News for hackers. Stuff that matters.

A comment on MongoDB Releases Queryable Encryption Preview. Parent comment

Re:MongoDB Releases Queryable Encryption Preview by hapiri on Tuesday June 07, 2022 @01:32PM (#31657605)
It is less secure than your standard symmetric encryption. I guess they would use deterministic encryption in which 2 entries with same email address will have the same record string ( this leaks information to attacker ). Prefix search & sort can be achieved by using order preserving encryption. Not really sure about sub-string though.
[ Parent | on HN ]
Re:MongoDB Releases Queryable Encryption Preview by throwaway2016a on Tuesday June 07, 2022 @01:47PM (#31657798)
I've researched order preserving encryption before but the tradeoffs (mainly that the attacker can tell the order and use that to narrow the search space) always seemed like high risk.
[ Parent | on HN ]
Re:MongoDB Releases Queryable Encryption Preview by sangel on Tuesday June 07, 2022 @11:25PM (#31662831)
High risk compared to what? The alternative is absolutely no privacy (status quo) or no/limited functionality (not very useful). Seems like strictly better than having no privacy.
[ Parent | on HN ]
Re:MongoDB Releases Queryable Encryption Preview by throwaway2016a on Wednesday June 08, 2022 @01:00AM (#31663413)
Depending on your compliance needs and the sensitivity of your data, "limited functionality" may be a reasonable tradeoff, though.
[ Parent | on HN ]
Re:MongoDB Releases Queryable Encryption Preview by bawolff on Tuesday June 07, 2022 @11:28PM (#31662854)
Using fake encryption is much riskier than no encryption, because if you think you are safe you will do unsafe things with your data. If you know you are unsafe then you will take appropriate precautions.
[ Parent | on HN ]