Content-Type: text/plain;
	charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 13.4 \(3608.120.23.2.1\))
Subject: Re: Encryption in pg_dump
From: =?utf-8?Q?Paul_F=C3=B6rster?= <paul.foerster@gmail.com>
In-Reply-To: <87zh7qbxqk.fsf@gmail.com>
Date: Thu, 23 Jul 2020 07:48:19 +0200
Cc: pgsql-admin@lists.postgresql.org
Content-Transfer-Encoding: quoted-printable
Message-Id: <C579395F-2357-4C44-950E-352D5B00F601@gmail.com>
References: 
 <CAD7GeHRZ3tu8y9VG_0juVK3RQq6r+t6HciguEz_C8Eh85Hmq3A@mail.gmail.com>
 <2BCA8D4B-E94D-4F2F-99A5-D783912A1CDF@gmail.com>
 <20200722185541.GE3899@momjian.us>
 <6D40812C-3F42-41A2-A548-4EC7754DF473@gmail.com> <87zh7qbxqk.fsf@gmail.com>
To: Tim Cross <theophilusx@gmail.com>
Precedence: bulk

Hi Tim,

> On 23. Jul, 2020, at 07:34, Tim Cross <theophilusx@gmail.com> wrote:
>=20
> Yes, I think the IT heads issue is the primary driver - combined with
> very poor understanding of information security at senior levels and a
> huge growth of poor quality and 'snake oil salesmen' in the IT =
security space
> due to the amount of money ill informed senior managers are throwing =
at
> what they think is a technical problem which usually is in fact a
> business process problem.=20

and the best solution to that nonsense comes from the big red O. They =
use PKCS#12 wallets. Good, but as soon as you need auto-open wallets, =
which you do for every automated job like backups, you put the key right =
next to it. So it's like having a big safe in your house but the =
combination of the lock is written all over it. So much for security by =
obscurity.

For PostgreSQL we use a umask of 077 in our profile. That's why I keep =
telling my IT head that this is enough and it does not make sense to put =
the key next to the safe.

Cheers,
Paul=