Governments and high tech

elfprince

3.5" stiffies were nice to handle

WetGeek

elfprince 3.5" stiffies were nice to handle

And they held a lot more than floppies. 1.44 MB, weren't they?

elfprince

WetGeek 1.44 MB That was the standard. 800 KB to 2.8 MB range.

kyrios

WetGeek When I was a teenager, I used to convert single-sided 5.25" floppy from 180kb to 360kb (double side) floppy then later I did the same with the 3.5" 720Kb floppy to 1?44Mb
This just by making a little hole on the right side of the disk

Nowadays, things are poor quality... I made a hole on my USB stick but instead to getting double capacity, it stopped working! 😆

kyrios

qsl One the one hand, moving to more modern tech just for the sake of being modern

NASA using old technologies software and hardware because they are reliable, deeply tested, don't require fans to cool a CPU, must lasts many decades, etc. is a thing but having governments relying on outdated technologies for some processes is something else.

Such floppy disks aren't manufactured anymore for decades. Even if they still work, they were designed for 10 to 20 years lifetime. So relying on this for official governmental processes isn't the smartest thing. It's not like a hobbyist doing retro gaming or so.

These drives are slow which isn't really a problem since the capacity of the disks is limited and that could be a problem because this might lead to stick to old technologies potentially not supported anymore because newer file format might be too large for these floppy disks.

No modern computers are sold with floppy drives anymore which means you have to purchase external usb floppy drives if computers are replaced. It might lead to security issues: many companies don't allow external storage as it might ease date leaks and some even block data transfer on USB.

So this is not just for the sake of being modern. Its like the fax. It's nice an all and if it still works why not... But if citizens/enterprises want to exchange documents with a governmental administration and all they accept is a fax, it might be annoying because there aren't many places that still have fax devices. Perhaps you can send faxes over the internet but you have to rely on a 3rd party service and if your documents are confidential it might be an issue. Also you can't digitally sign faxes.

qsl

kyrios Until not that long ago, faxes were de facto for medical, law, and much of government; and only recently changed with standards for encrypted email and digital signatures.

And even then, with how many database hacks, it's questionable if that will last, as the whole purpose of faxes being secure with a traceable chain of custody isn't being met with current technologies. We still keep fax machines expressly for this (although they are used infrequently).

Again, modern for sake of being modern.

brent

qsl Again, modern for sake of being modern.

yes, that mindest frustrates me. doesn't translate to 'better' very often

kyrios

qsl Until not that long ago, faxes were de facto for medical, law, and much of government; and only recently changed with standards for encrypted email and digital signatures.

And even then, with how many database hacks, it's questionable if that will last, as the whole purpose of faxes being secure with a traceable chain of custody isn't being met with current technologies. We still keep fax machines expressly for this (although they are used infrequently).

Again, modern for sake of being modern.

Let me disagree and let me ask a question: do you think fax were de facto for medical because it is highly secured (if so why other sensible sectors like banks/finance/army don't privilege it over other means of communication?) or because of the lack security culture and investment on the health sector ?

Among the sectors handling personal/sensitive data health is most vulnerable to data leakage, ransomware, etc. So it seems faxes didn't really help them.

Don't confuse security with a feeling of security!

Let me remind some points

Faxes are devices and as any electronic devices they can be hacked, they aren't very secured and shall some manufacturers publish some updated firmware to address vulnerabilities, chances they are actually applied are very low.
Like people might dial a wrong number for phone calls, they might do it for faxes
Once the fax has been received by the device you have zero traceability. It can be taken by a wrong person, someone can do a xerox of it then put it back without anyone knows, it can be lost, put in a wrong folder, etc. so where is the traceable chain of custody ?
The time faxes were added in folders the were stored on shelves in rooms (with restricted access which doesn't mean secure and which doesn't prevent people having access to this room to check your data if they want, even if they aren't allowed) is over for a long time. Because although paper work remains, having some secretary manually inputting the data from the fax into a database (yet another person who sees personal data), then faxes were directly received as digital documents (pdf, images, ...). So you have the feeling of security but anyhow the personal data are stored in databases that can be hacked stored in the cloud, etc.
Faxes devices aren't all PSTN (connected to the copper cable), T.38 is the standard for IP faxes so if you believe you are secured because you use an old fax the recipient might receive it on a classic IP network. PSTN lines are more and more rare since they are replaced by fiber... so keeping outdated technologies for the sake of being "secured", well... I have to agree I agree when you have PSTN device and optical fiber, you can't even connect the device so it is indeed super secured... 🙂

And I don't even mention that a digitally signed document is very hard to tamper so you know from who it actually comes but if you get a fax from me with my signature, you can't be sure it is me who actually signed it and if you give it to someone else, that person can't be sure you haven't altered it.
If you send an encrypted document, you are sure that only the recipient can decrypt it, if you send a fax, anyone sitting near the device can potentially see it so if you care about privacy of medical data perhaps fax isn't the ideal choice.

You know steam locomotives powered by coal could still work today. These machines are very strong and easy to repair. However nobody uses them. Using floppy disks or faxes now or in a recent past is not because it's good technology or because it's secured or because it works super well. It is just a lack of investment and I don't care attitude, nothing else.

qsl

kyrios Mmmm, you are comparing sectors whose answers to security problems is to claim identity theft as their main answer to security problems.

