Data Protection on Linux & OSX stores keys unencrypted in the user profile directory

[blowdart]

Please direct discussion to aspnet/DataProtection#108

The Data Protection stack creates a key ring and rotates keys on a regular basis. Under OSX and Linux keys are stored unencrypted under the user profile path, in ~/.aspnet/DataProtection-Keys.

You should ensure permissions on this directory are limited to the user account your application runs as. You can review permissions with ls -l path and adjust permissions using chmod. chmod 700 will limit read, write and execute permissions to the directory owner.

We are still examining options for better protection on these platforms.