Mailing-List: contact user-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@couchdb.apache.org
Received-SPF: pass (nike.apache.org: domain of travis.jensen@gmail.com
 designates 209.85.216.52 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=mime-version:references:in-reply-to:from:date:message-id:subject:to
         :content-type:content-transfer-encoding;
        b=pkGF9v38np8sj3m/UxtrD5bHcIOgWz1b438iToot0qRrrAJsFzqBm7hKFEhEtOdCde
         vBWk8LerliUa8EQRdGWBO5S46/K08nbYPhCaRe0BKwLNM9xbJItbFWOtCCuDC25wOjWN
         FOmnpz5+lqjPfbfdAs/aYZT2FDWCb6N1++4K4=
Mime-Version: 1.0 (iPad Mail 8G4)
References: <1383643868066120172@unknownmsgid>
 <BANLkTimTtDmkz5UgHmFF7b4e=bZUwqAWgg@mail.gmail.com>
 <3746963615976933497@unknownmsgid>
 <BANLkTimewzqs4kWhfjTrDO1HTM8ewCfvAg@mail.gmail.com>
In-Reply-To: <BANLkTimewzqs4kWhfjTrDO1HTM8ewCfvAg@mail.gmail.com>
From: Travis Jensen <travis.jensen@gmail.com>
Date: Tue, 12 Apr 2011 15:42:48 -0600
Message-ID: <8307437816949766397@unknownmsgid>
Subject: Re: Encrypting attachments
To: "user@couchdb.apache.org" <user@couchdb.apache.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

My hope is to keep it self contained inside Couch. I am already
extending the auth to handle custom authentication, so I'm not afraid
to get into the code. :)

JS encryption won't work because you can't get access to files getting
posted.  If I could do that, I certainly would, but my only option
there (which I have investigated) is a plugin.

I'm not completely tied to the idea of using couch's attachments, but
it has a certain simplicity I am in favor of.

I did just realize that this is probably more applicable to the dev
list than here, though.
-
Travis Jensen

On Apr 12, 2011, at 2:03 PM, Ryan Ramage <ryan.ramage@gmail.com> wrote:

> I think Benoit is talking about a middle layer. Like node.js or an app se=
rver.
>
> If you are doing a thin couchapp style, then yes it's harder. You
> could use a javascript encryption lib on the client.
>
> Although, I could see value of having it handled as a "couch plugin"
> to the attachment system.
>
>
> On Tue, Apr 12, 2011 at 1:51 PM, Travis Jensen <travis.jensen@gmail.com> =
wrote:
>> On Apr 12, 2011, at 11:41 AM, Benoit Chesneau <bchesneau@gmail.com> wrot=
e:
>>
>>> On Tue, Apr 12, 2011 at 7:33 PM, Travis Jensen <travis.jensen@gmail.com=
> wrote:
>>>> If I wanted to encrypt all attachments, where would I go about hooking
>>>> in to couch? I'm guessing I would have to replace the current
>>>> attachment handler, right?
>>>>
>>>> I haven't started digging on this; I thought it might be useful to get
>>>> some feedback first.
>>>>
>>>> Thanks
>>>>
>>>> Tj
>>>>
>>>> -
>>>> Travis Jensen
>>>>
>>>
>>> for better security I would encode them at the client level so the
>>> server isn't aware of the decryption key or anything.
>>>
>>> - beno=EEt
>>
>> While I totally agree with you, it isn't really practical for
>> web-based applications.
>>
>> Tj
>>
>> -
>> Travis Jensen
>>