Received: from localhost (maia-2.hub.org [200.46.204.187]) by postgresql.org (Postfix) with ESMTP id D15E19FB2EF for ; Tue, 5 Jun 2007 11:00:11 -0300 (ADT) Received: from postgresql.org ([200.46.204.71]) by localhost (mx1.hub.org [200.46.204.187]) (amavisd-maia, port 10024) with ESMTP id 67938-03 for ; Tue, 5 Jun 2007 10:59:50 -0300 (ADT) X-Greylist: from auto-whitelisted by SQLgrey-1.7.5 Received: from lists.commandprompt.com (host-254.commandprompt.net [207.173.203.254]) by postgresql.org (Postfix) with ESMTP id C67C19FB618 for ; Tue, 5 Jun 2007 10:59:55 -0300 (ADT) Received: from perhan.alvh.no-ip.org (201-221-217-243.bk12-dsl.surnet.cl [201.221.217.243]) (authenticated bits=0) by lists.commandprompt.com (8.13.7/8.13.6) with ESMTP id l55DxrvJ019465; Tue, 5 Jun 2007 06:59:53 -0700 Received: by perhan.alvh.no-ip.org (Postfix, from userid 1000) id 0CB8432A28; Tue, 5 Jun 2007 09:59:51 -0400 (CLT) Date: Tue, 5 Jun 2007 09:59:51 -0400 From: Alvaro Herrera To: Ron Johnson Cc: pgsql-general@postgresql.org Subject: Re: Encrypted column Message-ID: <20070605135951.GB8140@alvh.no-ip.org> References: <46645B01.6070605@terra.com.br> <4664983F.4010700@burntmail.com> <46656398.1090203@cox.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <46656398.1090203@cox.net> User-Agent: Mutt/1.5.13 (2006-08-11) X-Virus-Scanned: ClamAV version 0.88.5, clamav-milter version 0.88.5 on projects.commandprompt.com X-Virus-Status: Clean X-Greylist: Sender succeded SMTP AUTH authentication, not delayed by milter-greylist-1.6 (lists.commandprompt.com [192.168.2.159]); Tue, 05 Jun 2007 06:59:54 -0700 (PDT) X-Virus-Scanned: Maia Mailguard 1.0.1 X-Archive-Number: 200706/395 X-Sequence-Number: 115218 Ron Johnson wrote: > On 06/04/07 17:54, Guy Rouillier wrote: > >Many people consider two-way encryption to be insecure; two-way > >encryption means you can decrypt a value if you know the key, and it is > >insecure because you usually have to put the key into the source code. > >That means at least one person in your company, the programmer > >maintaining the source code, can learn all of your users' passwords. > > Two-way encryption is needed for companies that store customer > credit cards. I thought that the advice for companies storing customer CCs was: don't. -- Alvaro Herrera http://www.CommandPrompt.com/ The PostgreSQL Company - Command Prompt, Inc.