMPP based program. Honestly, you're probably better off on XMPP in any case.
Because it cant be automated, it creates a huge mess, cant be done in office space (unless you like cleaning up fine bits of aluminum, epoxy, and steel), and requires a decent drill.
secure: definitely, no hard disk has ever been physically reconstructed that had holes in the platters
Not correct, and its not even a little difficult. A contiguous multi-inch stripe of a modern HD platter contains gigs of data. The only challenge is going to be fragmentation, but with a single hole the file table is probably intact.
You're basically relying on the high cost and inconvenience-- the hole through the disk renders the existing casing + chipset inoperable, but does nothing to affect 99% of the actual data on the disk. An attacker with the right sort of enclosure could simply read the data right off of the platters, very little reconstruction necessary.
And while you you would be right to take any such self-interested claims with a grain of salt, its worth noting that several recovery companies (Kroll, Centrex) indicate that such recoveries are possible, and that a number of national regulations in both the US and the UK mandate very particular forms of physical destruction, notably where the entire surface of the drive is affected (shredding, grinding, degaussing).
But hey-- if you want to argue with the DoD, NIST, Kroll, and the UK Information Commissioner's Office, all so that you can use a messy and non-compliant form of destruction-- go for it. Have fun explaining to federal regulators why you felt it was best to ignore both the experts and federal law regarding private information.
You'd be better off degaussing, if youre gonna shred it anyways. Doing 7 overwrites is gonna take longer than just tossing the drive in a degausser and being done with it.
Whether or not data can be recovered off of wiped (overwritten) disks is a subject of great speculation. The answer seems to be "theoretically, but we dont know of anyone who's done it". If you're comfortable with that, fine.
If you're in China, they also record your calls (TOM Skype).
You should not be using Skype for anything that you dont want a nationstate to hear, full stop. Microsoft is one of a number of companies known to cooperate in surveillance requests in countries like China.
Okay, Thorium reactors also breed some highly radioactive byproducts. Now, the UPSIDE of this is, they're so "hot", that they decay down in a matter of days/weeks/months/years instead of "tens of thousands of years".
Some quick reading indicates that those hot byproducts decay into U-233 which has a halflife that IS in the hundreds of thousands of years. I wasnt able to find whether U-233 can be used in a reactor or if you have to store the stuff.
Not clear why you would use an encryption scheme to do hashing, though-- my understanding is that while both should have good hash characteristics (small changes in plaintext should cascade into large changes in the secured form), purpose-designed hash algorithms will generally be more resistant to attack than encryption schemes, and often faster.
Why wouldnt they have used MD5 back when DES Hash was used?
Anyone want to clarify what the problem with thorium is? There is obviously some amount of downside here. I've heard "it can generate weapons grade plutonium", but thats true whether or not you use it; just as we are choosing now not to use it, we could hypothetically use it and choose not to create weaponry from it.
Theres value to be had if you use advanced CPU features, because all AMD processors tend to have the high-end features (ECC support, etc). Intel charges you through the nose if you want that stuff-- think that Pentium has virtualization support or AES-NI? The AMD sure does.
Great, so we can proceed onto a fragmented internet, with China, Russia, India, Brazil, Iran, and the Western world all having their own private enclaves.
No, its a bad precedent, and you can now look forward to China / Russia / India issuing subpoenas for things like email inboxes and documents stored on the cloud for US citizens.
Ive never really gotten how slashdot has so many people with apparent astigmatism, only able to see the close up things and always missing the bigger picture.
Slashdot Mirror
By that logic, you pay taxes for absolutely no benefit whatsoever.
No, its not. They generally have root access even if its your modem.
The customer should buy the modem, otherwise theyre liable to get hit with a hidden $5/mo surcharge.
Really it IS customer equipment, and if you insist on their modem you're gonna get crap.
This discussion gets kicked around a lot, and it astonishes me how much assumptions are kicked around in a security-focused discussion.
Superuser has a good write up on this.
Heres the TL;DR:
* It has been shown to be theoretically possible under the right conditions to recover data from "shadow bits"-- detectable differences in over all magnetic moment from a bit on the disk. This was demonstrated in 1995 by Peter Gutman.
* It is widely believed that modern disk technologies and densities make such methods much more difficult. However, Heise Security demonstrated that it is still a theoretical possibility, at least for single bytes, though very difficult.
* There are sector remapping technologies which throw all of this out the window. Blindly following the "multi-overwrite" mantra is also ineffective on non-magnetic media.
* For reasons unknown, DoD, NSA, and NIST, as well as the UK's ICO all require varying degrees of overwrite and / or destruction. The NSA / DoD specifically indicate that overwrites are OK only when the disks will be repurposed in the same security area. I'll leave it to you to determine if you know more than they do.
Security is highly based upon theory. That is, we trust encryption schemes like AES because there is a strong degree of confidence that it will remain very difficult to crack for many years to come. When "theoretical" holes are discovered, they are treated very seriously because the entire point of such security is to defeat a determined, well funded attacker. Security schemes which do not defeat determined attackers are little better than "do not burgle" signs on your door.
