On 12/11/2007 13:18 PM, "Ed Pastore" <email@hidden> wrote:
>>> I understand why it uses an encrypted image. What I don't get is why
>>> it cannot read or write from/to that image when I am logged in. I can
>>> access that image from the Finder... I would think TM could acquire
>>> my privileges and access it as well.
>>
>> Without re-encrypting that data, the only thing "protecting" it are
>> filesystem privileges, and those are trivial to bypass.
>
> But it can encrypt as it writes. That's what happens when I write
> anything in my FileVaulted account, right? It is on-the-fly
> encryption and decryption. If it can do that for everything I do as a
> logged-in user when writing to my hard drive, why can't it do it for
> TM writing to an image?
Actually, I don't think FV does on the fly encryption of every write you do,
but I could be wrong there. That kind of encryption has a non-zero amount of
overhead, and because you're talking about a lot of encryption/decryption
throughout the day (even if you never recover something), that's a
significant resouce hit.
That also creates some issues with regard to security, because TM has to be
able to verify your password against something. If you're restoring to a new
home directory on the same machine, then it's easier. But, what about if you
have to restore to a new drive? Where does TM store a master password when
you're restoring to a different machine? If you're on an Open Directory or
Active Directory network, that potentially is easier, but now you have to
kerberize TM.
If you aren't, then how does Time Machine on a Boot DVD access the password
when you want to do a machine restore? There are possible solutions, but
each of those carries its own set of attendant problems. Again, TM is not
designed to be the perfect backup solution. It has a specific sweet spot,
and if your needs are consistently outside of that, then you really need to
use a different method.
--
John C. Welch Writer/Analyst
Bynkii.com Mac and other opinions
email@hidden
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Macos-x-server mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
http://lists.apple.com/mailman/options/macos-x-server/email@hidden
This email sent to email@hidden
