13 replies to this topic

[skywol]

hello I wanted to ask why tuttii decoder with arm processors which have made backups you create a file where you can just walk in the images, so needless to put password

 

example, I create a backup on only 4k vu and give it to a friend but do not password

 

my friend just doing a backup and go quietly in the pictures, why you create these free rootfs.tar.bz2?

[Pedro_Newbie]

Why not?

[skywol]

because even if you put ssh password dreamboxmio after making the backup file opens sil rootfs.tar.bz2 tranquillamnete without a password and a person can go and quietly even put plugin you want or look at my config not know if I get the idea

[Pr2]

The goal of the backup is to be able to flash it back from a USB stick.

 

It you password protect the rootf.tar.bz2 you will never be able to flash it back on your STB since the bootloader has no way to ask you for the password.

[Erik Slagter]

If you want encryption, it should never be done by the application (in this case backup), it should be done by a dedicated encryption application. Use whatever you like, zip with a password, pgp, gpg, openssl...

[skywol]

if I put zip with a password then the backup will not boot from charging what's the excuse?

[athoik]

What prevents users to open other backups (non tar.gz) and find what's inside? Nothing...

It requires few more steps. All backups, once somebody has access, then game over!

If you really care about you data, place your backups on a safe place, or wrap them on a password protected zip etc etc.

PS. Security =! Ease of use

Edited by athoik, 24 March 2017 - 06:49.

[Pedro_Newbie]

Maybe he wants to distribute some backups with c-lines and wants to protect the specifics, otherwise I can't think of the problems he thinks he''s having

[WanWizard]

Hehehe... Sounds very plausible.

[skywol]

@pedro-newbie good you understand what I want to do, give up with my c line inside you can close those tar.gz files?

[betacentauri]

Man if you really need it, which I still don't understand zip the backup files by your own and add a password to the zip. Or put the backup on a USB stick and remove it from your box after creating the backup.
As said before for normal users a password protection doesn't make sense.

[Pedro_Newbie]

He's selling C-lines and wants to protect his business, the cheater doesn't like to be cheated  

[betacentauri]

Ah, now I understand. User should be possible to create a backup with an for the user unknown password. But unfortunately then the backup is useless for the user.

[MiLo]

In that case, the proper way to "sell C lines" would be to adjust oscam to support a signed+encrypted network config using a challenge algorithm and place the configuration on a smart card, since you'll need some trusted hardware to store the keys for the challenge.
No need to violate licenses and it's pretty airtight.

You can buy programmable smartcards for a few euros a piece, and the boxes are already equipped with cardreaders, which you can also use to program the cards, so the hardware cost it pretty low.