From: Michael Gould <mgould@intermodalsoftwaresolutions.net>
To: Timothy Madden <terminatorul@gmail.com>
To: Andreas 'ads' Scherbaum <adsmail@wars-nicht.de>
Cc: Kevin Grittner <Kevin.Grittner@wicourts.gov>
Cc: Scott Marlowe <scott.marlowe@gmail.com>
Cc: pgsql-admin@postgresql.org, Joe Conway <mail@joeconway.com>
Subject: Re: Database level encryption
Date: Wed, 7 Apr 2010 07:25:52 -0500
Message-ID: <4fafa57d090e57bb44ec5a177ecf292e@intermodalsoftwaresolutions.net> (raw)
In-Reply-To: <t2k5078d8af1004070324m1f3d4f26lbc7f559e73d555ed@mail.gmail.com>
Timothy,
I've worked with SQL Anywhere which does have database encryption. There
are pluses to having a encrypted db, but it did slow down the processing.
They also had the ability to encrypt stored procedures and triggers. That
didn't' seem to really slow down the system.
That being said, the encryption will keep the normal user out of the system,
but those aren't the people you need to worry about. The people you need to
worry about are the real hackers and they will be able to get around this
type of encryption. I'd like to see something to protect stored procedures
and triggers but overall I agree that a encrypted drive is probably the best
thing and require ssl connections.
Best Regards
Michael Gould
"Timothy Madden" <terminatorul@gmail.com> wrote:
> Andreas 'ads' Scherbaum <adsmail@wars-nicht.de> wrote:
>
>> If someone captures the machine the bad guy can install a network
>> sniffer and steal the database passwords upon connect.
>
> I think protecting against a keylogger is a different issue than
> database encryption. Is this why database encryption is "not needed"
> for PostgreSQL, as people here say ?
>
>
>>> With an encrypted database, you need the password anytime you connect,
>>> even if another application already has an open connection.
>>
>> See above, this doesn't help.
>>
>> If someone get's root access to your machine, nothing (no filesystem
>> and no database encryption) is goint to help you here.
>
>
> I would have to disagree with you here. The whole point of encryption
> is that you need the key in order to get your data back.
>
>
> Timothy Madden
>
> --
> Sent via pgsql-admin mailing list (pgsql-admin@postgresql.org)
> To make changes to your subscription:
> http://www.postgresql.org/mailpref/pgsql-admin
>
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: mgould@intermodalsoftwaresolutions.net, terminatorul@gmail.com, adsmail@wars-nicht.de, Kevin.Grittner@wicourts.gov, scott.marlowe@gmail.com, mail@joeconway.com
Subject: Re: Database level encryption
In-Reply-To: <4fafa57d090e57bb44ec5a177ecf292e@intermodalsoftwaresolutions.net>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox