Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

learn more… | top users | synonyms

3
votes
2answers
107 views

Is there a way to guarantee removal of data after closing Facebook / Gmail / Dropbox account? [closed]

Of course my default way of thinking is: deleted: true while keeping all the data in place. In fact I would be interested in knowing what standard operating procedures are in place for retention of ...
3
votes
3answers
239 views

How is truncation according to PCI DSS secure?

In section 3.3 of the PCI standard, it says that when displaying PANs, limiting visibility to the first 6 and last 4 digits of the PAN is considered secure. Doing some quick math, on a 16 digit PAN, ...
3
votes
1answer
148 views

Optimise user data fetch using S3

I'm writing a mobile app that communicates with my server using REST. Upon every launch, the app makes a call to the server api to check whether there was a change in the user details (using a ...
3
votes
2answers
1k views

Shutdown: Clear virtual memory pagefile

I was reading about Windows Local Policy of "Shutdown: Clear virtual memory pagefile". I need some clarification on this brief policy description: What do it mean by operating system that allow ...
3
votes
3answers
120 views

Good way of storing lots of third-party passwords

I've consulted this question, but I'd like to hear some more input. I'm building a scraping app that is going to act as an aggregator of sorts for a large number of businesses which use a few popular ...
3
votes
1answer
65 views

Is it safer to store valuable information on a unsecure client or send the data through the internet?

Background: I'm creating a secure web app with the purpose to act as a no-knowledge storage for small data (we're talking a few bytes). Since all the encryption and decryption happens client-side, ...
3
votes
1answer
234 views

Remote System Administration of an Encryption-Switch-Encrypted Infrastructure

I can't seem to find a decent explanation anywhere of the practicalities of remote system administration (e.g. SSH) of an encryption-switch-encrypted SAN-stored infrastructure. The environment will ...
3
votes
1answer
190 views

Updating stored, encrypted containers on a server

My scenario is this -- I want to store an encrypted container on a network server. This encrypted container should be accessible to others to download and decrypt/mount locally provided they have the ...
2
votes
1answer
162 views

Xbox 360 Security - Why must you be the data owner to move content?

Xbox 360 does not allow you to move content (such as to a usb), unless you are the owner of the content (Same gamertag as save file). This seems pointless considering, I can simply sign into any ...
2
votes
3answers
345 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
2
votes
2answers
166 views

Password verification scheme (used in eg. MS Office) - more secure than just a hash?

Usual password verification schemes stores a salted password hash and the salt. If the hash is good and computational costly, it is considered secure. However an alternate version (used in Microsoft ...
2
votes
3answers
13k views

Database field type for password storage?

In the past I used varchar(255) for storing hashed passwords (no salt). Is this still enough? Or are longer fields required?
2
votes
1answer
71 views

Can we determine how securely files are stored on a cloud storage service?

After asking two questions about the security of online cloud storage, it seems to me that we can only at best speculate as to the security practices of the hosting company, and believe what they tell ...
2
votes
1answer
875 views

Secure private key storage

In light of BadUSB, storing private keys on a USB flash drive is not the best way. What about writing private keys to a CD? What I am worried about is whenever I plug my private key storage device ...
2
votes
1answer
489 views

Are there any secure ways to store the secret key used in a TOTP scheme?

I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
2
votes
1answer
88 views

How to store client login credentials?

My company has to constantly connect to remote server where there are numerous way to access, often via vpn and remote desktop connections, as well as SQL servers. There are over 50 clients that this ...
2
votes
3answers
471 views

How can my bank issue a new credit card with the same pin number? [duplicate]

I live in France, and I have a debit card issued by my bank. When it expires, I receive a new one with the same pin number. I recently asked my banker to issue another card (a different one, for ...
2
votes
1answer
146 views

Strategy for encryption before cloud storage

Apologies if this has been asked before. I am looking to encrypt documents before storing in the cloud. There will be a separate metadata storage, which could be either internal or cloud hosted. My ...
2
votes
1answer
260 views

HIPAA compliant blob storage architecture

There is a task to design a system to store sensitive data securely (should be HIPAA compliant in the future). It's just a draft - this will not be used in production in a foreseeable future. I have a ...
2
votes
1answer
193 views

Tools for Verifying Secure Deletion [closed]

It is recommended to verify the zeroing-out was done properly when you try to secure delete a HDD. From this post, some drives with firmware bugs prevent secure erase from working properly. What are ...
2
votes
2answers
393 views

Locality Sensitive Hash (LSH) function to approximately match old passwords

Recently, I ran across a website that requires me to change my password after X number of days had passed since I had last created one. Intelligently, the service made sure that the password did not ...
2
votes
1answer
269 views

How to safely “remember” login information in a program [duplicate]

Possible Duplicate: How to Securely Implement a “Remember Me” Feature? I have a program that communicates with a server. The user must log in with the application which runs on their ...
2
votes
2answers
7k views

How to set up a user-friendly NAS encryption?

