RSS Feeds: restrict access

Question

"We are a bunch of journalists and we share much of the information via e-mails. This has become tedious now. Hence we found out a way to share, by just having to share our private blog posts via RSS(achieved through token OAuth.) But now there is a new problem. Not all private posts are the same. I want only a specific group of people to see a specific set of feeds not all. So I started to encrypt that part of the feed required by a specific group, by a specific key, the key being shared my all those members part of that group. Since a group has the key to decrypt only a part of the feed, the information in the other part is safe. Now there seems to be a new problem, a person might be a part of two groups, that means he needs to have both the keys to decrypt it, that means the decryption is two times slower and we have to send two keys securely. Is there a way out of this problem. Can this be somehow achieved through PKI?"

(This is something I encountered while trying to solve a problem. If you are interested see http://groups.drupal.org/node/9719 )

NOTE:Imported from http://stackoverflow.com/questions/14502756/rss-feed-restricted-access

Answer 1

This isn't about encryption, this is about finding an application that does what you want. Encryption is just a tool to secure information, and so is PKI, but it's only one way to go about it. In fact, encryption is not really ideal for what you are trying to do, as you are in essence using encryption in place of account management. What you need is an application where you say which data is for which groups and it goes and does it for you. As for encryption it's unlikely you'd need encryption of data at rest, so just use SSL.

Unless you really are paranoid about data security I suggest you use web-based collaboration tools like evernote or the like, that way someone else handles the dirty work and you just handle the content.

Answer 2

I agree with WoJ, sounds like you want a wordpress setup.

To expand on it, you could effectively create groups (i.e. through google groups, facebook, etc) and only invite the appropriate people involved in those groups. That gives your users the option to receive email updates that are relevant.

Another home-grown solution would be to set up a handful of wordpress blogs related to the appropriate groups; this offers the same sort of functionality as google groups and facebook, with the peace of mind that comes with not having to worry about where the actual data is stored, as well as access to the server logs associated with your traffic (i.e. traffic from China or Iran when you don't have anyone operating from there.) If the data is especially sensitive, you can also add two factor authentication and even have it only accessible by VPN.

Answer 3

You could set up an exchange platform where the access (to posts and RSS) would be based on roles. An example is the CaPa protect plugin for Wordpress.