The notion of an operator-provided or operator-unlocked key is the way it used to work "back in the days" when every server had a monitor plugged into it. You would provide a password on bootup which was a mini-key to decrypt the actual SSL/TLS keys. It would get stashed in memory at that point and (hopefully) operator intervention wouldn't be needed again until the next scheduled reboot. Before too long, the threat of in-memory attacks far eclipsed the threat of physical server theft and this practice was ditched.

Putting the key alongside the data is a bad idea no matter how the key gets there. Finding it in RAM would be no different than finding it somewhere on the disk (assuming the disk approach is more complex than c:\config\crypto.key) so that's out. There are TPM solutions that can make it secure (storing the key in tamperproof memory, never releasing it, doing the encryption/decryption only at the request of signed binaries) but at this scale I don't know if the TPM can keep up or if doing it all on one closed system is enough of a safeguard. Would security go up by having one hardened database server and one hardened decrypt server in different auth realms, or would it go down since the attack surface is larger?

In this case, it was one less step the miscreants have to go through to grade each record set for sale on the black market. No doubt they are going to (or already have) sort by income descending, break them into nice 100 ID chunks, and sell them to the highest bidder.

Out of curiosity since you are familiar with the subject, where is the acceptable place to keep the encryption key? During a compromise it doesn't do much good when it's on or near the same server as the DB with the data. Two servers, with two distinct access control credentials?

It's annoying but doing a full reset (via the bootloader menus) helped my 2012 N7 to run great again with 5.0. I realized how few apps I actually needed to make good use of it, too. Battery life is still subpar, but it's almost 3 years old at this point so I don't expect it to be fresh as a daisy.

If you had clicked the "show more" button you would have gotten to:

enormity
inôrmd/
noun
noun: enormity; plural noun: enormities
1.
the great or extreme scale, seriousness, or extent of something perceived as bad or morally wrong.
"a thorough search disclosed the full enormity of the crime"
(in neutral use) the large size or scale of something.
"I began to get a sense of the enormity of the task"
synonyms: immensity, hugeness; More

[slow clap]

That's it for this thread.

To be completely pedantic, you don't actually know that he confined his search to just Wikipedia. The article revolves around Wikipedia but he might be crusading across the entire internet, for all you know. Many other Wiki systems allow user contributions just like Wikipedia.

How many of those edits were accepted fixes, and how many were epic edit war battles fought tooth and nail over 100 reverts with the Wikirati elite editor brigade?

You are completely right that governments (big or small) shouldn't be in the business of indiscriminately creating arms that provide services at or near the level of existing commercial interests. However, if the US isn't a good example of freedom at work when we have bulk taxation for education, all manner of safety services, roads, waste removal, parks, etc after citizens all agreed that it was indeed a common good, then I want no part of what you do think a good example of freedom is. You might be interested in relocating to Freedom-rich Libya. Now with fewer taxes, and you can't even tell the government is there at all!

Maybe if you use the word freedom a few dozen more times it will all work itself out? You have arrived at the point where your awareness of the situation ends. "Another company" can't show up since many municipalities have incumbent agreements that specifically *forbid* anyone from competing with the cable or phone company that first installed infrastructure. Who thought of those laws? It wasn't the will of the people, not by a last mile, but I will give you one guess as to who did. There is such a terrifying patchwork of local laws surrounding utility construction and availability that no company large enough to pull it off would ever want that kind of risk (until Google showed up, but at their current buildout rate they are still about 1400 years from offering service to a substantial portion of the US).

Muni broadband runs into funding problems from conservative officials who dont want to throw taxpayer money at the problem (I'm not taking sides, thats just how it is) and private broadband runs into pole attachment problems where incumbent exclusivity agreements exist with a muni. Same set of officials, but a completely different direction to pull them in. Google is making it look pretty easy, but then again they are throwing billions of dollars at it.

The sarcasm came from the fact that we (in the USA) traded in our freedom, and instead of broadband all we got was this lousy t-shirt.

Google is demonstrating that there isn't a mandated communications monopoly per se, but just an extremely high barrier to entry and some incumbent legislation that moves out of the way as soon as enough people are teased with hyperfast internet hookups.

Mid 90's was when modem technology still hadn't caught up to the phone line standards that were deployed far and wide across the US. Sure, you could get a nice solid 14400 or 28800 (if you were living high on the hog) and have lightning-fast IRC sessions. A few years later, you will be connecting at 31200 and bitching that you can't get a 56k handshake in your neck of the woods (as distance to the local CO and quality of lines really started to matter) and a few years after that you would have been bitching that no cable or telephone company wanted to bother spending $1M+ rolling out to a tiny town to try to grab a few hundred customers paying $40/mo for 1Mbit broadband. Meanwhile, those who did live in urban/suburban areas were being "treated" to broadband from the phone company and the cable company, neither of which was really prepared to deal with thousands of customers with 3Mbit+ connections all trying to pirate music. So, service "upgrades" were nonexistent as all the providers played catchup with customer demand for about 10 years.

And then, as if by some dark magic, wireless operators started rolling out handsets that could best all but the fastest wired connections (50Mbit+ coverage for 90% of the US pop). What a strange land we live in.