From: Andreas 'ads' Scherbaum <adsmail@wars-nicht.de>
To: pgsql-admin@postgresql.org
Subject: Re: Database level encryption
Date: Tue, 6 Apr 2010 14:59:38 +0200
Message-ID: <20100406145938.5037011e@platin.wars-nicht.de> (raw)
In-Reply-To: <j2v5078d8af1004060245g35b87d5av329ab7a6af9a5579@mail.gmail.com>
References: <q2y5078d8af1004030635g624bf8f7r580cb3ebe7135b74@mail.gmail.com>
<4BB774D4.3070306@joeconway.com>
<m2r5078d8af1004051330n1874e532u3c88fd1bc31c8697@mail.gmail.com>
<v2ldcc563d11004051334ledfcd2b2gf8db60ca48b43118@mail.gmail.com>
<4BBA05E80200002500030493@gw.wicourts.gov>
<4BBA6924.5050305@joeconway.com>
<j2v5078d8af1004060245g35b87d5av329ab7a6af9a5579@mail.gmail.com>
On Tue, 6 Apr 2010 12:45:52 +0300 Timothy Madden wrote:
> The machine is a mini-laptop running almost all day time (actually
> there are many of them) and if the machine is captured it is likely to
> be captured while running. With an encrypted file system if the
> machine is already booted you already have access to the file system
> and can simply copy it and even place back the machine without anyone
> notice anything.
If someone captures the machine the bad guy can install a network
sniffer and steal the database passwords upon connect.
> With an encrypted database, you need the password anytime you connect,
> even if another application already has an open connection.
See above, this doesn't help.
If someone get's root access to your machine, nothing (no filesystem
and no database encryption) is goint to help you here.
Bye
--
Andreas 'ads' Scherbaum
German PostgreSQL User Group
European PostgreSQL User Group - Board of Directors
Volunteer Regional Contact, Germany - PostgreSQL Project
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: adsmail@wars-nicht.de
Subject: Re: Database level encryption
In-Reply-To: <20100406145938.5037011e@platin.wars-nicht.de>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox