It needs to be a system and a contractual framework that complies with the medical privacy regulations of the place where it’s being used (in the US, HIPAA). I have some doubts about whether specific companies or people will actually comply, or the enforcement of those laws by certain governmental authorities, but I don’t think it’s conceptually impossible to have this kind of tech be compliant with those types of regulations.
on average peoples’ computers
Average people don’t have self-administered computers anymore.
People have work laptops administered by their work IT departments, or they have phones and tablets running iOS/Android. Some children have school-administered Chromebooks, and may never own a normal laptop running a traditional desktop OS.
The main people operating self-administered traditional computers are PC gamers (a dying breed during the current price crisis), freelance/independent workers in the fields who still benefit from a mouse and keyboard for productive work and aren’t provided a computer by an employer, and tech nerds.
It hasn’t felt t like there’s been much significant performance increases or development in RAM in the last… decade?
In memory? There’s been a ton of improvement, even if most of the coolest stuff isn’t making it into DIMMs that are installed in user laptops/desktops.
Advanced packaging technology has allowed chip manufacturers to put different silicon dies together with increasingly high performance (high bandwidth, low latency) connections in the same package, including with some three dimensional stacking. That way they can mix and match different silicon dies for greater cost effectiveness, yield, performance, etc.
This also means that in-package memory is now the standard in certain chips. Apple’s M-series silicon has its memory packaged right into the CPU/GPU package, as a system-in-a-package, so that the connection between the logic and memory is comparatively much higher performance, several times higher bandwidth than desktops or laptops that don’t follow that kind of architecture.
Similarly, in data centers, the AI boom has caused all the memory manufacturers to switch their production lines to high bandwidth memory, where they vertically stack a bunch of DRAM chips on each other, with ultra-fast, high bandwidth connections, so that they can shove terabytes of memory into these data center servers. These recent generations have been improving speed and bandwidth in ways that make consumer level DDR5 RAM look like child’s play.
So they’re improving things. Just not in ways that really show up in DIMM sticks.
Anybody who believed that quantum computing posed a risk to symmetric encryption was fundamentally misunderstanding how encryption works and what quantum computing might be good at one day.
Asymmetric cryptography is primarily used for the secure exchanging of symmetric keys: use a public/private key pair to exchange secure messages of what symmetric key to use for their session, and then both sides switch to the symmetric key for actual communication of a real payload.
A public/private key pair is two keys that have some interesting mathematical relationship, such that it is easy to confirm that someone possesses the right private key using the public key or to encrypt something that only the correct private key can decrypt. And that mathematical relationship, relating to the product of two very large prime numbers, is at the core of modern asymmetric cryptography.
Quantum computing may make number factorization much, much easier. So once a product of two large primes becomes possible to factor, the public/private key pairs might not be as secure anymore.
But none of this has anything to do with symmetric encryption, or hash functions. Quantum doesn’t move the needle on that particular math.
The real risk, though, is for an adversary to eavesdrop on an encrypted key exchange (which uses asymmetric cryptography) and then the message itself (which uses symmetric cryptography) and then be able to take the two steps of getting the secret symmetric key from the intercepted key exchange over a compromised asymmetric protocol, and being able to decrypt the symmetric portion of the communication too.
But it’s not the company itself putting those assets up for sale. It’s the court-approved or court-appointed bankruptcy trustee of that company, executing transactions approved by the court. That’s why bankruptcy has to go through court, but it also provides a level of immunity (commonly called “exculpation” in bankruptcy cases) to the individuals actually doing the things ordered by the court.
If it’s illegal to do, a court shouldn’t be ordering it, so the affected people should have to fight the court order before it happens. But it’s not illegal to sell anonymized user data like this, and not illegal to sell employee work-related data, either, in the U.S.