Hacker News Reader

Comment by rplnt | Hacker News Reader

Do you store all your money at home or do you have some in bank? There's no reason why some big entity couldn't guarantee that the data you put in will get back to you whatever happens to company holding your data. If you mean security as in privacy, then there are cryptographically safe methods on preventing that.

View on HN

I think the crucial difference here is the number of entities I have to trust. People can generally do a bit of research on a bank before they join one, if a bank really sucks you can switch, and if a bank seriously defrauds you then you know whodunit and can pursue legal recourse. By contrast if I'm using a supposedly dumb terminal provided by some random cafe then there's absolutely no way to prevent them from seeing everything I do [1], or from inserting arbitrary commands into any service I use. And if I use the provided computers at many locations, as you suggest, there's probably no way for me to figure out who it was that screwed me.

[1] You say "cryptography". I say "Analog hole".

I'm not talking about tomorrow but rather distant future. The banks evolved somehow. Now it is really hard to "become" a bank. There are very strict regulations in place. If a bank goes bankrupt the personal savings are still guaranteed to be paid off. So this is just a matter of making some regulations and establishing proper hierarchy.

And about security as in privacy. I don't know what future holds. Perhaps you'd be implanted a token that you can use for accessing the data which can't be faked or copied. Who knows. I just wouldn't rule out the possibility of a "cloud world" completely.

Even with strong crypto, if you're typing in your passphrase on a "dumb" machine that someone else owns and controls, you're risking the entirety of your security on how trustworthy (and security-competent) the owner of that machine is. No thanks.

two-factor auth helps?

You could have a token that would work exactly as credit card. Only one token would be authorized. You cannot copy it so if you lose it, you know you lost it can be "disabled". You would then need a new one with the same key however. That key could be stored in real bank's deposit box. Hardware of the token would only allow to store the key and not read it. I mean, that's a possibility for the paranoid ones who are not happy with cell phone auth for example.

I know there's no infrastructure in place (yet) but we're talking about some kind of future, not about today. It's certainly possible though. Even secured.

If somebody steals your money from a bank, the bank can replace it. If somebody steals your data from the cloud, there's no way to make things ok.

It doesn't matter that someone have a copy of your properly encrypted data.

Reply on news.ycombinator.com