I also refer you to the talks by Catlin Long and Frank Abagnale regarding the security practices of the financial sector.

Not a good example to draw your ideas of security.

The military, that I am aware, uses privileged networks for their secure communications.

kyrios Among the sectors handling personal/sensitive data health is most vulnerable to data leakage, ransomware, etc.

qsl much of government; and only recently changed with standards for encrypted email and digital signatures.

Note the time difference between these statements.

And allow me to refer you to the Two Generals problem https://en.wikipedia.org/wiki/Two_Generals%27_Problem[](url) and describe how a secure fax is sent.

You call or otherwise notify me of who you are, your contact information, and what data you want.
I check your credentials and your contact information against my own whitelist. If there are discrepancies, you are referred to a different department to resolve them.
I contact you again using your whitelisted information, have you verify what data you want, and your fax number.
Once I have collected the the information, I call again, verify your credentials, and that I am sending the fax NOW.
Fax is sent, the fax machine verifies the number, and securing the information is now your problem.

All of your other examples apply equally to any other technology.

Faxes were preferred because I define the security protocol, and can change it on a dime.

Try doing that with an encrypted network, running any modern OS and app, with cloud storage. 🙂

Don't confuse security with a feeling of security!

Likewise.

brent

kyrios . Using floppy disks or faxes now or in a recent past is not because it's good technology or because it's secured or because it works super well. It is just a lack of investment and I don't care attitude, nothing else.

compelling case and interesting explanation (security vs feeling of security). if it comes to something analog or computer hardware, I will always value something built to last. Because there's no hypothetical security issue with the steam engine or the A:/ drive. A fax I never thought about that way, but those 50-60 year old old-timey phone lines still used today were vulnerable to intrusion all the way back in the 60's to now for sure.

kyrios

qsl Mmmm, you are comparing sectors whose answers to security problems is to claim identity theft

Nope I am talking about security/data breaches by industry sectors. Ask google is a good way to get a first high level insight on the general trends before eventually diving into the studies to get reliable sources

qsl Note the time difference between these statements.

During this very quick search, I saw statistics going back to 2009 and 2013 showing healthcare sector was always in the top ranked industries. So this was obviously already the case before the "recently changed with standards" you are mentioning.

qsl And allow me to refer you to the Two Generals problem https://en.wikipedia.org/wiki/Two_Generals%27_Problem[](url) and describe how a secure fax is sent.

So you just demonstrated that the fax is intrinsically insecure - which by the way was my point - and to mitigate this you need to couple it with phone calls in a process that is quiet inconvenient since both parties must be available at the same time.

By the way about your process

qsl 2. I check your credentials

You didn't mention any credentials previously sent. So let's assume in point 1. I tell you on the call "Doctor, my secret word is "******" (there might be people around me listening, there can be people around the doctor, you could be on loudspeaker, a 3rd party can listen to the call - PSTN lines are not secured, and (T.30 Fax protocol has no encryption btw). This supposes that both parties physically met before otherwise the doctor cannot have it on his whitelist. Also it doesn't tell anything on how this whitelist is secured. Also what proves me that it is actually you who answer the phone in 1. It is a one way trust, the patient has no mean to be sure he's actually talking to the doctor or an accredited collaborator.

qsl 3. I contact you again using your whitelisted information, have you verify what data you want, and your fax number.

Except that I can call from any location and I can sent the fax from anywhere and if I send a fax from my company I usually do it via Outlook/Microsoft Exchange connected to a fax gateway service and the number that will be displayed (unless it is masked) might be the phone number of the gateway. It seems you are taking lot of assumptions. Phone numbers can easily be deviated so at best binding the patient to given numbers is an additional safety but surely not a security.

qsl 4. Once I have collected the the information, I call again, verify your credentials, and that I am sending the fax NOW.

I lost you here. I don't get why you call the patient 2 times in a row (at 3. and 4.) and why you ask for his credentials again. Also what's the need of sending a fax if the patient already provided all the info on the phone ?

qsl 5. Fax is sent, the fax machine verifies the number

I have never seen a fax machine that verifies the phone number, but okay... as said already the person could dial from another location (I.e: I am ill on holiday or on my secondary house, ...).

qsl Try doing that with an encrypted network, running any modern OS and app, with cloud storage. 🙂

A few points here

You already give the solution in your statement : asymmetric encryption (key pairs) is the widely used way to mitigate this problem. Another way is the blockchain (proof of work).
You mix secured data transfer and secured data storage (+ as you said in point 5. of your demonstration "securing the information is now your problem"
If the transferred data are intercepted by a 3rd party, if it's a fax, it's game over since it's unencrypted by design. Otherwise, the 3rd party will still have to find a way to decrypt the data.
If the fax machine is connected to a network, a hacker can send it a corrupted image to access its buffer and download anything left in the buffer.

qsl

kyrios As this is rapidly turning into an academic slapfight, here is a list of the biggest data breaches:

https://www.upguard.com/blog/biggest-data-breaches.

You have to scroll pretty far down the list to even get to governmental or healthcare agencies, and absolutely none of them make mention of faxed data compromised.

kyrios

Back to the original topic, the point is they did rely on processes involving outdated technologies way too long.
Working with floppy disks is inefficient and potentially risky since they are not manufactured anymore for decades, fax machines don't address the current needs in terms of privacy and security (it's government procedures) and this is certainly not "modern for sake of being modern".