srn Posted April 2, 2015 Report Share Posted April 2, 2015 It is not uncommon for people to accidentally check in sensitive information such as database logins and API keys (x-ref http://arstechnica.com/security/2015/03/ubers-epic-db-blunder-is-hardly-an-exception-github-is-awash-in-passwords/) and the blesta encryption key is almost as sensitive. I think there should really be a script that uses the old key and a newly generated key and descrypts/re-encrypts the data in the database. Blesta Addons 1 Quote Link to comment Share on other sites More sharing options...
mrrsm Posted April 2, 2015 Report Share Posted April 2, 2015 +1 I think that having a way to migrate to a new encryption key would be useful Quote Link to comment Share on other sites More sharing options...
Michael Posted April 2, 2015 Report Share Posted April 2, 2015 Not a fan, because if someone get's your database some how, installs blesta, all they need to do is run that script to change the key and then they have everything in the database. Quote Link to comment Share on other sites More sharing options...
mrrsm Posted April 2, 2015 Report Share Posted April 2, 2015 Not a fan, because if someone get's your database some how, installs blesta, all they need to do is run that script to change the key and then they have everything in the database. They need your old encryption key, if they have that and your database you are screwed anyways. Quote Link to comment Share on other sites More sharing options...
Michael Posted April 2, 2015 Report Share Posted April 2, 2015 They need your old encryption key, if they have that and your database you are screwed anyways. True but you don't want to have something which is vital to your system to be changed the only reason this would be a good idea is if you are merging two databases to one. Blesta to Blesta installation so you don't have two sets of encryption. Quote Link to comment Share on other sites More sharing options...
mrrsm Posted April 2, 2015 Report Share Posted April 2, 2015 True but you don't want to have something which is vital to your system to be changed the only reason this would be a good idea is if you are merging two databases to one. Blesta to Blesta installation so you don't have two sets of encryption. Do you ever change your password? To me this could be the same principal. Another reason I see is if someone gained access to my system but my database was safe I would need to change my encryption key for security reasons. Having a tool, not normally uploaded to your live system, available would be nice to have. Not a high priority for the blesta team, I don't think, as anyone (developer) should be able to create a tool to do this as blesta doesn't hide how it does encryption. Blesta Addons 1 Quote Link to comment Share on other sites More sharing options...
Michael Posted April 2, 2015 Report Share Posted April 2, 2015 Do you ever change your password? To me this could be the same principal. Another reason I see is if someone gained access to my system but my database was safe I would need to change my encryption key for security reasons. Having a tool, not normally uploaded to your live system, available would be nice to have. Not a high priority for the blesta team, I don't think, as anyone (developer) should be able to create a tool to do this as blesta doesn't hide how it does encryption. Passwords are different, an encryption key only works for encrypting the database hashes. As you stated you need both otherwise they are useless. A password gains access to whatever you use it for. Quote Link to comment Share on other sites More sharing options...
mrrsm Posted April 2, 2015 Report Share Posted April 2, 2015 Passwords are different, an encryption key only works for encrypting the database hashes. As you stated you need both otherwise they are useless. A password gains access to whatever you use it for. You are correct, it was a bad analogy. My overall opinion stands though Quote Link to comment Share on other sites More sharing options...
Paul Posted April 3, 2015 Report Share Posted April 3, 2015 There should be a utility that would allow you to change the encryption key. The question is whether that's more important to people than some of the other features that have been requested. I have no doubt we'll get to it eventually, but it's not a very squeaky wheel. Blesta Addons 1 Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.