Would be a nice feature, to provide an encrypt checkbox for CCK fields, and that would be it to encrypt them :)

Kind of like the Unique field module where you can select which fields should be unique.

Comments

lee20’s picture

lee20 CreditAttribution: lee20 commented
Title: Option for CCK fields to store as encrypted » Integratation with CCK
Version: 6.x-1.4 » 7.x-1.x-dev
Status: Active » Postponed

I like this idea! Although, it may involve some heavy lifting override the output of CCK field values.

If a CCK field is encrypted, then it is likely that you wouldn't want to just decrypt it and display it on the screen in plaintext.

I think for starters we could integrate it with the CCK Password Field module. I don't know that integrating it with a generic CCK text field would be feasible as it's implementation with the various CCK widgets would not make sense.

Perhaps an AES CCK Field sub-module can be packaged into AES on top of integrating with the CCK Password Field module. The specialized AES field could provide a field that supports a plaintext entry widget and a password entry field.

I need to figure out if and how I am going to support the AES branch for D7 before I can begin adding features. For now I am marking this as postponed, but I will certainly be looking to add this functionality.

that0n3guy’s picture

that0n3guy CreditAttribution: that0n3guy commented

sub...

that0n3guy’s picture

that0n3guy CreditAttribution: that0n3guy commented

Just some ideas, but it would be nice to display the data masked (like with *****) but with the ability to quickly and easily unmask it. Like by clicking on the a button (example: http://drupal.org/project/password_toggle) or even by clicking on the ****** where the text should be, like in views, and see the encrypted text (see how http://www.passpack.com/en/home/ does this for passwords)

I found this which might be useful: https://github.com/damian/jQuery-passwordMask

giorgio79’s picture

giorgio79 CreditAttribution: giorgio79 commented
Title: Integratation with CCK » Integration with CCK

"If a CCK field is encrypted, then it is likely that you wouldn't want to just decrypt it and display it on the screen in plaintext."
I imagine a scenario, where users are reassured that their data is stored as encrypted in the db, and even the admins cannot see it, only the enduser :)

lee20’s picture

lee20 CreditAttribution: lee20 commented

@that0n3guy

Thanks for your ideas. In version 2 of AES, there will be some AHAH based form helpers for unmasking encrypted data, these can be used in custom forms. Can you elaborate on where you would like the passwords to be optionally visible?

@giorgio79

I like the idea that admins should not be able to see user passwords. There is no way to absolutely prevent user passwords from being decrypted by someone who controls the system. However, I think we can adjust the AES permissions so that there are permissions for "view own passwords" and "view all passwords".

that0n3guy’s picture

that0n3guy CreditAttribution: that0n3guy commented

I wasn't really talking just about passwords, but about any data we want encrypted. Passwords were just and example.

Being able to store sensitive data, like passwords, is a need I have coming up very soon. I have many accounts on many sites that I share with several employee's. It would be nice if I could organize this data in drupal so I can integrate it with my drupal based [insert here- like CRM, or project management software or etc...].

AHAH based form helpers for unmasking encrypted data would be great if these worked with views as well.

giorgio79’s picture

giorgio79 CreditAttribution: giorgio79 commented

"I wasn't really talking just about passwords, but about any data we want encrypted. Passwords were just and example."

Yes me too. This module can take a bigger picture than passwords. For example, why not store emails in the db encrypted as well? It is ok, if on display they are shown without encryption. The whole point is in my opinion is to store it encrypted in the database!

This would protect one from hackers, that get a hold of the db, and spam the entire user base, like it happened recently with email providers
http://www.chicagotribune.com/business/sc-biz-0405-email-hacking-2011040...

Taking this further, we could integrate it with any cck text field. Don't just think that it does not serve any purpose, because it is shown on the screen without encryption. The main purpose in this case would be to store it encrypted in the DB!

Given it is as easy as the following
$encrypted_data = aes_encrypt("mydata");
$decrypted_to_plain_text = aes_decrypt($encrypted_data);

I dont think it would be a big deal to integrate it with CCK, we just need to hook in before data is saved in the db...

giorgio79’s picture

giorgio79 CreditAttribution: giorgio79 commented

Also raised it over at CCK, perhaps they can give some pointers
#1116446: Integrate CCK with AES Encryption module

and for Drupal Core :)
#1116460: Optionally encrypt email fields and other fields selected by user

Perhaps some tips will be given at stackoverflow :)
http://stackoverflow.com/questions/5548022/drupal-how-to-integrate-aes-e...

giorgio79’s picture

giorgio79 CreditAttribution: giorgio79 commented

Hmm, just found this http://drupal.org/project/encrypted_text
It seems there was a module for this in D4 :D

giorgio79’s picture

giorgio79 CreditAttribution: giorgio79 commented

Also found another module for D7 http://drupal.org/project/encset, it seems like this is a field integration, quite nice.

giorgio79’s picture

giorgio79 CreditAttribution: giorgio79 commented

It seems the author of the Encrypted Field module is open for integration with AES module

#1136440: Integration with "AES" or "Encryption" module

giorgio79’s picture

giorgio79 CreditAttribution: giorgio79 commented

I have an even better idea :D

Expose encryption, decryption actions for Rules, so we can encrypt pretty much any text field :)

techypaul’s picture

techypaul CreditAttribution: techypaul commented

+1.

My personal view, simply hook into cck at the very last point before input to the database and at the very first point on taking data out. For me, this should be about the database and NOT the viewing, although this could be optional but I think should come later with nice ajaxy stuff going on.

Perhaps someone better than me can put a patch for cck (v6) based around this module, as a non php programmer, I assume there the main cck module takes care of the actual database in/outs and not the widgets or am I wrong?

Thanks,
Paul.

giorgio79’s picture

giorgio79 CreditAttribution: giorgio79 commented

Here is an encrypt field integrated with encryption api, looking for testers
#1129888: Integration with CCK

thedut’s picture

thedut CreditAttribution: thedut commented

To gorgio79

Yes me too. This module can take a bigger picture than passwords. For example, why not store emails in the db encrypted as well? It is ok, if on display they are shown without encryption. The whole point is in my opinion is to store it encrypted in the database!

I did it !
I have called it DataBase Email Encryption, this sandbox project has been reviewed by the community and is on the verge to become a full project !
more information on http://drupal.org/sandbox/thedut/1209196

thedut’s picture

thedut CreditAttribution: thedut commented

And it is a full project now : DataBase Email Encryption
http://drupal.org/project/dbee !

thedut’s picture

thedut CreditAttribution: thedut commented

And it is available on Drupal6 and Drupal 7 !
http://drupal.org/project/dbee