Re: Client/server security

David Williams <djw@smooth1.demon.co.uk> wrote: :In article <54bdp8$m8g@nntp.idgonline.no>, Nils Myklebust :<Nils.Myklebust@idg.no> writes :>I think, I think (I hope :-)... :> :>If Informix had implemented password checking on the set role statment :>we could possibly have solved the security issues that have reasantly :>been discussed in a very easy and elegant way. :> :>The statement would be: :> :>set role rolename identified by password :> :>We could then store the password somewhere in an encrypted form. It :>could be in a database table every user had select rights only to. :> :>The application would then have to decrypt the password, plug it into :>the above statement and execute it. We could write encryption and :>decryption algoritms so that it whould not be easy for a user to :>decrypt the password. In this way the user wouldn't be able to set the :>role outside of an application that have the built in functionallity :>to do it. :> : What stops the user disassemnling the application to see how it works? Probably nothing. We have however come prety much farther if that is the only way. Also I think there are techniques that could be used for the encryption/decryption that would make it a little harder then simply finding the code that does the work. I am not an expert on this, that's why I invited input. ...snip... : Have you considered looking at Online/Secure ? No I haven't. I don't think even that would solve our little problem though. If an ODBC connection is even possible to this engine wouldn't it exibit the same problem - of not beeing able to distinguish between applications run by the same user using the same password? Another think is that Online/Secure sounds like a wast overkill for the kind of security we are after here. We want simple and low cost solutions to a serious problem that I think is affecting a lot of users. And I believe most of them aren't even aware of it. :-- :David Williams Nils.Myklebust@idg.no NM Data AS, P.O.Box 9090 Gronland, N-0133 Oslo, Norway My opinions are those of my company