Re: Encrypted data on webserver

From: Luke Vogel (luke@bell-bird.com.au)
Date: 01/19/02

  • Next message: teste'r: "realtime intrusion monitor" 

    From: Luke Vogel <luke@bell-bird.com.au>
Date: Sat, 19 Jan 2002 22:16:56 +1000

    Christoph R wrote:

    > I'm talking about the HTML docs (and possibly some pics) that should be
    > stored
    > encrypted on the disk, Just in case someone hacks the server and steals
    > the data
    > right from the filesystem.
    > The process should look something like:
    > 1. decrypt the data (data is plain now)
    > 2. serve it with apache over ssl (data is encrypted again)
    > 3. client decodes the ssl encryption and has his plain data.
    >
    > Does this make sense? And, more important will it give me additional
    > security?

    Sending any data over SSL is reasonably secure in terms of data
    interception etc, but I doubt that you have much to gain by doing it
    this way.

    How feasible would it be to send the encrypted files to the end user
    encrypted with pgp/gpg on the fly?

    I.e.:
    1. Client selects desired files and provides his public key
    2. server script encrypts the data with the public key and forwards it
    to the client.
    3. Client uses his private key to decrypt the data.

    With this system, you wont get the html docs to be rendered by the
    browser of course. 

    -- 
Regards
Luke
------
Q:  What does FAQ stand for?
A:  We are Frequently Asked this Question, and we have no idea.
------
C.O.L.S FAQ - http://www.linuxsecurity.com/docs/colsfaq.html
Note: Remove NOSPAM from my return address if necessary
------

    Relevant Pages

    • Re: SSL Overhead?
      ... Encryption itself isn't the sole culprit of data expansion. ... behind data expansion is the web service - and not SSL. ... I don't see how your comment on security has any credence. ...
      (microsoft.public.dotnet.framework.compactframework)
    • Re: Secure web authentication system w/o SSL and PKI
      ... Authentication has nothing to do with SSL. ... Why do you want symmetric encryption? ...
      (comp.security.misc)
    • RE: ssh and ids
      ... box is the termination point of the SSL tunnel. ... Subject: ssh and ids ... Your claim is only partially true Peter. ... Encryption remains the bane of network-based intrusion ...
      (Focus-IDS)
    • Re: Why is .NET CF 2.0 (HttpWebRequest Class) using 40-bit Encryption over HTTPS?
      ... EndGetResponsemethod on the HttpWebRequest object. ... encryption, or requires no encryption at all, then my code works perfectly. ... I am investigating how to properly implement SSL Certificates because our ... above) and it still fails to communicate with the newly configured server. ...
      (microsoft.public.dotnet.framework.compactframework)
    • Re: username and Password sent as clear text strings
      ... encryption of the traffic. ... SSL is used. ... client, it would seem like too much hassle for a low possibility hack. ... This is how all web applications on the planet work today by design. ...
      (Pen-Test)