Frog looking nervous

Frogger

not frog

maybe there's a frog hiding in there

you've got no frogs

it might be a frig or a freg

A European frug or an African frug

Good thing it's sunny

exploded frogs do not count

they don't do very much, in fact

due to dead

@HannahVernon yikes. What is your primary heating source in that kind of climate?

@PaulWhite they can still be baseballs

OK people, here's a challenge for you all. How is file-system level encryption (like BitLocker) less secure than TDE in SQL Server? I can't see any way you can get around BitLocker that you can't get around TDE.

Relevance: this comment chain

@HannahVernon It's mainly sunny

@Charlieface They both have some similar and some dissimilar attack vectors

@SeanGallardy Go ahead. Give me a scenario where you can circumvent BitLocker but not TDE.

I wouldn't say it's any more or any less secure without a specific example, but both are not secure if as stated in the comments someone has the admin password

@Charlieface Non-admin login that doesn't have access to SQL Server as a login and can't gain access to SQL Server but can open files.

@SeanGallardy So you gave such user permission to shut down SQL service (otherwise files would be locked) and gave them permission over the Data folder? More fool you. This is a non-default setup.

you wouldn't need that

@SeanGallardy Also if you can get your hands on master then TDE is also broken.

correct

@SeanGallardy Need what?

you wouldn't need to shutdown sql

How so?

whether or not the account had access to the root folder which would then give them access to other folders is possible

bypass traversing permission

anyway my point is neither is more or less secure

when it comes to someone with admin

🙂

@SeanGallardy Which was exactly what I said in those comments: admin access is game-over.

right, that's why I think the exercise is moot

@SeanGallardy True, still a weird setup, but that doesn't help you for open files. You can't read those unless you close the handles, which you can't do unless you're admin or can shut down the service.

@JoshDarnell I'm talking about a standard installation of SQL Server, with the data files stored in a location set up correctly, with the correct permissions. Obviously if you break recommended guidelines you're going to burn: if you set up a sysadmin and publish the password on Facebook you'd also be broken.

@Charlieface I'm sure there are crafty people that can do it with a non-admin account

but I really don't want to play revolving 20 questions with different specific items that crop up after each answer

I feel sorry for the poor guy that added a brief answer and is now getting inbox notifications every time CF or pmdba reply about their side argument

@PaulWhite should I join in the fun?

@PaulWhite new laptop arrived!

@J.D. My challenge is still open to anyone who doesn't get grumpy with me.

@Charlieface lol I probably have nothing useful to add, other than redundancy with security can only help not hurt, most times. But there's even times when redundancy with security can make things less secure, so 🤷‍♂️

@Charlieface not a frog; don't care