Hacker News Reader

Comment by earthboundkid | Hacker News Reader

A nice thing about paper is it is very hard for hackers to ransom all of the wills.

It's hard for hackers to ransom tape backup or cloud backups or versioned cloud storage as well, so that's not really an issue here.

Maybe in theory. But a lot of orgs like to automate their backups, meaning their backup infrastructure is online and available and thus exploitable.

A lot of orgs like to not bother testing their backups as well, meaning that their backup infrastructure functionally doesn't exist.

> It's hard for hackers to ransom ... cloud backups or versioned cloud storage as well, so that's not really an issue here.

Until you set the password to Password123! because that's the only password that everyone can remember, and the attackers go in delete the originals and previous versions and then keep all the data only for themselves.

Under a "right to be forgotten" [0] society there's no such thing as an append-only backup or storage, or even offline snapshots in time. As soon as a mechanism to overwrite all existing records (or, equivalently, to destroy the keys necessary to decrypt those records) exists, a sufficiently determined hacker/ransomeer will be able to compromise that mechanism.

Paper, at least in theory, requires noticeable human action to achieve destruction at similar scale. One hopes, of course, that the environmental controls of the archival facilities aren't cloud connected...

[0] https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-re...

GDPR doesn't apply to the UK but one of the provisions of GDPR is that it does not apply to deceased people. Recital 27: "This Regulation does not apply to the personal data of deceased persons"

Article 17 is "Right to erasure (‘right to be forgotten’)" and even without Recital 27 a deceased person cannot ask anything anymore.

It very much does apply to the UK.

How?

When managing data of EU citizens, but does it still apply to UK companies managing data of UK citizens in the UK?

EU asserts extrajudicial authority but it's pretty meaningless. Can't see why it would apply to UK citizens in the UK at all.

> EU asserts extrajudicial authority but it's pretty meaningless

They can prevent a company to operate in the EU and/or fine them.

> Can't see why it would apply to UK citizens in the UK at all.

Exactly.

Did they repeal it after the withdrawal finalized or something? IIRC, it was granted ascent long before they left the EU.

>Under a "right to be forgotten" [0] society there's no such thing as an append-only backup or storage, or even offline snapshots in time.

No. There are many exemptions to the Article 17 right to erasure, including a specific exemption for historical archives.

https://gdpr-info.eu/art-17-gdpr/

Ransoming cloud storage is just a matter of finding a dev who has production keys on their laptop and getting them to install some CLI that promises to butter toast or whatever.

Except, you're assuming extreme competence here, when, if govt and hospital IT systems are to be any indicator, it's the exact opposite position.

all the more reason for the 3-2-1 backup approach.

there should at least be 1 paper copy somewhere

Reply on news.ycombinator.com