Re: getting started with encryption

From	Matthew Carter <m@ahungry.com>
Newsgroups	comp.lang.php
Subject	Re: getting started with encryption
Date	2014-10-16 15:25 -0400
Organization	Ahungry (http://ahungry.com)
Message-ID	<87r3y7ddgn.fsf@mcarter.techni-serve.com> (permalink)
References	(5 earlier) <c9vfbuF5eg6U1@mid.individual.net> <m1e62v$99h$1@speranza.aioe.org> <c9vm0pF76n1U1@mid.individual.net> <m1giau$n43$1@speranza.aioe.org> <U-6dnRtm7-JJYaLJnZ2dnUU7-U-dnZ2d@posted.internetamerica>

Show all headers | View raw

gordonb.1o7q6@burditt.org (Gordon Burditt) writes:

>>> Don't matter, it's still insecure and untrustworthy, even if you
>>> use SSL on the intranet web server, but I do recommend usage of
>>> SSL even in an internal network, as not only outsiders may be
>>> keen on mischief, many times you have someone internally who is
>>> the bad guy or assisting someone outside.
>> 
>> In this case, the only inside people are the ones with access 
>> privileges already
>
> Really?  Does that include the janitor?  The guy who sprays for
> termites and roaches?  Patients?  Children of employees?  Burglars?
>
>> The key is then kept in a mySQL MEMORY engine table and
>> the table is DROPed at logout
>> 
>> This would protect against server theft - unless they steal the 
>> UPS too.  No one but the superuser knows the key. (of course the 
>> key needs to be kept in a secure place... just in case)
>
> You *DO* have encrypted swap, don't you?  Otherwise you don't have
> protection for the key in a MEMORY table.
>
> There are also supposed to be some techniques for freezing the
> memory to lengthen the retention time to hours after power-off, but
> there are likely only a few people who can do that well.
>
> The regulations for medical information are complicated enough that
> even if the information *IS* safe, you can still get in trouble for
> not being able to *PROVE* it's safe.  You're taking risks similar
> to having unprotected sex with an Ebola patient.  Even if you survive
> the disease, you're likely to have everything in your house burned.
> You probably need a lawyer as a project leader for this project.
> And don't let programmers not certified in handling medical information
> work on the code, or even read it.

This is a pretty cool link that popped up on HN yesterday:

http://catalyzeio.github.io/policies/

-- 
Matthew Carter (m@ahungry.com)
http://ahungry.com

Thread

getting started with encryption bill <william@TechServSys.com> - 2014-10-10 14:46 -0400
  Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-10 16:36 -0400
  Re: getting started with encryption John-Paul Stewart <jpstewart@sympatico.ca> - 2014-10-10 18:53 -0400
  Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 09:07 +0200
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 07:59 -0400
  Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 10:36 -0400
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 10:42 -0400
      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 11:45 -0400
      Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 18:38 +0200
        Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 15:16 -0400
          Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 10:53 +0200
            Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:17 -0400
              Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 08:47 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:04 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:13 -0400
                Re: getting started with encryption "J. Clarke" <jclarkeusenet@cox.net> - 2014-10-12 15:12 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 21:45 -0400
              Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:53 +0200
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 10:07 -0400
                How - off topic bill <william@TechServSys.com> - 2014-10-12 11:05 -0400
                Re: How - off topic "J.O. Aho" <user@example.net> - 2014-10-12 17:27 +0200
                Re: How - off topic Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:23 +0000
                Re: How - off topic Tim Streater <timstreater@greenbee.net> - 2014-10-12 18:49 +0100
                Re: How - off topic bill <william@TechServSys.com> - 2014-10-13 09:24 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:01 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:19 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:38 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:18 -0400
                Re: getting started with encryption - now off topic with gratuitous insults bill <william@TechServSys.com> - 2014-10-13 10:36 -0400
                Re: getting started with encryption - now off topic with gratuitous insults Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:14 -0400
        Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:15 -0400
          Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:52 +0200
            Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:17 -0400
              Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 17:45 +0200
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:58 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:23 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 10:44 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:20 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-15 21:52 +0200
                Re: getting started with encryption gordonb.1o7q6@burditt.org (Gordon Burditt) - 2014-10-16 12:13 -0500
                Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-16 15:25 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 08:13 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 07:52 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-18 14:46 +0200
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-19 07:47 -0400
  Re: getting started with encryption Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:30 +0000
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:59 -0400

csiph-web