Re^4: Encrypt files on server and then decrypt when user downloads

[MPM]

I understand that it's not 100% secure, I'm just trying to add another layer, well it's not really me that wants to add it, but anyway.....also, just because they have access to the server and possibly the files, that wouldn't necessarily mean they have access to the script also. Thanks for the input though.

[Illuminatus]

I echo BrowserUK's sentiment. Put another way "put your effort into protecting access to the files, not encrypting them". Using linux for an example, you can set the directory permission of the files to only allow read for the owner or group. The 'web-server SSL' user should be the owner. If a hacker can get access as the web-SSL user (or root), then you should be concentrating on improving access security, not download security. If this is a remote-FS issue, ie the web-server mounts the FS where these files reside, and security isn't as good on that file-server, fix the security there.

fnord

[BrowserUk]

also, just because they have access to the server and possibly the files, that wouldn't necessarily mean they have access to the script also.

Ah well. If the script is secure, just put the files in the same place as the script and they'll be no need to encrypt them.

[moritz]

I understand that it's not 100% secure, I'm just trying to add another layer

But it's not another layer -- it's simply the pretense of another layer.