Skip site navigation (1) Skip section navigation (2)

Re: [PHP] Secure DB Systems - How to

From: Daniel Struck <struck(dot)d(at)retrovirology(dot)lu>
To: Bruno Wolff III <bruno(at)wolff(dot)to>
Cc: Sarah Tanembaum <sarahtanembaum(at)yahoo(dot)com>,pgsql-php(at)postgresql(dot)org, pgsql-admin(at)postgresql(dot)org,pgsql-hackers-win32(at)postgresql(dot)org, pgadmin-support(at)postgresql(dot)org,pgsql-sql(at)postgresql(dot)org
Subject: Re: [PHP] Secure DB Systems - How to
Date: 2004-07-13 13:18:38
Message-ID: 20040713151838.0004cb8e@localhost (view raw or flat)
Thread:
Lists: pgadmin-supportpgsql-adminpgsql-hackers-win32pgsql-phppgsql-sql
> If you decrypt the data on the database, the sysadmin can see it.

Hm, you are right. If one does decrypt the data on the database you have to sent the password to postgresql and so a administrator of the database could easily grasb the password.

So the only way to go, would be to perform en/decryption on the client side?


> If you are willing to take that chance (e.g. if you primary concern is
> some third party getting a snapshot of the DB), then you can do lots of
> things.

I wonder now; if somebody could achieve to get a snapshot of the database, they could also be able to get the log-file of postgresql.
So one would also have to make attention that the information like sql statements don't leak that way.
Are there other places where this kind of information could leak?


Greetings,

Daniel Struck

-- 
Retrovirology Laboratory Luxembourg
Centre Hospitalier de Luxembourg
4, rue E. Barblé
L-1210 Luxembourg

phone: +352-44116105
fax:   +352-44116113
web: http://www.retrovirology.lu
e-mail: struck(dot)d(at)retrovirology(dot)lu

In response to

Responses

pgsql-php by date

Next:From: Mitch PirtleDate: 2004-07-13 14:06:02
Subject: Re: [ADMIN] [PHP] Secure DB Systems - How to
Previous:From: Bruno Wolff IIIDate: 2004-07-13 12:38:17
Subject: Re: [PHP] Secure DB Systems - How to

pgsql-admin by date

Next:From: Gaetano MendolaDate: 2004-07-13 13:32:49
Subject: Re: Slony NG
Previous:From: Jim SeymourDate: 2004-07-13 13:10:04
Subject: Re: Slony NG

pgadmin-support by date

Next:From: Mitch PirtleDate: 2004-07-13 14:06:02
Subject: Re: [ADMIN] [PHP] Secure DB Systems - How to
Previous:From: Bruno Wolff IIIDate: 2004-07-13 12:38:17
Subject: Re: [PHP] Secure DB Systems - How to

pgsql-hackers-win32 by date

Next:From: Alexander CohenDate: 2004-07-13 13:44:27
Subject: libpq compiled not compiled with minGW
Previous:From: Merlin MoncureDate: 2004-07-13 12:51:13
Subject: Re: PostGre and Windows XP

pgsql-sql by date

Next:From: Mitch PirtleDate: 2004-07-13 14:06:02
Subject: Re: [ADMIN] [PHP] Secure DB Systems - How to
Previous:From: Bob ArensDate: 2004-07-13 12:56:00
Subject: Query plan discrepancies

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group