Date: Tue, 6 Apr 2010 14:59:38 +0200
From: Andreas 'ads' Scherbaum <adsmail@wars-nicht.de>
To: pgsql-admin@postgresql.org
Subject: Re: Database level encryption
Message-ID: <20100406145938.5037011e@platin.wars-nicht.de>
In-Reply-To: <j2v5078d8af1004060245g35b87d5av329ab7a6af9a5579@mail.gmail.com>
References: <q2y5078d8af1004030635g624bf8f7r580cb3ebe7135b74@mail.gmail.com>
	<4BB774D4.3070306@joeconway.com>
	<m2r5078d8af1004051330n1874e532u3c88fd1bc31c8697@mail.gmail.com>
	<v2ldcc563d11004051334ledfcd2b2gf8db60ca48b43118@mail.gmail.com>
	<4BBA05E80200002500030493@gw.wicourts.gov>
	<4BBA6924.5050305@joeconway.com>
	<j2v5078d8af1004060245g35b87d5av329ab7a6af9a5579@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

On Tue, 6 Apr 2010 12:45:52 +0300 Timothy Madden wrote:

> The machine is a mini-laptop running almost all day time (actually
> there are many of them) and if the machine is captured it is likely to
> be captured while running. With an encrypted file system if the
> machine is already booted you already have access to the file system
> and can simply copy it and even place back the machine without anyone
> notice anything.

If someone captures the machine the bad guy can install a network
sniffer and steal the database passwords upon connect.


> With an encrypted database, you need the password anytime you connect,
> even if another application already has an open connection.

See above, this doesn't help.

If someone get's root access to your machine, nothing (no filesystem
and no database encryption) is goint to help you here.


Bye

-- 
				Andreas 'ads' Scherbaum
German PostgreSQL User Group
European PostgreSQL User Group - Board of Directors
Volunteer Regional Contact, Germany - PostgreSQL Project