News Third suspect arrested over TalkTalk breach

Code:

blacklaw@trioptimum[~]$ host forums.bit-tech.net
forums.bit-tech.net has address 195.78.94.76
blacklaw@trioptimum[~]$ host bit-tech.net
bit-tech.net has address 195.78.94.76

Well, they're certainly on the same web server, but I have no idea what server any of the databases live on. I just work here, y'know?

Yes, we do: they didn't hash passwords or encrypt data. They've said so, several times.

Darn tootin'. As I've said upthread, there is no legitimate reason to be storing passwords in a reversible format, and anyone who is doing is Doing It Wrong.

 

Good job I didn't extrapolate anything then, isn't it? I mentioned the study as an aside and a way of demonstrating how what was once a performance-killer - encrypted web traffic - is now so negligible to be something to enable by default. Since then, I've linked to two benchmarks - one small-scale independent, one enterprise-scale vendor - which show database encryption to be equally negligible.

If you can find a recent database benchmark that shows encryption has a non-negligible effect overall - no, the outliers that pointed to a 15% hit for selected transaction types in the independent benchmark don't count, 'cos it all averaged down to just 6.36% - then I'd love to see it.

 

You mean this?

I fail to see any extrapolation there. I do see an example of how encryption in general has become computationally negligible, using Google's SSL study as an example. I also was aware of benchmarks - but did not mention them directly - which showed the same for databases. There was no extrapolation involved, merely my direct knowledge - and the accuracy of my post has been proven by the links I have since provided which show database encryption to have negligible performance impact.

I really don't know what's got under your bonnet, but you're attacking me for things that I haven't done - or, at least, I don't believe I've done.

Let's cut to brass tacks, here: I have claimed that encryption of data coming into or going out of a computer is computationally negligible, and have provided benchmarks to back up those claims. Do you dispute that claim, and if so do you have benchmarks to support that?

 

Could well be; like I say, I just work 'ere. (In this case, "'ere" being my home office; the servers are Somewhere Else and Somebody Else's Problem, which after years of sysadmining is a wonderful feeling.)

 

<twitches>