Protecting Your Users Data With a Privacy Wall
// February 23rd, 2007 // No Comments » // Security & Privacy, Technology
Brad Greenlee has a good article in his blog about the data security architecture he designed and that’s used by Wesabe to protect the company’s sensitive data.
In essence, they abstract the connection between a user and their sensitive data by using a cryptographic hash rather than a foreign key. The result is that should the data fall into the wrong hands, the data is readable but not traceable back to its owner. So in a bank for example, the bad guys would know that somebody has $500k in their account and somebody else has $500, but they wouldn’t know which one is me (well, anyone who knows me would, but…).
The design does have a few drawbacks, which he addresses, and additional measures would be required for very-high security applications (like a bank maybe). But it’s good to see smart people putting some good thought into designing simple, effective security into application and database architectures (which I’ve always felt was the most-overlooked and easiest-to-exploit of the generally accepted data security threats), and protecting users data from what is arguably it’s biggest threat – internal compromise.

After suppressing my initial revulsion at the thought of a Monty Burns-esque captain-of-industry sitting in his expansive study next to a warm fire in his Gothic armchair, sipping Brandy and scheming about how to get rich off of so-called “Green” business opportunities, I realized maybe it was me who was looking at it all wrong.
Let’s for a moment set aside the emotion and cost of the exercise to which we so readily dedicated ourselves these past 18 months. Forget the emotional roller coaster we tread weekly. Ignore the misunderstandings, endless waiting, driving all over town looking for just the right paint chip, and staying up pondering the cascade of “what-ifs”.
Michael Crichton has an interesting op-ed in the New York Times discussing what has become among the most egregious abuse of the underfunded US Patent Office and their penchant for rubber stamping most patent applications that come across their desk, regardless of the true originality, merit, or social value of the claim.
I can barely stop laughing long enough to write this post.

