Hacker News Reader

Comment by TomOfTTB | Hacker News Reader

My problem with encryption technology like this is that it falls into that gray area between theoretically useful and actually useful.

Equivalent software encryption has existed for a while (it's built into Vista for example). But when you read about these Government or Financial laptops getting stolen with people's private information on them they're never encrypted. Why?

Because any info that's valuable is too valuable to risk losing just because someone lost the password. I mean, he says it himself...

"it can't be brought back up and read without first giving a cryptographically-strong password. If you don't have that, it's a brick. You can't even sell it on eBay."

So when you deploy this kind of thing you have to ask yourself if there's any circumstance under which that password could get lost. I'm not against the technology I just don't know a lot of people who will be brave enough to use it.

View on HN

I don't want to comment much on a story from a trade rag like Computerworld, especially when it ignores the fact that we already have better options than this press release product. But, I'll take a moment to correct you:

In many F-500 companies, disk encryption is already a corporate standard on all laptops; the organizations that are worried about losing passwords keep escrow keys. The problem people are trying to solve is, if you leave your car unlocked and lose your laptop, you don't have to cut a press release about how many SSNs you just lost.

I don't deny that there are ways in which encryption can be very useful and that a very organized company can guard against ever losing their data because of a password mishap. I'm just saying I've never met one of these companies and I've done my fair share of consulting work for companies large and small,

People are used to security that can be circumvented if need be (through an administrators password or at worst a disk recovery service). When you're talking about hardware based encryption that option is no longer on the table and I think that rightfully makes a lot of people uncomfortable. In that way it's a huge risk.

Which is why things like bitblocker (again, built into Vista) don't get used.

Big organizations don't trust individuals enough to make them the single point of failure for encryption. Most often, these organizations run key servers that have the actual key, and provide the key based on some form of auth (usually Active Directory). If the user forgets their AD password, its an easy reset; and if they leave the company or something, their data is easily recoverable.

This sort of "encryption in the sky" approach is available to consumers too. There are products by most of the big encryption vendors (like http://voltage.com/vsn/) that make it easy for a user to encrypt their data without putting themselves at risk for data loss.

> if you leave your car unlocked and lose your laptop,

You're assuming that they didn't lose the key as well.

You remember the key; it's the sequence of digits and letters on the post-it just beside the track pad.

Reply on news.ycombinator.com