Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

"We are a bunch of journalists and we share much of the information via e-mails. This has become tedious now. Hence we found out a way to share, by just having to share our private blog posts via RSS(achieved through token OAuth.) But now there is a new problem. Not all private posts are the same. I want only a specific group of people to see a specific set of feeds not all. So I started to encrypt that part of the feed required by a specific group, by a specific key, the key being shared my all those members part of that group. Since a group has the key to decrypt only a part of the feed, the information in the other part is safe. Now there seems to be a new problem, a person might be a part of two groups, that means he needs to have both the keys to decrypt it, that means the decryption is two times slower and we have to send two keys securely. Is there a way out of this problem. Can this be somehow achieved through PKI?"

(This is something I encountered while trying to solve a problem. If you are interested see http://groups.drupal.org/node/9719 )

NOTE:Imported from http://stackoverflow.com/questions/14502756/rss-feed-restricted-access

share|improve this question
add comment

3 Answers

I agree with WoJ, sounds like you want a wordpress setup.

To expand on it, you could effectively create groups (i.e. through google groups, facebook, etc) and only invite the appropriate people involved in those groups. That gives your users the option to receive email updates that are relevant.

Another home-grown solution would be to set up a handful of wordpress blogs related to the appropriate groups; this offers the same sort of functionality as google groups and facebook, with the peace of mind that comes with not having to worry about where the actual data is stored, as well as access to the server logs associated with your traffic (i.e. traffic from China or Iran when you don't have anyone operating from there.) If the data is especially sensitive, you can also add two factor authentication and even have it only accessible by VPN.

share|improve this answer
    
I am actually thinking of a Drupal setup not wordpress and thats the exact functionality that I want. –  bobbyaldol Feb 7 '13 at 13:17
add comment

You could set up an exchange platform where the access (to posts and RSS) would be based on roles. An example is the CaPa protect plugin for Wordpress.

share|improve this answer
add comment

This isn't about encryption, this is about finding an application that does what you want. Encryption is just a tool to secure information, and so is PKI, but it's only one way to go about it. In fact, encryption is not really ideal for what you are trying to do, as you are in essence using encryption in place of account management. What you need is an application where you say which data is for which groups and it goes and does it for you. As for encryption it's unlikely you'd need encryption of data at rest, so just use SSL.

Unless you really are paranoid about data security I suggest you use web-based collaboration tools like evernote or the like, that way someone else handles the dirty work and you just handle the content.

share|improve this answer
1  
its only a a part of the problem that I have mentioned. Think of a corporate who has both a public and a private blog.I have data that I want to syndicate to myself, but I don't want you to see it. It's private. Now this could be my credit card balance or internal bug reports for the day job. Either way, I want the information in a form suitable for syndication but not available to everyone.Now my aggregator of choice is Bloglines,sure they're nice folks, but I really don't want to give them my password. One security breach and my whopping credit card debt is splattered across the Web. –  bobbyaldol Jan 24 '13 at 15:40
    
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.