Hacker News Reader

Comment by hanniabu | Hacker News Reader

> They also encrypt user data in a way that they can't access it without the user's password

I love how low our standards for government sites have gotten where this is seen as a plus and not something that's expected

View on HN

Isn't the US corporate standard even lower? Outside of maybe Google, Facebook, or HIPAA-covered entities.

Corporate customer databases I've seen have rarely even been need-to-know access limited, much less actually encrypted to internal users.

I don't even think a HIPAA-covered entity could hold their data to the standard of zero-knowledge encryption... since, you know, they have to be able to use patient data.

in theory they could but I doubt most patients want to have to remotely authorize their provider any time someone wants to access their record.

They could authorize an agent to authorize provider usage. The agent could apply provider-specific policies, and potentially monitor record requests to try to identify fraud, waste, or abuse, and so forth. The patient regularly reviews a report of actions taken by the agent to adjust configuration or revoke authorization. Could be an interesting approach!

It also needs to be a system that is workable when you scrape an unconscious person off the street with no next-of-kin available. It's not possible to have the patient or their agent hold the sole key for data that is created before the patient/agent is first available. Really, the best you can do in that situation is exactly what HIPAA requires.

Agent should not be individual it should be an third party service or organization( could even by governmental) which shouldn't have uptime concerns. The policy setup would be complex to do without expert assistance anyway.

Maybe so, but that's a different thing than the zero-knowledge encryption that this branch of the comment thread was originally about.

Agent only handles the policy and access, they don't have access to the data itself It is still zero knowledge ?

Good point, implied consent does make such a system unworkable.

All of the access audit information exists, afaik, albeit in non-standardized form. Because the law distinguishes between wilful and inadvertent releases, and assesses penalties on the basis of count and type, covered entities darn well better be able to produce an audit trail when asked.

In a healthcare context, the patient often may not physically be able to.

Absolutely. People do what they need, no more.

It’s getting better as people shift to cloud and inherit better controls, or implement better controls for cost avoidance reasons.

My country lets me use Google's SSO (arguably should probably also support Apple and have better 2FA options) - why wouldn't yours?

If someone wants to use facial recognition - why not? If someone wants to use insecure username/password and risk a compromise - let them do it.

FWIW big tech has probably 99.99% of people's faces, I'd guess at least 90% is tied to an identity.

I'd say the bigger issue isn't being allowed to use a third-party SSO, the issue is having the option to not use the third-party's SSO. We see enough horror stories about the impact of being locked out of a Google account.

Reply on news.ycombinator.com