pg.ddx.io  pgsql-sql@postgresql.org mailing list archive  

help / color / mirror / Atom feed

From: Daniel Struck <struck.d@retrovirology.lu>
To: Bruno Wolff III <bruno@wolff.to>
Cc: Sarah Tanembaum <sarahtanembaum@yahoo.com>
Cc: pgsql-php@postgresql.org
Cc: pgsql-admin@postgresql.org
Cc: pgsql-hackers-win32@postgresql.org
Cc: pgadmin-support@postgresql.org
Cc: pgsql-sql@postgresql.org
Subject: Re: [PHP] Secure DB Systems - How to
Date: Tue, 13 Jul 2004 15:18:38 +0200
Message-ID: <20040713151838.0004cb8e@localhost> (raw)
In-Reply-To: <20040713123817.GB3710@wolff.to>
References: <ccjra4$pgl$1@sea.gmane.org>
	<20040709152722.GA20935@wolff.to>
	<20040713113557.31e9d6dc@localhost>
	<20040713123817.GB3710@wolff.to>

> If you decrypt the data on the database, the sysadmin can see it.

Hm, you are right. If one does decrypt the data on the database you have to sent the password to postgresql and so a administrator of the database could easily grasb the password.

So the only way to go, would be to perform en/decryption on the client side?


> If you are willing to take that chance (e.g. if you primary concern is
> some third party getting a snapshot of the DB), then you can do lots of
> things.

I wonder now; if somebody could achieve to get a snapshot of the database, they could also be able to get the log-file of postgresql.
So one would also have to make attention that the information like sql statements don't leak that way.
Are there other places where this kind of information could leak?


Greetings,

Daniel Struck

-- 
Retrovirology Laboratory Luxembourg
Centre Hospitalier de Luxembourg
4, rue E. Barblé
L-1210 Luxembourg

phone: +352-44116105
fax:   +352-44116113
web: http://www.retrovirology.lu
e-mail: struck.d@retrovirology.lu

view thread (17+ messages)  latest in thread

Message-ID: <20040713151838.0004cb8e@localhost>
Permalink:  ../20040713151838.0004cb8e@localhost/
Also on:    postgresql.org/message-id/20040713151838.0004cb8e@localhost

copy link · copy postgr.es

reply

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Reply to all the recipients using the --to and --cc options:
  reply via email

  To: pgsql-sql@postgresql.org
  Cc: struck.d@retrovirology.lu, bruno@wolff.to, sarahtanembaum@yahoo.com, pgsql-php@postgresql.org, pgsql-admin@postgresql.org, pgsql-hackers-win32@postgresql.org, pgadmin-support@postgresql.org
  Subject: Re: [PHP] Secure DB Systems - How to
  In-Reply-To: <20040713151838.0004cb8e@localhost>

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

This inbox is served by DDX for PostgreSQL; see mirroring instructions
for how to clone and mirror all data and code used for this inbox