Is it feasible to encrypt customers personal data? (name, address etc...)

Simple answer - yes, it is feasible - if by that you mean 'can it be done?' as you can encrypt pretty much everything stored.

However the extra computational overhead (especially on encrypted databases) is usually looked on unfavourably, as is the cost to recode, updating procedures etc etc. Obviously you can't just hash if you want to allow partial searches on names, addresses etc., so everything has to be encrypted to a key, which then needs to be protected etc.

Before regulation such as PCI-DSS, many organisations didn't want to encrypt credit card data, due to the costs involved, and even now, PCI hasn't managed to persuade every handler/storer of credit card data to do this correctly.

So the long answer is - No, it is not going to get any budget until it is mandated.


I'm interested to know if there are techniques that can be used to securely encrypt personal details so that they are still "usable".

This is what the field of Homomorphic encryption is all about. It is already possible, via end-to-end voting systems like Helios to publicly store votes in an encrypted fashion, so that the public can add them up to confirm the totals, and to also check that their own vote was indeed included in the total. Without giving someone a 'receipt' that they can use to sell their vote. Surprising, but true.

We now have more advanced forms of homomorphic encryption that are suitable for storing data encrypted in the cloud, and allowing a not-very-highly-trusted server to directly do useful computation on it. They are still too slow for many uses, but progress is being made.

The ways of cryptography are often counter-intuitive, and asking basic questions like this is always a good thing - thanks!

We've been doing somewhat similar things for decades with passwords. You left out the fact that Sony said that the "PlayStation Network/Qriocity password" was stolen also - clearly this is personal information intended to remain a secret. And of course a competent site should indeed be able to both store something useful, and protect the actual password via standard hashing/salting/iteration techniques that have been in use since 1979 at least. Their press release seems to be evidence that Sony didn't properly handle them.


the above combination of information still leaves you open to many forms of identity theft

Does it? If so then the obvious question is: why?

All this information is part of the public record. Why in 2011 do we still pretend that it is secret at all never mind top secret? Who is building the brain damaged systems that depend on the pretence that public information is secret?

Our name and address is so need-to-know-basis-only secret that we print it on the outside of envelopes and give it away on business cards.

obviously credit cards can (and should) be encrypted

Just as the information that is embossed on the plastic cards themselves is encrypted.

Oh, wait.

Well at least we never let those cards out of our sight. Or hand them to complete strangers. Or read them out over the phone.

Oh.

Again - how did the credit card companies manage to convince people that these things are secrets?