Geek Answers Handbook

Linux Secrets

Sorry if this was asked and answered here, a simple search did not give me much. Feel free to correct the tags and provide links to questions such as the following or discussion of a topic. In addition, I know a little Windows, Linux is not much, so the questions may seem trivial.

Some Windows applications use the registry and some other obscure places to store their activation data there, days of the trial period, only the fact that the software is installed on this OS.

Are there any similar places in Linux?

If so, how is the data detected, if you have not only root access rights, but also almost all of the source code, and you can always configure the kernel and force things to force?

If there is no way to protect such data on Linux, all other things being equal, how much does this affect the availability of commercial software for Linux?

+4
source share
4 answers

What you are saying is security from the unknown - and no, the registry on Windows is not a much more obscure place to store data than any deeply hidden file on Linux.

However, programs on Linux usually store their data in files, starting with a dot . (meaning the hidden nature of these files) in the user's home directory. The places are usually not very obscure, for example, Qt has the QSettings class, which uses the registry in Windows, but in Linux, the data is stored in .config/CorporationName/ProgramName.conf . Thus, many other programs also store data. Being paranoid of your data, you, of course, can use any encryption scheme that you like - much more incomprehensible than the Windows registry.

Windows-style registry inaccessibility hindering commercial software availability? Even if a small factor (but I do not believe in it), there are more serious problems (/ features) with the platform, which makes writing commercial and proprietary software more intrusive. (but not impossible)

+6
source

No matter which OS you use, you should not depend on security by obfuscation. This is the easiest thing to crack. Wherever you store your data, you should encrypt it and only decrypt it at runtime as short as possible. Even better , if you use user accounts that are stored on the server that you manage, store data there and perform your checks during authentication / authorization.

+2
source

The only theoretically safe solution is IMO for receiving a network connection and storing data in the form of an encrypted string and only ever decrypts it on a central server that is completely under your control. This is also true for Windows.

+1
source

There are several options for storing sensitive data:

  • simple encrypted files (can be done using gpg)

  • encrypted container (e.g. using truecrypt, dm-crypt)

  • encrypted partitions or disks (dm-crypt)

Remember that you must also use an encrypted swap.

0
source

More articles:


All Articles