TheConfusedOne wrote:
I'm a bit confused about the 2-key system vs. a pluggable module. To me they seem the same. (I'm probably missing something).
I don't think that it is safe to allow a remote program access to your database without further protections. Even if the password is not stored in plain-text, can't a user just listen-in to the outgoing packet after it's been decrypted?
Code:
====== pass=12345 =========
|client| ----------------> |db server|
====== =========
I don't know the best answer to this problem... Web services are one way I think.
Is my understanding correct?
I think I found something you may be looking for after googling for "encrypting hibernate password":
http://www.javalobby.org/java/forums/t93046.htmlhttp://www.jasypt.org/hibernate3.html
What I'm suggesting when I mentioned two approaches is that some sort of trivial encryption (non two key) would meet the requirement. Software that reads the "encrypted" password from the file, de-codes it, and uses it, would work for me.
Yes, this is not secure over a network, but for the requirement I'm looking to meet, there is no network. The only requirement is that the password not be sitting there on the disk in a plain text file. That simple, that's it.
I could also scramble the entire XML file, using some external tool. But I'd need some way to decode it and allow Hibernate to access the set up without having the decoded XML on a disk file.
I looked at uses of jasypt and using a web service (before posting here) or some other way to define the data source. This could probably meet the requirement, but this is what I'm calling overkill. My application does not otherwise need a container, it's a simple stand alone Java application. The security requirement is not a super-duper one. It just shouldn't be so trivial to see the password.
Thanks for the consideration