With that in mind, it is incredible that people would suggest things like drilling a hole through a drive when it is clear that that would not prevent a determined attacker from recovering data Worst case, fill the hole with epoxy and sacrifice that quarter of the platter, you can still recover ~75% of the data. Appeals to the difficulty or expense of the recovery are not statements on security, and when a degausser can guarantee security in roughly the time it would take to drill press the drive, its astonishing that people would even suggest it.
Some of the suggestions here are akin to recommending turning off WiFi beacons or using MAC security on your AP. They sound cool, they have the appearance of working, but they are in reality snake oil; a determined attacker will simply ignore them.
Not everyone agrees with Stallman's theory that he should get to dictate what license developers use, but then you knew that when you dropped that bit of trollbait.
IMO, freedom means you can choose not to use Skype, or Windows, or OSX, or anything else, and since Skype is both free and available with alternatives, its really no skin off anyones back whether you use it or some XMPP based program. Honestly, you're probably better off on XMPP in any case.
Because it cant be automated, it creates a huge mess, cant be done in office space (unless you like cleaning up fine bits of aluminum, epoxy, and steel), and requires a decent drill.
secure: definitely, no hard disk has ever been physically reconstructed that had holes in the platters
Not correct, and its not even a little difficult. A contiguous multi-inch stripe of a modern HD platter contains gigs of data. The only challenge is going to be fragmentation, but with a single hole the file table is probably intact.
You're basically relying on the high cost and inconvenience-- the hole through the disk renders the existing casing + chipset inoperable, but does nothing to affect 99% of the actual data on the disk. An attacker with the right sort of enclosure could simply read the data right off of the platters, very little reconstruction necessary.
And while you you would be right to take any such self-interested claims with a grain of salt, its worth noting that several recovery companies (Kroll, Centrex) indicate that such recoveries are possible, and that a number of national regulations in both the US and the UK mandate very particular forms of physical destruction, notably where the entire surface of the drive is affected (shredding, grinding, degaussing).
But hey-- if you want to argue with the DoD, NIST, Kroll, and the UK Information Commissioner's Office, all so that you can use a messy and non-compliant form of destruction-- go for it. Have fun explaining to federal regulators why you felt it was best to ignore both the experts and federal law regarding private information.
You're talking about an attack that has never been publicly demonstrated, and you think a $1000 offer is sufficient to prove its infeasibility? Cute.
No that's what security people...will tell you
By all means dont ever listen to THOSE people.
You'd be better off degaussing, if youre gonna shred it anyways. Doing 7 overwrites is gonna take longer than just tossing the drive in a degausser and being done with it.
A drill press, while flashy, is simultaneously less secure, convenient, and available than a wipe, all while being more expensive.
Whether or not data can be recovered off of wiped (overwritten) disks is a subject of great speculation. The answer seems to be "theoretically, but we dont know of anyone who's done it". If you're comfortable with that, fine.
Courts have ruled that it is not possible to steal something from yourself, so they are mutually exclusive.
Assange leaked a whole bunch of diplomatic cables aside from the war logs. That comment is highly misleading.
Thats because the fine people at Reddit decided to post fake reviews without having been a customer, which jacks the system up for everyone.
If you're in China, they also record your calls (TOM Skype).
You should not be using Skype for anything that you dont want a nationstate to hear, full stop. Microsoft is one of a number of companies known to cooperate in surveillance requests in countries like China.
Okay, Thorium reactors also breed some highly radioactive byproducts. Now, the UPSIDE of this is, they're so "hot", that they decay down in a matter of days/weeks/months/years instead of "tens of thousands of years".
Some quick reading indicates that those hot byproducts decay into U-233 which has a halflife that IS in the hundreds of thousands of years. I wasnt able to find whether U-233 can be used in a reactor or if you have to store the stuff.
The more you know...
Not clear why you would use an encryption scheme to do hashing, though-- my understanding is that while both should have good hash characteristics (small changes in plaintext should cascade into large changes in the secured form), purpose-designed hash algorithms will generally be more resistant to attack than encryption schemes, and often faster.
Why wouldnt they have used MD5 back when DES Hash was used?
I think that argument just got settled with this story - and I won.
The article doesnt actually specify.
The article isnt clear how it was detected-- automated tools, or not.
I would find it a little hard to believe that there are positions at google paid to peruse people's inboxes.
Anyone want to clarify what the problem with thorium is? There is obviously some amount of downside here. I've heard "it can generate weapons grade plutonium", but thats true whether or not you use it; just as we are choosing now not to use it, we could hypothetically use it and choose not to create weaponry from it.
Is the tech not there yet, or what?
AFAIK electronics react rather poorly to radiation.
DES isnt a hash, its a Data Encryption Standard.
Theres value to be had if you use advanced CPU features, because all AMD processors tend to have the high-end features (ECC support, etc). Intel charges you through the nose if you want that stuff-- think that Pentium has virtualization support or AES-NI? The AMD sure does.
Great, so we can proceed onto a fragmented internet, with China, Russia, India, Brazil, Iran, and the Western world all having their own private enclaves.
Great idea!
No, its a bad precedent, and you can now look forward to China / Russia / India issuing subpoenas for things like email inboxes and documents stored on the cloud for US citizens.
Ive never really gotten how slashdot has so many people with apparent astigmatism, only able to see the close up things and always missing the bigger picture.