Tagged Questions

Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

learn more… | top users | synonyms

1
vote
1answer
572 views

Browser cache, cookies, active logins and other data

This question is regarding common browsers, even though I may refer to Firefox settings. Not IE though, I wouldn't expect that to be in any way secure. I'm seeking to know how secure it is to let the ...
4
votes
2answers
2k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
3
votes
1answer
152 views

Updating stored, encrypted containers on a server

My scenario is this -- I want to store an encrypted container on a network server. This encrypted container should be accessible to others to download and decrypt/mount locally provided they have the ...
2
votes
1answer
126 views

Xbox 360 Security - Why must you be the data owner to move content?

Xbox 360 does not allow you to move content (such as to a usb), unless you are the owner of the content (Same gamertag as save file). This seems pointless considering, I can simply sign into any ...
0
votes
2answers
327 views

encrypted cloud storage with partial local copy

Is there a cloud storage solution with the following features: partially copied locally. Not fully like dropbox so it can be larger than the local disk. Not fully in the cloud but just a local disk ...
3
votes
3answers
112 views

Are mail-servers removed from security concerns in contrast with cloud storage?

I have meet people and even businesses that are against using the cloud for data storage invoking security risks. In the same time they seem perfectly fine using email services (usually from obscure ...
18
votes
3answers
1k views

ZX Spectrum tape loader: how was copy prevention implemented?

I am curious how copy prevention was implemented for games or other programs loaded from cassette on the micro computers of the early 1980s, such as the ZX Spectrum 48k. If I recall correctly, some ...
2
votes
3answers
268 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
0
votes
1answer
523 views

How to Protect the Password Stored in a Configuration File? [duplicate]

Possible Duplicate: Standards for encrypting passwords in configuration files? I am not sure if this question has been asked before here, I wasn't able to find it. So, please feel free to ...
2
votes
1answer
186 views

How to safely “remember” login information in a program [duplicate]

Possible Duplicate: How to Securely Implement a “Remember Me” Feature? I have a program that communicates with a server. The user must log in with the application which runs on their ...
8
votes
2answers
2k views

How should an application store its credentials

When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
10
votes
3answers
4k views

How secure is Intel SSD Encryption?

Are there any known flaws in the full disk encryption on Intel 520 series SSD drives? Specifically, it seems these drives generate an internal AES key automatically, even when no password is set. But ...
2
votes
2answers
4k views

How to set up a user-friendly NAS encryption?

We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
8
votes
4answers
3k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
3
votes
6answers
276 views

Is it okay to wrap a cryptographic hash with MD5 for storage?

Is there any security issues if you wrap your cryptographic hash with MD5 for storage purposes? For example: $hash = md5(hash($password,$salt,$rounds)); Note: hash() uses scrypt or bcrypt or pbkdf2 ...
3
votes
5answers
394 views

PCI-DSS and salt storage

PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...
9
votes
1answer
3k views

When using AES and CBC, is it necessary to keep the IV secret?

If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key? ...
2
votes
1answer
197 views

Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?

NIST has released Special Publication 800-132: Recommendation for Password-Based Key Derivation which is meant for protection of stored data using encryption keys derived from user password. This ...
6
votes
6answers
848 views

Implications of securing data in RAM

Someone told me that his company is storing all application data (at least the sensitive data I guess) in RAM for security. Their application runs for long periods of time, so data stays in memory for ...
2
votes
3answers
6k views

Database field type for password storage?

In the past I used varchar(255) for storing hashed passwords (no salt). Is this still enough? Or are longer fields required?
6
votes
6answers
15k views

It is safe to store photos and documents on skydrive / google cloud services?

I have over 20GB of photos and documents stored on my hard disk without a backup. I'm thinking about saving all of them in a cloud service such as Microsoft Skydrive or google cloud, but I'm wondering ...
4
votes
4answers
398 views

Security of Cloud Storage

What are the main security risks of popular cloud storage services such as Dropbox? I am torn between the convenience of cloud storage and the potential security risk of it. How can I evaluate whether ...
5
votes
1answer
830 views

Do TrueCrypt volumes look like random data?

Let say I use Eraser (or other tools) to erase my hard drive (using DoD standards which is 7 times or Gutmann which is 35 times), These eraser tools just write random data on the hard drive many ...
30
votes
4answers
15k views

Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?

Lots of different programs, such as Darik's Boot and Nuke, let you write over a hard drive multiple times under the guise of it being more secure than just doing it once. Why?
36
votes
8answers
8k views

How can I reliably erase all information on a hard drive?

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also. Methods for flash drives ...