Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.php > #11583 > unrolled thread

Unzip password-protected ZIP file in RAM?

Back to article view | Back to comp.lang.php

Contents

  Unzip password-protected ZIP file in RAM? Gilles <nospam@nospam.com> - 2013-10-25 14:51 +0200
    Re: Unzip password-protected ZIP file in RAM? "J.O. Aho" <user@example.net> - 2013-10-25 18:37 +0200
      Re: Unzip password-protected ZIP file in RAM? Gilles <nospam@nospam.com> - 2013-10-25 21:22 +0200
    Re: Unzip password-protected ZIP file in RAM? Robert Heller <heller@deepsoft.com> - 2013-10-25 12:18 -0500
      Re: Unzip password-protected ZIP file in RAM? The Natural Philosopher <tnp@invalid.invalid> - 2013-10-25 20:30 +0100
        Re: Unzip password-protected ZIP file in RAM? Gilles <nospam@nospam.com> - 2013-10-25 21:53 +0200
          Re: Unzip password-protected ZIP file in RAM? Arno Welzel <usenet@arnowelzel.de> - 2013-10-29 20:01 +0100

#11583 — Unzip password-protected ZIP file in RAM?

Hello

This is a newbie question.

While travelling, I keep an .htaccess-protected text files with
e-mails/passwords, credit card numbers, etc.

To make it more secure, I was thinking of compressing the file as a
password-protected ZIP file, and access it through a PHP script that
would unzip it in RAM and display the contents, so that a clear text
version is no longer necessary.

What do you think? Can PHP do this?

It's 5.3.13 running on a hosted *nix server.

Thank you.

[toc] | [next] | [standalone]

#11585

On 25/10/13 14:51, Gilles wrote:
> Hello
>
> This is a newbie question.
>
> While travelling, I keep an .htaccess-protected text files with
> e-mails/passwords, credit card numbers, etc.
>
> To make it more secure, I was thinking of compressing the file as a
> password-protected ZIP file, and access it through a PHP script that
> would unzip it in RAM and display the contents, so that a clear text
> version is no longer necessary.
>
> What do you think? Can PHP do this?

zip files not that safe.

> It's 5.3.13 running on a hosted *nix server.

A shared sercer not that safe to store things on.



Would recommend you to think of using TrueCrypt, works on all major 
operating systems and majority of cellphones. This would be outside the 
scope of this user group.



-- 

  //Aho

[toc] | [prev] | [next] | [standalone]

#11587

On Fri, 25 Oct 2013 18:37:36 +0200, "J.O. Aho" <user@example.net>
wrote:
>Would recommend you to think of using TrueCrypt, works on all major 
>operating systems and majority of cellphones. This would be outside the 
>scope of this user group.

Thanks for the tip. So I'll just install Linux on an appliance and
keep it switched on while I travel.

[toc] | [prev] | [next] | [standalone]

#11586

At Fri, 25 Oct 2013 14:51:38 +0200 Gilles <nospam@nospam.com> wrote:

> 
> Hello
> 
> This is a newbie question.
> 
> While travelling, I keep an .htaccess-protected text files with
> e-mails/passwords, credit card numbers, etc.

You really don't want to do this!

> 
> To make it more secure, I was thinking of compressing the file as a
> password-protected ZIP file, and access it through a PHP script that
> would unzip it in RAM and display the contents, so that a clear text
> version is no longer necessary.

This probably not really much better.

> 
> What do you think? Can PHP do this?
> 
> It's 5.3.13 running on a hosted *nix server.
> 
> Thank you.
>                                                                                     

-- 
Robert Heller             -- 978-544-6933 / heller@deepsoft.com
Deepwoods Software        -- http://www.deepsoft.com/
()  ascii ribbon campaign -- against html e-mail
/\  www.asciiribbon.org   -- against proprietary attachments


                                                                                                                     

[toc] | [prev] | [next] | [standalone]

#11588

On 25/10/13 18:18, Robert Heller wrote:
> At Fri, 25 Oct 2013 14:51:38 +0200 Gilles <nospam@nospam.com> wrote:
>
>>
>> Hello
>>
>> This is a newbie question.
>>
>> While travelling, I keep an .htaccess-protected text files with
>> e-mails/passwords, credit card numbers, etc.
>
> You really don't want to do this!

Indeed. te way I did this on a laptop which  given where we were 
operating was very vulnerable to theft, as to used a USB pen drive, 
which was only inserted in the laptop when it was fully attended.

The data in the drive (it as a mySQL database) was encrypted using an 
mysql encryption function -AES_ENCYPT('data','key') - and the key was in 
the actual PHP code on the laptop hard drive.


that meant that the data was secure if the pen drive was lost, and the 
computer didn't have the data on it anyway, although it had the means to 
decrypt it.

what it did mean that the loss of other the pen drive or the laptop was 
no big deal. the sort of thieves would be likely to be uninterested in 
the data anyway, and it wouldn't look like 'windows' anyway so they 
would probably wipe it.

The pen drive was formatted EXT2 IIRC so didn't read in a windows 
machine anyway.

So it would take a criminal linux hacker to discover the data, which 
wasn't named in an obvious way, and the laptop as well, or a knowledge 
of what algo was in use, and a lot of patience to get the data back.

So that's what I would do: format a USB stick pen drive with a Linux 
format (assuming you are using linux) and set up an instance of apache 
on the lappie to serve internally via php the contents of an encrypted 
DB on the USB stick pen drive.

Always remove the pen drive after use.



>
>>
>> To make it more secure, I was thinking of compressing the file as a
>> password-protected ZIP file, and access it through a PHP script that
>> would unzip it in RAM and display the contents, so that a clear text
>> version is no longer necessary.
>
> This probably not really much better.
>
>>
>> What do you think? Can PHP do this?
>>
>> It's 5.3.13 running on a hosted *nix server.
>>
>> Thank you.
>>
>


-- 
Ineptocracy

(in-ep-toc’-ra-cy) – a system of government where the least capable to 
lead are elected by the least capable of producing, and where the 
members of society least likely to sustain themselves or succeed, are 
rewarded with goods and services paid for by the confiscated wealth of a 
diminishing number of producers.

[toc] | [prev] | [next] | [standalone]

#11589

On Fri, 25 Oct 2013 20:30:27 +0100, The Natural Philosopher
<tnp@invalid.invalid> wrote:
>So that's what I would do: format a USB stick pen drive with a Linux 
>format (assuming you are using linux) and set up an instance of apache 
>on the lappie to serve internally via php the contents of an encrypted 
>DB on the USB stick pen drive.

Thanks for the tip. USB sockets are usually off-limit in web cafés,
which is where I'd go if I lost my smartphone, but I'll check it out.

[toc] | [prev] | [next] | [standalone]

#11629

Gilles, 2013-10-25 21:53:

> On Fri, 25 Oct 2013 20:30:27 +0100, The Natural Philosopher
> <tnp@invalid.invalid> wrote:
>> So that's what I would do: format a USB stick pen drive with a Linux 
>> format (assuming you are using linux) and set up an instance of apache 
>> on the lappie to serve internally via php the contents of an encrypted 
>> DB on the USB stick pen drive.
> 
> Thanks for the tip. USB sockets are usually off-limit in web cafés,
> which is where I'd go if I lost my smartphone, but I'll check it out.

Maybe you want to have a look at the MCrypt functions:

<http://www.php.net/manual/en/book.mcrypt.php>



-- 
Arno Welzel
http://arnowelzel.de
http://de-rec-fahrrad.de

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.php

csiph-web