<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 06/27/2012 11:26 AM, Mike Brudenell wrote:
<blockquote
cite="mid:CAPXCWauZt6hyXp5GV+cnjcxKPycZB74bssJsoLeFmOzJBOh55g@mail.gmail.com"
type="cite">Hi, Tamas -<br>
</blockquote>
<br>
hi,<br>
<br>
<blockquote
cite="mid:CAPXCWauZt6hyXp5GV+cnjcxKPycZB74bssJsoLeFmOzJBOh55g@mail.gmail.com"
type="cite">On 26 June 2012 17:06, Papp Tamas <span dir="ltr"><<a
moz-do-not-send="true" href="mailto:tompos@martos.bme.hu"
target="_blank">tompos@martos.bme.hu</a>></span> wrote:<br>
<div class="gmail_quote">
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div bgcolor="#FFFFFF" text="#000000">Users trust in
sysadmins, they have to.<br>
Anyway zip password is also a good idea, but it's not enough
safe, not enough.<br>
I prefer server side protection.</div>
</blockquote>
</div>
<br>
I think we'll have to agree to differ on this one: if I were
conducting highly sensitive research using specialist data I
wouldn't feel I could leave it to someone else to encrypt for me
before uploading it for transferring to someone else.
<div>
<br>
</div>
<div>Implementing encryption on the server side wouldn't
necessarily make it any stronger, and could actually (depending
on what the SysAdmin chose to set up) be weaker than you'd like,
giving you a false sense of security. For additional security
you could look at using something like GnuPG to:</div>
<div>
<ol>
<li>Set up a public/proviate key pair, then</li>
<li>encrypt your data using your colleague's public key, and
then</li>
<li>digitally sign it with your own private key.</li>
</ol>
<div>Upon receipt your colleague can then:</div>
<div>
<ol>
<li>Verify that it was really you who sent it by validating
the file with your published public key, and then</li>
<li>decrypt it using their own private key (which only they
know the pass-phrase to).</li>
</ol>
<div>
Yes, it's hoops to jump through but it gives them
reassurance that the data really was from yourself, and you
reassurance that only they can read the data. Gives plenty
of security (but possibly overkill for what you need?). Oh,
and couldn’t be implemented server-side as it needs people's
private and public keys for the process. :-)</div>
</div>
</div>
</blockquote>
<br>
You're right. But the application is used by users. They don't care
about gpg or any other kind of encrypting. If there is no easy way,
they don't use anything. Of course for maximum security they can use
both option (I wrote before) and in case gpg is not necessary, web
authentication would be good enough.<br>
<br>
tamas<br>
</body>
</html>