|Subject||Re: [Firebird-Architect] Re: Does the database 'need' encryption?|
> I think what we have here is a set of users who want encryption and aNot "developers who don't", but rather "developers who have other things
> set of developers who don't. In short, an impasse. And in the open
> source, an impasse goes in favor of the developers.
with higher prios to worry about"... I think everybody would only
welcome new contributors that would take care of the security part.
Considering the situation that most of us as amateurs in that area, I
see no chance that project can afford itself work in that area.
Incorrectly implemented encryption seems to be more dangerous than no
encryption at all - it would fool people with false sense of being secure.
> 'Tis a pity that we never got around to discussion what an encryptionI deliberately wrote that Oracle / MS SQL have different approach. Some
> architecture might look like, but again, that's the open source world.
time ago I invested some time to check whether it would be feasible for
FB to implement something similar to what they do.
In few words, one part of their security concept addresses the issue of
encrypting sensible information in some columns while leaving the
database operational for the normal users (they would see encrypted data
unless a key is stored in the session).
This goes in the direction of the column-based security and might be
quite interesting topic directly related to the database engine...