Hacker News Reader

Comment by zelly | Hacker News Reader

Maybe this will convince businesses to encrypt user data end-to-end.

Either lose the pennies you would've made from data mining or lose real millions from getting ransomed. Your choice.

I would bet most of this users clicking things they should not. recently my company put out a phishing email and people clicked on it and then started a thread on the internal forums about how mad they were the company would do this (they had to take extra training if the fell for it). Another co worker was telling me about his old position where he put the thumb drives in parking lots and people would pick them up and plug them into their work computer, and the would get mad that their security team did this exercise and caught them.

Yes a lot can still be done with security on machines and traffic, etc.... But the human factor is hard to control and fix. If someone sent out a phishing email with a link that said "click here to see magical unicorns jumping over a rainbow", someone would click it, i know poeple i work with who would click it. It gets, frustrating at least for me, since i have a lot to do with security where i am at.

What's frustrating is that we're still dealing with systems where these kinds of simple and obvious actions are not safe.

What reasonable person thinks that clicking on a link is a potentially dangerous act? That's how everything is done these days, and we're not supposed to trust that it is a safe operation?

We're not supposed to plug in a USB drive to see what's on it? That's pretty much all they're for!

People expect to plug in USB and all to magically work. In this case hardware/firmware get full access and can fry your port.

0-day bugs and lacking updates make promiscuous internet use hazardous, yet people expect browser to do everything a PC can.

This comment is non-responsive to the parent

For many businesses that's not really possible. For your standard e-commerce website the majority of the data you have is what people are ordering. How do you end-to-end encrypt that? What about internal documents and memos? User names and email addresses (not as valuable as passwords but still useful if you join it against other data sets)?

Yes, it's very hard. They would have to completely re-architecture their systems.

For e-commerce, the client can sign his or her address with the shipper's public key, so that only the shipper and the recipient are guaranteed to know the address. To the user, this could happen transparently without any change in UX, where the e-commerce website acts like a keyserver.

For email addresses, phone numbers, names, etc. it is more difficult. You can't just store a hash of the email address if you want to ever be able to email your customers.

Internal documents can be more trivially end-to-end encrypted. Imagine the whole company shares a WhatsApp group chat. Nobody has to ever hold a plaintext copy of an internal document. Only permit access on company devices which hold the keys in hardware.

Usually you can't. Services depend on user data, so the company needs the key.

It works only for storage service basically (or messaging, where the two have the keys).

Encryption will do nothing to stop this. If a user clicks a link and gets the malware, the malware will be doing it's damage inside of the encryption envelope or encrypting already encrypted data which has the same effect.

I assume most of these occur through phishing and very few occur by someone sniffing unencrypted data in transit.

No I'm talking about the rows in their database being ciphertext with the client having the private key

Yes, but public leaks of customer data are a GDPR violation that you get fined for. If the data is end-to-end encrypted, this mitigates the risk substantially.

Reply on news.ycombinator.com