Encrypt all the things!

Is there any particular reason why an SSH tunnel is better than a VPN? Or are they pretty much the same?

My PIA VPN subscription is about to expire, anyone out there with a better service that I should be exploring? I'm in Oz BTW...

Are you using it for encryption or pretending you're in different countries?

For encryption I set up my own, it's cheaper than pia and faster. Only two simultaneous connections though.

A bit of both... I'm not very tech savvy, something simple please...

Last time I looked PIA seemed as good as anything for price/simplicity/speed combo.

I gave up on it as speed topped out at about 50Mb/s and it didn't work for iplayer.

There must be an Oz nerd forum that will have the answer. Wasn't there a broadband.com kind of thing over there that all the adsl junkies hung out on?

I don't have time for another forum, especially one full of Australians... Thanks, @aggi!

Thatoneprivacysite.net

Useful for comparing various aspects of VPN providers

Thanks, man... 👍

Anyone use Disconnect app for Mac?

Yep. I use the premium version that has an actual VPN, but they have other levels of product too which focus on the tracker blocking.

It's very good,p in many ways, bit frustrating in that they only have 4 VPN locations. Let me know if you have questions.

https://ico.org.uk/about-the-ico/news-and-events/news-and-blogs/2016/10/talktalk-gets-record-400-000-fine-for-failing-to-prevent-october-2015-attack/

Is there a difference between customer account numbers / sort codes and company's?

Because many companies publish their account details online in order to be paid by their customers.

I guess with more information, more possibility exists for social engineering an individual but why aren't people doing the same to BT or Virgin Media, for example?

There are several things here:

1. Who publishes information matters. You can publish your own sensitive data, you cannot publish someone else's.

2. Sensitive data is different from personally identifiable data. Bank account information may be sensitive as a set of facts (this sort-code, that account number) but is only personally identifiable when associated with a name or address. Only the latter is the domain of the ICO.

Further on #2, addresses are not secret and do not need to be protected. Names are not secret and do not need to be protected. Associating a name to an address is now personally identifiable and needs to be protected.

This was written quickly, it's a guide only, but there are subtleties in data protection and PCI stuff.

I guess with more information, more possibility exists for social engineering an individual but why aren't people doing the same to BT or Virgin Media, for example?

This was predominantly a SQL injection attack was it not? Rather than social engineering.

No, I meant that with account number and sort code PLUS with the other personally identifiable details, hackers could use this set of data in social engineering scams for direct debits or whatever. Not the attack itself but what the combination of data could be used for.

In terms of "published", what if it's stored and not published? What are 'reasonable means' required to protect an account number? Will a password protected login do or do the ICO require this data to be encrypted? Do these requirements change if the account details are linked to an individual?

Yeah, it could.

But then... Direct Debit guarantee... so everyone would get their money back.

The new standard with GDPR in mind, is to isolate all information from each other, allocate each an identifier, and only store collections of identifiers, and then use systems of record to resolve bringing the information together at a time when you need to (whilst auditing access to each system of record, and alerting on abnormal access patterns, etc).

GDPR is pretty interesting, read about it here: https://iapp.org/news/a/top-10-operational-impacts-of-the-gdpr-part-8-pseudonymization/

But then... Direct Debit guarantee... so everyone would get their money back.

You'll get it back. Eventually. Meanwhile the loss of money from your account could cause other regular payments to fail incurring charges (and hassle) that you won't be able to claim back.

Remember Clarkson's boast that publishing his account number and sort-code wouldn't lead to any problems? https://www.theguardian.com/money/2008/jan/07/personalfinancenews.scamsandfraud

When I try to set up Signal on the iPhone, I get to the stage where it sends me a verification code but it just hangs forever when I enter it. Seems kind of odd.

Meh.

It's consumer banking.

Honestly, it's not secure, encrypted, protected, safe, verifiable... it's an entire industry based on a set of antiquated protocol that says that they'll only do Y when X happens, and if enough complexity exists in that then they give the illusion of having a good product.

The thing is, there really are no protections in banking. So either you go figure out how to live your life without a bank account, or you accept that the system is an antiquated mess and that when shit does go wrong you really do have to wait for X to happen so that Y can occur.

I'm very meh about it because I've seen it up close. Yes it affects people's lives, but this is why it is fairly critical that you have money set aside for rainy days and other unforeseen circumstances, the cavalry will ride into town, but only moments before the closing credits.

What do you mean 'only store collections of identifiers'? Where is the actual data then? It needs to be linked up for use, which would mean it could be linked by someone compromising the database while at rest, no?

What do you mean 'only store collections of identifiers'? Where is the actual data then? It needs to be linked up for use, which would mean it could be linked by someone compromising the database while at rest, no?

Under GDPR, if I were selling you something, I might have a shopping cart that said:

profileID: 47714
items: 1 x clydesdale wheelset

Nothing in there is personally identifiable, so it needs less protection.

But somewhere, there would be a system that could take profileID and translate that into "hippy".

That system/service, that does the translating is the one that would be audited, alerted, protected, secure.

And then you may imagine that actually a billing system starts to look ridiculous as it's just a collection of identifiers. Something like:

profileID: 47714
addressID: 98756
emailID: 98436
paymentMethodID: 54217

A system like that is fine under GDPR, and can be compromised. It tells you nothing.

The difference ultimately is the answer to the question, "Where are the fortress boundaries?".

In older systems, the fortress boundary was the network perimeter. Once compromised, everything was accessible.

In new systems, the fortress boundary will be a specific single-purpose datastore/service, and compromising a network perimeter gets you nothing at all. You'd need to compromise every internal fortress too.

I think I will be pursuing a career in carpentry in the very near future...

Mall greeter FTW.