7 ms·

Sheesh, clickbaity title. No, it’s not a scam. Should you use it for your data? Yes. Does it prevent you being h4x0red? No. Defense in the depth.

fenollp 3y ago
From the article: > Nothing in this diatribe argues that encryption at rest is creating a net negative, outside of it being represented as a be-all and end-all security measure. When I say encryption at rest is a scam, I’m talking about it from the eyes of the purchaser. And given that it’s their data at risk, this is the standpoint that matters.
- dizhn 3y ago
  "not creating a net negative". Blog author doesn't want to commit to anything. What's the point if they're not going to make a point?
  - ghusto 3y ago
    The point I read (though he was preaching to the choir) is that > developers often rely on encryption at rest as a gold standard security measure and they shouldn't. Security isn't a list of checkboxes to tick.
  - dspillett 3y ago
    The point is that while “not creating a net negative”, is it still creating the net positive that providers claim and in some cases want you to pay for. Significantly: there are a whole host of risks that is doesn't mitigate, that it is not intended at all to mitigate, that people who don't know any better might assume are dealt with when things are pushed as secure “because the data is encrypted at rest”. If you read TFA you'll see that it details some of these concerns.
- omnicognate 3y ago
  Exactly. As explained in the article itself, the title is pure clickbait.
dizhn 3y ago
Most corporate blogs are less than useless. Clickbait titles are getting more and more prevalent too. "We're not sustainable" from yesterday is another example.
speedgoose 3y ago
Yes, a title with a question mark can usually be answered by a simple "no". If it was a yes, the title "Encryption at Rest is a scam" would be more likely. https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...

fenollp 3y ago

From the article: > Nothing in this diatribe argues that encryption at rest is creating a net negative, outside of it being represented as a be-all and end-all security measure. When I say encryption at rest is a scam, I’m talking about it from the eyes of the purchaser. And given that it’s their data at risk, this is the standpoint that matters.

dizhn 3y ago
"not creating a net negative". Blog author doesn't want to commit to anything. What's the point if they're not going to make a point?
- ghusto 3y ago
  The point I read (though he was preaching to the choir) is that > developers often rely on encryption at rest as a gold standard security measure and they shouldn't. Security isn't a list of checkboxes to tick.
- dspillett 3y ago
  The point is that while “not creating a net negative”, is it still creating the net positive that providers claim and in some cases want you to pay for. Significantly: there are a whole host of risks that is doesn't mitigate, that it is not intended at all to mitigate, that people who don't know any better might assume are dealt with when things are pushed as secure “because the data is encrypted at rest”. If you read TFA you'll see that it details some of these concerns.
omnicognate 3y ago
Exactly. As explained in the article itself, the title is pure clickbait.

dizhn 3y ago

Most corporate blogs are less than useless. Clickbait titles are getting more and more prevalent too. "We're not sustainable" from yesterday is another example.

speedgoose 3y ago

Yes, a title with a question mark can usually be answered by a simple "no". If it was a yes, the title "Encryption at Rest is a scam" would be more likely. https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headlines https://en.wikipedia.org/wiki/Betteridge%27s_law_of_headline...