Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #14307 > unrolled thread

getting started with encryption

Back to article view | Back to comp.lang.php

Contents

  getting started with encryption bill <william@TechServSys.com> - 2014-10-10 14:46 -0400
    Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-10 16:36 -0400
    Re: getting started with encryption John-Paul Stewart <jpstewart@sympatico.ca> - 2014-10-10 18:53 -0400
    Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 09:07 +0200
      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 07:59 -0400
    Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 10:36 -0400
      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 10:42 -0400
        Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 11:45 -0400
        Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 18:38 +0200
          Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 15:16 -0400
            Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 10:53 +0200
              Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:17 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 08:47 -0400
                  Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:04 -0400
                    Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:13 -0400
                    Re: getting started with encryption "J. Clarke" <jclarkeusenet@cox.net> - 2014-10-12 15:12 -0400
                      Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 21:45 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:53 +0200
                  Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 10:07 -0400
                    How - off topic bill <william@TechServSys.com> - 2014-10-12 11:05 -0400
                      Re: How - off topic "J.O. Aho" <user@example.net> - 2014-10-12 17:27 +0200
                      Re: How - off topic Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:23 +0000
                        Re: How - off topic Tim Streater <timstreater@greenbee.net> - 2014-10-12 18:49 +0100
                      Re: How - off topic bill <william@TechServSys.com> - 2014-10-13 09:24 -0400
                  Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:01 -0400
                    Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:19 -0400
                      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:38 -0400
                        Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:18 -0400
                          Re: getting started with encryption - now off topic with gratuitous insults bill <william@TechServSys.com> - 2014-10-13 10:36 -0400
                            Re: getting started with encryption - now off topic with gratuitous insults Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:14 -0400
          Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:15 -0400
            Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:52 +0200
              Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:17 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 17:45 +0200
                  Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:58 -0400
                    Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:23 -0400
                      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 10:44 -0400
                        Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:20 -0400
                    Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-15 21:52 +0200
                    Re: getting started with encryption gordonb.1o7q6@burditt.org (Gordon Burditt) - 2014-10-16 12:13 -0500
                      Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-16 15:25 -0400
                        Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 08:13 -0400
                      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 07:52 -0400
                        Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-18 14:46 +0200
                          Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-19 07:47 -0400
    Re: getting started with encryption Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:30 +0000
      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:59 -0400

Page 3 of 3 — ← Prev page 1 2 [3]

#14360

gordonb.1o7q6@burditt.org (Gordon Burditt) writes:

>>> Don't matter, it's still insecure and untrustworthy, even if you
>>> use SSL on the intranet web server, but I do recommend usage of
>>> SSL even in an internal network, as not only outsiders may be
>>> keen on mischief, many times you have someone internally who is
>>> the bad guy or assisting someone outside.
>> 
>> In this case, the only inside people are the ones with access 
>> privileges already
>
> Really?  Does that include the janitor?  The guy who sprays for
> termites and roaches?  Patients?  Children of employees?  Burglars?
>
>> The key is then kept in a mySQL MEMORY engine table and
>> the table is DROPed at logout
>> 
>> This would protect against server theft - unless they steal the 
>> UPS too.  No one but the superuser knows the key. (of course the 
>> key needs to be kept in a secure place... just in case)
>
> You *DO* have encrypted swap, don't you?  Otherwise you don't have
> protection for the key in a MEMORY table.
>
> There are also supposed to be some techniques for freezing the
> memory to lengthen the retention time to hours after power-off, but
> there are likely only a few people who can do that well.
>
> The regulations for medical information are complicated enough that
> even if the information *IS* safe, you can still get in trouble for
> not being able to *PROVE* it's safe.  You're taking risks similar
> to having unprotected sex with an Ebola patient.  Even if you survive
> the disease, you're likely to have everything in your house burned.
> You probably need a lawyer as a project leader for this project.
> And don't let programmers not certified in handling medical information
> work on the code, or even read it.

