Posted on 2018-01-29 by: Axel Kloth
Some people commented on my security and privacy posts, so I am going to expand on my take. First of all, I think that privacy should be a right, and not a concession from government or businesses. Second, data security can only be achieved if it is easy to use. Privacy, security and authenticity are intertwined. If your data is insecure, privacy cannot be achieved. Privacy requires the user to act too – ensuring privacy is not a passive act. Some people don’t seem to grasp that they need to act responsibly when it comes to their own security and privacy. This is not a spectator sports. They shred only the one important page they receive per week. That approach is dead wrong. In essence, they’ll need to shred all (or at least a significant portion) to achieve security by obscurity. If only one page is shredded, then the attack method for identity thieves is clear and easy: they just need to dig though the shredded paper and reconstruct it. If all paper is shredded, reconstruction is a lot more difficult. The same applies to data. The strategy must be to encrypt all data at rest. That way someone trying to steal data is faced with deciding what to steal without knowing what is in any of the devices or folders. If your banking data is in the only encrypted folder on your had disk, then any identity thief would focus his or her attention on that folder. A weak password might reveal the information. However, if all of the contents of the hard disk (or backup disk or other medium) is encrypted, any identity theft will have to start with finding the (strong) password for the disk encryption. By keeping data safe you keep your privacy. The individual user must control what is published and made available to others.
Some information is difficult or impossible to protect. It is not possible to not reveal metadata as an example. Metadata is not the contents of the message, but the information that is needed by the forwarder to transport a message from the sender to the recipient. This can be compared to the recipients’ address on a letter or postcard so that USPS can forward that letter or postcard to the recipient. Without that address, the letter or postcard cannot be forwarded. However, it is always possible to omit the senders’ address, or use a fake one. As a result, the recipient can never be 100% certain that the mail piece came from who claims to be the sender. In other words, the authenticity of the message is unproven. If USPS collects the addresses of all people that you send mail to, then they have a pretty good idea who you communicate with, even without opening any letters or reading postcards. Just your communication profile (the metadata that cannot be hidden) reveals a lot about you. The same applies to the Internet.
Just to make sure that I am not taking political sides here: I absolutely disagree with James Comey (and former Presidential candidate Hillary Clinton) with regards to citizens’ rights to privacy. I will and do encrypt everything I store. Whether it is important or not, I encrypt. I abhor the idea of backdoors as backdoors are never secure. Both the mechanism and the centralized database of back door keys are vulnerable. As a result, whoever cracks the mechanism or has broken into the database of keys for the backdoors can decrypt everything from anyone. That is an absolutely ridiculous notion.
