Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #14351

Re: getting started with encryption

Show all headers | View raw

On 10/13/2014 10:44 AM, bill wrote:
> On 10/13/2014 9:23 AM, Jerry Stuckle wrote:
> ...
>>>>
>>> What do you think of this:
>>>
>>> At logon, after the user's credentials are verified, the office server
>>> will (over https)
>>> send a token request to a remote server
>>> take the returned token, modify it to use as transaction token
>>> using the transaction token, request the encryption key (the remote
>>> server will verify that the modified transaction token is correct)
>>>
>>> The key is then kept in a mySQL MEMORY engine table and
>>> the table is DROPed at logout
>>>
>>> This would protect against server theft - unless they steal the UPS
>>> too.  No one but the superuser knows the key. (of course the key needs
>>> to be kept in a secure place... just in case)
>>>
>>> -bill
>>>
>>
>> I hope you like a few years of free room and board courtesy of the Feds
>> (or at the very least paying a six or seven figure fine).  HIPAA is NOT
>> something to fool with.
>>
> A) HIPAA is not a criminal statute.
> B) HIPAA auditors look well upon attention paid to blocking intrusions
> (physical or electronic) even when they have failed.
> C) for physical security, a knob in door lock is adequate protection for
> physical files (within a secure building). We know how insecure that is)
> D) HIPAA auditors routinely give practices a 2nd chance after an
> inspection that fails on the condition that the practice fix the
> problems identified.
> 
> I appreciate your attempts to save the practice a big fine, but I
> suggest that as HIPAA compliance is 50% of my job (for which I have been
> trained), I probably know a bit more about it than you do.
> 
> Now, would you like to look at the suggestion above with a critical eye?
> 
> -bill

It all depends on how effective the security precautions were and the
extent of the exposure.  A half-arsed attempt will quickly net a big
fine on the first time.  I know of at least one doctors office which was
using WiFi with WEP encryption.  Now WEP is a known weak encryption, and
not suitable for patients' records.  The Feds assessed a big fine when
they discovered it.  No warning.

And they are clamping down even more with the new Affordable Health Care
(ObamaCare) law.

And no, you do NOT know more about it than I do.  Otherwise you would
not be proposing the solution and asking the questions you are.

You've already been given good advice, yet you make excuses as to why
you won't implement proper security.  So no, I will not waste my time
trying to save your arse any longer.

-- 
==================
Remove the "x" from my email address
Jerry Stuckle
jstucklex@attglobal.net
==================

Back to comp.lang.php | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

getting started with encryption bill <william@TechServSys.com> - 2014-10-10 14:46 -0400
  Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-10 16:36 -0400
  Re: getting started with encryption John-Paul Stewart <jpstewart@sympatico.ca> - 2014-10-10 18:53 -0400
  Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 09:07 +0200
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 07:59 -0400
  Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 10:36 -0400
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 10:42 -0400
      Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-11 11:45 -0400
      Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-11 18:38 +0200
        Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-11 15:16 -0400
          Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 10:53 +0200
            Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:17 -0400
              Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 08:47 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:04 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:13 -0400
                Re: getting started with encryption "J. Clarke" <jclarkeusenet@cox.net> - 2014-10-12 15:12 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 21:45 -0400
              Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:53 +0200
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 10:07 -0400
                How - off topic bill <william@TechServSys.com> - 2014-10-12 11:05 -0400
                Re: How - off topic "J.O. Aho" <user@example.net> - 2014-10-12 17:27 +0200
                Re: How - off topic Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:23 +0000
                Re: How - off topic Tim Streater <timstreater@greenbee.net> - 2014-10-12 18:49 +0100
                Re: How - off topic bill <william@TechServSys.com> - 2014-10-13 09:24 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:01 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-12 11:19 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:38 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:18 -0400
                Re: getting started with encryption - now off topic with gratuitous insults bill <william@TechServSys.com> - 2014-10-13 10:36 -0400
                Re: getting started with encryption - now off topic with gratuitous insults Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:14 -0400
        Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 08:15 -0400
          Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 15:52 +0200
            Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-12 11:17 -0400
              Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-12 17:45 +0200
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:58 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 09:23 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 10:44 -0400
                Re: getting started with encryption Jerry Stuckle <jstucklex@attglobal.net> - 2014-10-13 12:20 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-15 21:52 +0200
                Re: getting started with encryption gordonb.1o7q6@burditt.org (Gordon Burditt) - 2014-10-16 12:13 -0500
                Re: getting started with encryption Matthew Carter <m@ahungry.com> - 2014-10-16 15:25 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 08:13 -0400
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-18 07:52 -0400
                Re: getting started with encryption "J.O. Aho" <user@example.net> - 2014-10-18 14:46 +0200
                Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-19 07:47 -0400
  Re: getting started with encryption Denis McMahon <denismfmcmahon@gmail.com> - 2014-10-12 17:30 +0000
    Re: getting started with encryption bill <william@TechServSys.com> - 2014-10-13 08:59 -0400

csiph-web