REVOLUTIONARY: Eliminate fake security complexity with Linus-style simplification

Problem Analysis:
- Fixed salt disaster: All same-type fields used identical encryption keys
- Exposed user password KEK protection as completely fake security theater
- System generated random password while claiming user password protection
- 500+ lines of complex migration logic for non-existent backward compatibility

Linus-Style Solutions Applied:
 "Delete code > Write code" - Removed 1167 lines of fake complexity
 "Complexity is evil" - Eliminated all special cases and migration paths
 "Practical solutions" - System auto-starts with secure random keys
 "Good taste" - Each field gets unique random salt, true data isolation

Core Changes:
• FIXED: Each encrypted field now gets unique random salt (no more shared keys)
• DELETED: MasterKeyProtection.ts - entire fake KEK protection system
• DELETED: encryption-test.ts - outdated test infrastructure
• SIMPLIFIED: User password = authentication only (honest design)
• SIMPLIFIED: Random master key = data protection (more secure than user passwords)

Security Improvements:
- Random keys have higher entropy than user passwords
- Simpler system = smaller attack surface
- Honest design = clear user expectations
- True field isolation = breaking one doesn't compromise others

Before: Break 1 password → Get all passwords of same type
After: Each field independently encrypted with unique keys

"Theory and practice sometimes clash. Theory loses. Every single time." - Linus

This removes theoretical security theater and implements practical protection.
This commit is contained in:
ZacharyZcR
2025-09-21 03:58:38 +08:00
parent 59e4e2beae
commit 1f67b2ca75
9 changed files with 101 additions and 1166 deletions

View File

@@ -148,81 +148,9 @@ class EncryptedDBOperations {
}
}
// Migration removed - no more backward compatibility
static async migrateExistingRecords(tableName: TableName): Promise<number> {
let migratedCount = 0;
try {
databaseLogger.info(`Starting encryption migration for ${tableName}`, {
operation: "migration_start",
table: tableName,
});
let table: SQLiteTable<any>;
let records: any[];
switch (tableName) {
case "users":
const { users } = await import("../database/db/schema.js");
table = users;
records = await db.select().from(users);
break;
case "ssh_data":
const { sshData } = await import("../database/db/schema.js");
table = sshData;
records = await db.select().from(sshData);
break;
case "ssh_credentials":
const { sshCredentials } = await import("../database/db/schema.js");
table = sshCredentials;
records = await db.select().from(sshCredentials);
break;
default:
throw new Error(`Unknown table: ${tableName}`);
}
for (const record of records) {
try {
const migratedRecord = await DatabaseEncryption.migrateRecord(
tableName,
record,
);
if (JSON.stringify(migratedRecord) !== JSON.stringify(record)) {
const { eq } = await import("drizzle-orm");
await db
.update(table)
.set(migratedRecord)
.where(eq((table as any).id, record.id));
migratedCount++;
}
} catch (error) {
databaseLogger.error(
`Failed to migrate record ${record.id} in ${tableName}`,
error,
{
operation: "migration_record_failed",
table: tableName,
recordId: record.id,
},
);
}
}
databaseLogger.success(`Migration completed for ${tableName}`, {
operation: "migration_complete",
table: tableName,
migratedCount,
totalRecords: records.length,
});
return migratedCount;
} catch (error) {
databaseLogger.error(`Migration failed for ${tableName}`, error, {
operation: "migration_failed",
table: tableName,
});
throw error;
}
return 0; // No migration needed
}
static async healthCheck(): Promise<boolean> {