One of my software (an R package) has to save on disk users sensitive information.
I encrypt such information using AES encryption using a random key that is generated at the moment of installation (which is saved in the same directory where I store the user profile).
I am trying to find a way to obfuscate the key and avoid other users on the same machine to access the other users key (the key are of course have read permissions only for the users who created the, but super users can use the key and read other profiles).
I would like to know:
is it really necessary worrying about superusers? My gut feeling says no: in princible whathever the encryption method a superuser can read all the files and ultimately any kind of keys of the users;
is ther a better way store a user profile other than encrypting it using AES or any other method?