0

I have an anonymous online community whose posts are deleted from the server after 21 days. In order to provide evidence against bullying and illegal activity, I'd like to keep logs without leaving my users open to having their information taken by a malicious third party.

Is there any reason printing the relevant documents before deleting from the database would be a bad idea?

  • 1
    Define "bad idea"? By doing that, the posts are no longer "deleted". If your users are expecting their posts to disappear, then you are violating that trust, unless you tell them about this offline "log". – schroeder Jan 8 '16 at 21:15
  • I completely do not understand. How can you "provide evidence" without "having their information taken by a third party"? Hopefully the arbiter is non-malicious but you can't really control how they will use the information which may ultimately lead it to being revealed to a malicious third party. – emory Jan 8 '16 at 21:19
  • I probably phrased everything terribly. I'm mostly curious to know if there would be any benefit to converting digital documents to physical ones so as to avoid hackers gaining access to any information in the case of an attack. – JacobPariseau Jan 8 '16 at 21:44
  • 1
    why print? why not just save the logs on an offline digital media, like backup tapes, or optical disks, or a removable drive? – schroeder Jan 8 '16 at 22:18
1

To answer your more specific question in comments:

I'm mostly curious to know if there would be any benefit to converting digital documents to physical ones so as to avoid hackers gaining access to any information in the case of an attack.

This, like most security, depends on what you are protecting against. If you have completely erased all posts older than 21 days from your database, then you have effectively prevented anyone who gains access to your database from reading those posts. However, since all the posts are now presumably in plaintext on a bunch of pieces of paper in a cabinet, a thief could steal the physical papers. You may or may not consider that a valid concern, but again it depends on your threat model.

I don't know how you define a bad idea, but I can say with certainty that this is not the path I would take. The biggest issue is that printing and storing a bunch of papers once a day is a pretty big expenditure of your time and energy. What happens if you go on vacation, for example? Additionally, if you want to protect the posts on your side, you'll want to use strong encryption on all messages currently in the database anyway. In that case, a malicious person who manages to get a copy of your database won't be able to read the messages.

Going back to your original idea, if you are willing to put in the effort to deal with physical objects each day you might be better off using an air-gapped server to store old messages. That way, you can keep them encrypted and still retrieve them later if necessary, but not even their ciphertext will be exposed if your main site is compromised.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.