This is a pretty cool link that popped up on HN yesterday:

http://catalyzeio.github.io/policies/

-- 
Matthew Carter (m@ahungry.com)
http://ahungry.com

[toc] | [prev] | [next] | [standalone]

#14362

On 10/16/2014 3:25 PM, Matthew Carter wrote:
...
> This is a pretty cool link that popped up on HN yesterday:
>
> http://catalyzeio.github.io/policies/

Thank you Matthew

-bill

[toc] | [prev] | [next] | [standalone]

#14361

On 10/16/2014 1:13 PM, Gordon Burditt wrote:
>>> Don't matter, it's still insecure and untrustworthy, even if you
>>> use SSL on the intranet web server, but I do recommend usage of
>>> SSL even in an internal network, as not only outsiders may be
>>> keen on mischief, many times you have someone internally who is
>>> the bad guy or assisting someone outside.
>>
>> In this case, the only inside people are the ones with access
>> privileges already
>
> Really?  Does that include the janitor?  The guy who sprays for
> termites and roaches?  Patients?  Children of employees?  Burglars?

no janitor. Janitorial is done be a staff member.
Anyone else is accompanied when not if the public space.
BTW: no termites or roaches
Patients are always with a therapist when in the non-public spaces.
Children of employees are not permitted.
Burglars are not "inside people."
Building has an alarm (which is bypassable, I know)
>
> You *DO* have encrypted swap, don't you?  Otherwise you don't have
> protection for the key in a MEMORY table.
>
Good point, although system has enough memory and a very stable 
load so does not swap.

[toc] | [prev] | [next] | [standalone]

#14363

On 18/10/14 13:52, bill wrote:
> On 10/16/2014 1:13 PM, Gordon Burditt wrote:

>> You *DO* have encrypted swap, don't you?  Otherwise you don't have
>> protection for the key in a MEMORY table.
>>
> Good point, although system has enough memory and a very stable load so
> does not swap.

Swap ain't last resort memory, it's used a lot earlier than that. 
Default in linux is a swapiness of 60%, which means that when memory is 
used up to 60%, then the system starts to swap things.

-- 

  //Aho

[toc] | [prev] | [next] | [standalone]

#14364

On 10/18/2014 8:46 AM, J.O. Aho wrote:
> On 18/10/14 13:52, bill wrote:
>> On 10/16/2014 1:13 PM, Gordon Burditt wrote:
>
>>> You *DO* have encrypted swap, don't you?  Otherwise you don't
>>> have
>>> protection for the key in a MEMORY table.
>>>
>> Good point, although system has enough memory and a very stable
>> load so
>> does not swap.
>
> Swap ain't last resort memory, it's used a lot earlier than that.
> Default in linux is a swapiness of 60%, which means that when
> memory is used up to 60%, then the system starts to swap things.
>
Thank you, I appreciate your concern.

william@ubuntu2:~$ free -h
              total       used       free     shared    buffers 
    cached
Mem:          1.5G       1.0G       493M        11M       181M 
     679M
-/+ buffers/cache:       150M       1.3G
Swap:         3.7G         0B       3.7G

I appear to be running on the edge.

-bill

[toc] | [prev] | [next] | [standalone]

#14338

On Fri, 10 Oct 2014 14:46:01 -0400, bill wrote:

> It has been decided that encrypting patient notes would be a good idea. 
> I anticipated this when I wrote the original code and all patient note
> writes go through a null (now) function and all notes to be read,
> likewise.

There's an on-line crypto course run out of stanford under the coursera 
umbrella. The most important thing it teaches about crypto is that if you 
attempt it without a very good understanding of what you're doing, you 
will invariably fail to protect anything.

Bottom line - the customer is either willing to pay for certified secure 
applications developed by appropriate experts, or they don't need crypto. 
There really is no middle ground on this.

-- 
Denis McMahon, denismfmcmahon@gmail.com

[toc] | [prev] | [next] | [standalone]

#14344

On 10/12/2014 1:30 PM, Denis McMahon wrote:
> On Fri, 10 Oct 2014 14:46:01 -0400, bill wrote:
>
>> It has been decided that encrypting patient notes would be a good idea.
>> I anticipated this when I wrote the original code and all patient note
>> writes go through a null (now) function and all notes to be read,
>> likewise.
>
> There's an on-line crypto course run out of stanford under the coursera
> umbrella. The most important thing it teaches about crypto is that if you
> attempt it without a very good understanding of what you're doing, you
> will invariably fail to protect anything.
>
> Bottom line - the customer is either willing to pay for certified secure
> applications developed by appropriate experts, or they don't need crypto.
> There really is no middle ground on this.
>
Thanks Denis.  I will check out the Stanford course.

-bill

[toc] | [prev] | [standalone]

Page 3 of 3 — ← Prev page 1 2 [3]

Back to top | Article view | comp.lang.php

csiph-web