154 reputation
18
bio website
location
age
visits member for 3 years, 2 months
seen Jun 9 at 3:18

Jun
9
comment Encrypting files on Google Drive
Basically means you need to have some specific trustworthy 3rd party non-google app that can encrypt/decrypt. 7-zip can do it but it makes an archive and you'd have to delete the original I guess or just send google drive a 7-zip copy.
Feb
2
awarded  Notable Question
Dec
7
awarded  Popular Question
Apr
8
awarded  Popular Question
May
3
comment When is it appropriate to SSL Encrypt Database connections?
Sorry I said that wrong. SSL will add security if they have access to the LAN but not the local machines. SSL will add security if the two servers communicate over the internet. However, if they have local machine access, then it doesn't add security. Plus, you have bigger problems if they've already accessed the LAN. If you're communicating within LAN though, usually SSL is not necessary, because they would need to already have hacked a machine within the LAN (which shouldn't happen with the hosting firm). Though if I was a bank, added security like this would definitely help.
May
3
comment When is it appropriate to SSL Encrypt Database connections?
That is exactly a good detailed explanation I was looking for. Basically unless the web server and database server are physically in different locations and are connecting over a remote IP, then they may be vulnerable. However, if they are communicating on some local network the only way to sniff those packets would be someone who is also within that local network (and we have whitelisting anyway). SSL will provide no added security if they already have access to the local network. Even if they hack a local process, then they have your certificate anyway.
May
3
accepted When is it appropriate to SSL Encrypt Database connections?
May
2
comment When is it appropriate to SSL Encrypt Database connections?
@RoryAlsop Indeed, but also people need to see and remember that you shouldn't just dismiss people for asking clarifications on questions which is what I did.
May
2
comment When is it appropriate to SSL Encrypt Database connections?
@Polynomial furthermore, please don't ever dismiss arguments again in comments. If all engineers and scientists behaved this way, nothing in science would advance because whenever something is questioned it would be dismissed for "you've already made up your mind because you're arguing with me." Debate is exactly how progress is achieved. Science, especially computer science and IT security works on consensus not on "listen to my advice or go away." I wish more debate occurred on stackoverflow, it might create higher quality answers.
May
2
awarded  Critic
May
2
comment When is it appropriate to SSL Encrypt Database connections?
@George Bailey I don't know the cost yet. But obviously determining the cost itself is a cost. The cost of learning how to setup SSL between webserver and database server, getting that to work with Entity Framework and ASP.net, and the cost of slowed down website due to constant encryption-decryption that is absolutely necessary on every transmitted message. If the cost was so small, then every website in the planet would be SSL. I am wondering how badly it might slow down the connection.
May
2
comment When is it appropriate to SSL Encrypt Database connections?
@polynomial don't be absurd. I am obviously looking for compelling arguments to convince me as a skeptical user so that I have strong arguments when someone asks "why is the site so slow?" It's quite presumptious of you to assume just because I'm arguing I've "made up my mind." I really think it is counterproductive when stackoverflow users tell you to go away when you don't say "I must accept your every advice without questioning anything and immediately give you best answer" to your every statement. It's hostile and unproductive.
May
2
comment When is it appropriate to SSL Encrypt Database connections?
@Bruno I'm concerned about delays, whenever I work with SSL, huge delays occur because of encrypting and decrypting data transmitted. In addition, I'd have to figure out how ASP.net can SSL-protect connection strings and how entity framework will be using SSL. What kind of millisecond delays will it add to my queries? I'm not worried about administrators, that is silly, if administrators want to spy on their own data, they can go ahead and do so but they can already view all the data in the database.
Apr
30
comment When is it appropriate to SSL Encrypt Database connections?
Obviously though, most security in systems are a probability. If you already implemented some IP checking whitelisting, do you really need to create overhead with SSL security between Web server and DB server if they are locally connected and firewalled? Assuming your administrators are trustworthy and no other vulnerable application services are running (plus if your local network is penetrated you have bigger issues at hand).
Apr
30
comment When is it appropriate to SSL Encrypt Database connections?
You've convinced me but I'm playing devil's adv. Can you tell me what kind of DB information you think would need such an added layer of security. Every security layer needs a cost-benefit analysis, if a hacker wants to get into my DB and would spend time penetrating the local network, the only motivation would be if the database has valuable CC or banking information right? There is also the cost of learning a new concept like encrypting with SSL database connections.
Apr
30
comment When is it appropriate to SSL Encrypt Database connections?
SSL handshakes can take 30-40 seconds, SQL queries take milliseconds. I don't think you can say SSL will be minimal in overhead. If it is a local network, how can there be others connected to it without having physical wired access to the router?
Apr
30
asked When is it appropriate to SSL Encrypt Database connections?
Jul
25
awarded  Scholar
Jul
25
accepted Need to secure (and add SSL?) RPC port 443 on Win2003 server
Jul
25
comment Need to secure (and add SSL?) RPC port 443 on Win2003 server
No I don't think there is any RPC, I just said that because sometimes port 443 is used by RPC, I have no clue why there would be RPC as I never installed anything like that. It's probably just IIS with https, but none of my IIS websites have SSL-forced.