# Secure data storage

**URL:** <https://www.ruby-forum.com/t/secure-data-storage/93464>\
**Category:** Ruby\
**Created:** [April 3, 2006, 7:14pm UTC](https://www.ruby-forum.com/t/secure-data-storage/93464 "2006-04-03T19:14:09Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![stian](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/3be4f8/32.png) [@stian](https://www.ruby-forum.com/u/stian)\
**Post date:** [April 3, 2006, 7:14pm UTC](https://www.ruby-forum.com/t/secure-data-storage/93464/1 "2006-04-03T19:14:09Z")

</div>

Greetings,

I am currently planning to write a diary type application using Ruby and  
FXruby, and I am therefor looking for a secure way of storing data.  
Using plain text files is of course out of the question, but I was  
thinking of using SQLite, could that be secure enough? The idea is that  
I don’t want people to be able to simply view a users diary entries by  
opening a file (preferrably, the data should be secured with a password  
(and username) defined by the owner).

I am fairly experienced with databases and programming, but rather new  
to Ruby and having to think about the fact that other people might be  
using my program and therefor unknown people might have direct access to  
the computer.

Thanks for any answers, tips and suggestions 🙂

Best regards,  
Stian H.

---

<div class="post-metadata">

**Author:** ![stian](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/3be4f8/32.png) [@stian](https://www.ruby-forum.com/u/stian)\
**Post date:** [April 3, 2006, 8:07pm UTC](https://www.ruby-forum.com/t/secure-data-storage/93464/2 "2006-04-03T20:07:52Z")

</div>

I would consider simply building an ‘encrypt’ method that you call  
before saving, and a ‘descrypt’ to be called while loading.

You can then call these no matter what storage medium you decide to use.

---

<div class="post-metadata">

**Author:** ![stian](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/3be4f8/32.png) [@stian](https://www.ruby-forum.com/u/stian)\
**Post date:** [April 3, 2006, 10:10pm UTC](https://www.ruby-forum.com/t/secure-data-storage/93464/3 "2006-04-03T22:10:26Z")

</div>

Stian H. wrote:

> I am currently planning to write a diary type application using Ruby and  
> FXruby, and I am therefor looking for a secure way of storing data.  
> Using plain text files is of course out of the question, but I was  
> thinking of using SQLite, could that be secure enough? The idea is that  
> I don’t want people to be able to simply view a users diary entries by  
> opening a file (preferrably, the data should be secured with a password  
> (and username) defined by the owner).

What platform is your application for? If it’s for a UNIX-ish platform  
(Linux, OSX, etc.,) simple file access control may suffice. If you’re  
dead serious about it, you can use heavyweight encryption.

Cheers,  
Daniel S.

---

<div class="post-metadata">

**Author:** ![stian](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/3be4f8/32.png) [@stian](https://www.ruby-forum.com/u/stian)\
**Post date:** [April 3, 2006, 10:18pm UTC](https://www.ruby-forum.com/t/secure-data-storage/93464/4 "2006-04-03T22:18:02Z")

</div>

Daniel S. wrote:

> Stian H. wrote:
> 
> What platform is your application for? If it’s for a UNIX-ish platform  
> (Linux, OSX, etc.,) simple file access control may suffice. If you’re  
> dead serious about it, you can use heavyweight encryption.
> 
> Cheers,  
> Daniel S.

I think it will probably be used mostly on Win XP computers, however  
beeing a user from both worlds, I probably myself will at least use it  
on a unix-ish platform. I do believe it can be possible to store the  
data in the profile directory in WinXP, however I am unsure of how  
secure this is.

---

<div class="post-metadata">

**Author:** ![stian](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/3be4f8/32.png) [@stian](https://www.ruby-forum.com/u/stian)\
**Post date:** [April 4, 2006, 12:11pm UTC](https://www.ruby-forum.com/t/secure-data-storage/93464/5 "2006-04-04T12:11:33Z")

</div>

- Stian H. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) [060403 22:18]:

> I think it will probably be used mostly on Win XP computers, however  
> beeing a user from both worlds, I probably myself will at least use it  
> on a unix-ish platform. I do believe it can be possible to store the  
> data in the profile directory in WinXP, however I am unsure of how  
> secure this is.

If each user has its own database file this should be okay (every user  
has to be/should be interested in the privacy of his data anyway).

Of course this will not work in case several users access the same  
database file. 😉

Cheers,

Steph.

---

<div class="post-metadata">

**Author:** ![stian](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/3be4f8/32.png) [@stian](https://www.ruby-forum.com/u/stian)\
**Post date:** [April 4, 2006, 1:51am UTC](https://www.ruby-forum.com/t/secure-data-storage/93464/6 "2006-04-04T01:51:54Z")

</div>

You could encrypt it under a password.

ezcrypto seems to do what it says on the tin. You need openssl  
installed, but once it is, encrypting the content is simple:

str = “Your private stuffs here”  
k = EzCrypto::Key.with\_password( “mypassword”, “somesalt” )  
ciphertxt = k.encrypt( str )

It uses 128 bit CBC AES by default, which should be adequate.

cheers  
J