From: Timothy Madden <terminatorul@gmail.com>
To: Andreas 'ads' Scherbaum <adsmail@wars-nicht.de>
Cc: Kevin Grittner <Kevin.Grittner@wicourts.gov>
Cc: Scott Marlowe <scott.marlowe@gmail.com>
Cc: pgsql-admin@postgresql.org, Joe Conway <mail@joeconway.com>
Subject: Re: Database level encryption
Date: Wed, 7 Apr 2010 13:24:19 +0300
Message-ID: <t2k5078d8af1004070324m1f3d4f26lbc7f559e73d555ed@mail.gmail.com> (raw)
In-Reply-To: <4BBA6924.5050305@joeconway.com>
References: <q2y5078d8af1004030635g624bf8f7r580cb3ebe7135b74@mail.gmail.com>
<4BB774D4.3070306@joeconway.com>
<m2r5078d8af1004051330n1874e532u3c88fd1bc31c8697@mail.gmail.com>
<v2ldcc563d11004051334ledfcd2b2gf8db60ca48b43118@mail.gmail.com>
<4BBA05E80200002500030493@gw.wicourts.gov>
<4BBA6924.5050305@joeconway.com>
Andreas 'ads' Scherbaum <adsmail@wars-nicht.de> wrote:
> If someone captures the machine the bad guy can install a network
> sniffer and steal the database passwords upon connect.
I think protecting against a keylogger is a different issue than
database encryption. Is this why database encryption is "not needed"
for PostgreSQL, as people here say ?
>> With an encrypted database, you need the password anytime you connect,
>> even if another application already has an open connection.
>
> See above, this doesn't help.
>
> If someone get's root access to your machine, nothing (no filesystem
> and no database encryption) is goint to help you here.
I would have to disagree with you here. The whole point of encryption
is that you need the key in order to get your data back.
Timothy Madden
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Reply to all the recipients using the --to and --cc options:
reply via email
To: pgsql-admin@postgresql.org
Cc: terminatorul@gmail.com, adsmail@wars-nicht.de, Kevin.Grittner@wicourts.gov, scott.marlowe@gmail.com, mail@joeconway.com
Subject: Re: Database level encryption
In-Reply-To: <t2k5078d8af1004070324m1f3d4f26lbc7f559e73d555ed@mail.gmail.com>
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox