From: Paul Förster <paul.foerster@gmail.com>
To: Tim Cross <theophilusx@gmail.com>
Cc: pgsql-admin@lists.postgresql.org
Subject: Re: Encryption in pg_dump
Date: Thu, 23 Jul 2020 07:48:19 +0200
Message-ID: <C579395F-2357-4C44-950E-352D5B00F601@gmail.com> (raw)
In-Reply-To: <87zh7qbxqk.fsf@gmail.com>
References: <CAD7GeHRZ3tu8y9VG_0juVK3RQq6r+t6HciguEz_C8Eh85Hmq3A@mail.gmail.com>
<2BCA8D4B-E94D-4F2F-99A5-D783912A1CDF@gmail.com>
<20200722185541.GE3899@momjian.us>
<6D40812C-3F42-41A2-A548-4EC7754DF473@gmail.com>
<87zh7qbxqk.fsf@gmail.com>
Hi Tim,
> On 23. Jul, 2020, at 07:34, Tim Cross <theophilusx@gmail.com> wrote:
>
> Yes, I think the IT heads issue is the primary driver - combined with
> very poor understanding of information security at senior levels and a
> huge growth of poor quality and 'snake oil salesmen' in the IT security space
> due to the amount of money ill informed senior managers are throwing at
> what they think is a technical problem which usually is in fact a
> business process problem.
and the best solution to that nonsense comes from the big red O. They use PKCS#12 wallets. Good, but as soon as you need auto-open wallets, which you do for every automated job like backups, you put the key right next to it. So it's like having a big safe in your house but the combination of the lock is written all over it. So much for security by obscurity.
For PostgreSQL we use a umask of 077 in our profile. That's why I keep telling my IT head that this is enough and it does not make sense to put the key next to the safe.
Cheers,
Paul
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: paul.foerster@gmail.com, theophilusx@gmail.com, pgsql-admin@lists.postgresql.org
Subject: Re: Encryption in pg_dump
In-Reply-To: <C579395F-2357-4C44-950E-352D5B00F601@gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox