4 ms·
Yeah, the only problem is you can never "un-give" a key, which means you either have to rebuild your cluster under a different key (having to re-give key to eve
by ohnoesjmr 10y ago
Yeah, the only problem is you can never "un-give" a key, which means you either have to rebuild your cluster under a different key (having to re-give key to everyone else apart from that one guy you want to kick out), or deal with the person having access to the data forever.
- danieldk 10y agoIndeed, with the standard folders you cannot do this. With the identity-based sharing, you can remove someone from a folder. The identity-based sharing model has some downsides (no support for encrypted read-only peers), but does support user management.
- brigandish 10y agoIf the data is encrypted using a session key and then the session key encrypted with a master key and stored with the data (concat them together) then it can. You can't revoke access to the data they've already got, of course, but as changes/additions are made they lose the ability to decrypt the new data because you've used a new session and master key. Arq uses this method when encrypting blobs.