We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
2
votes
1answer
227 views

Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?

NIST has released Special Publication 800-132: Recommendation for Password-Based Key Derivation which is meant for protection of stored data using encryption keys derived from user password. This ...
2
votes
0answers
26 views

OAuth2 client account & data storage [duplicate]

Context I have a REST API where a user can create an account from a web client. The password is saved as a salted hash in a database. When a user is authenticated they can save and retrieve private ...
2
votes
1answer
78 views

Secure sharing between Windows computers

I'm working on a project to setup a secure system to share files between 5 Windows computers. The computers are part of a domain so could have multiple different users logging in (based on an AD ...
2
votes
0answers
92 views

How to store a file securely on the windows file system?

Problem: I have a windows service running under local system account. I have a blob of data that I want to store securely and persistently between reboots. I have decided to store it as afile( as ...
1
vote
2answers
126 views

How can a seamless cloud storage service be Zero-knowledge?

Cloud based storage services like Dropbox and Google Drive are a cause for concern when it comes to privacy. They store encryption keys for your files on their servers. Therefore, anyone who manage to ...
1
vote
4answers
250 views

What options exist for authenticated full-disk encryption?

Title says it all really. I'm toying with the idea of storing some disk images in "the cloud", but am concerned about the possibility of an attacker manipulating cipertext to do evil things once it's ...
1
vote
2answers
745 views

Is a sensitive NAS behind a router safe?

I have four pcs connected to a switch connected to a router that gets connected directly to the internet. How safe is a NAS attached to the same router along with the switch plug? I'd like to have ...
1
vote
1answer
334 views

What evidence is there that SpiderOak is significantly different from Lavabit?

In 2013 Lavabit shut down because a US agency was demanding access to its private SSL keys and basically the deets on whatever users the US was interested in. Lavabit shut down rather than give the US ...
1
vote
1answer
136 views

How secure is the web-based file browser that comes with my NAS?

I have a Buffalo Linkstation Pro 2 Duo for home use. It has a web GUI for browsing the contents of the NAS (distinct from the admin interface). The idea is that you would expose the web GUI to the ...
1
vote
1answer
1k views

How to Protect the Password Stored in a Configuration File? [duplicate]

Possible Duplicate: Standards for encrypting passwords in configuration files? I am not sure if this question has been asked before here, I wasn't able to find it. So, please feel free to ...
1
vote
2answers
88 views

Keeping user files secure while allowing a web-application to use the files

Short background I am currently in the process of designing a web-application where the user uploads some files to the server and then asks the server to do some calculations based on these files ...
1
vote
1answer
275 views

How can Stolen Laptop tracking softwares survive OS reinstall?

Some softwares such as Computertrace claim that it can survive on a laptop even if the thief successfully reinstalls the operating system, reformats the hard drive, or (in some laptop models) swaps ...
1
vote
1answer
80 views

Can I store a GPG revoke certificate online?

It's clearly a good idea to store the revocation certificate in a way which is both secure and reliable. Cloud-based storage services are great for reliability, but of course they lack of security. ...
1
vote
1answer
499 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
1
vote
1answer
270 views

What are the implications of storing sensitive data in bookmarklets?

While discussing alternatives for asking the browser to remember your password, one guy suggested using a bookmarklet to store users' credentials. The original answer is in portuguese, but I'll ...
1
vote
2answers
1k views

How do i know if I have moved or copied a file from my SD card to PC? [closed]

is there any way to know if the file I have on my mini-SD card was moved or copied to my PC? i have sensitive files on my SD card which is stolen and i cant remember if I cut or copied the file from ...
1
vote
1answer
5k views

What method of secure erase is sufficient for MacBook Pro SSD Drives? [duplicate]

I would like to securely erase the hard drive of a SSD in a MacBook Pro. The Disk Utility does not give me the option to wipe this drive even when I boot into the System Partition. (it is greyed ...
1
vote
2answers
142 views

Best reasonable way to store a secret safely

I'm working on a software that need to store and use secrets. These secrets can be for example: a password to connect to a database a client secret for an OAuth 2.0 client_credentials grant. I ...
1
vote
2answers
31 views

Rembering password on client (not database) [closed]

I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again. Is there a secure way for my program to store ...
1
vote
2answers
590 views

How to safely store bearer tokens on server?

Imagine you're running a service that implements an OAuth 2.0 flow to allow your end users to log into 3rd party apps, and authorize those apps to consume your service's data through some API. Upon ...
1
vote
1answer
97 views

Storing salt and hashed password [duplicate]

Is there a benefit to storing salt appended to hashed password in a single column of a table verses storing salt and hashed password in different columns of the table. The OWASP guide here ...
1
vote
1answer
102 views

Embedded devices with storage for sensitive data

I'm looking for some embedded device that will be able to store sensitive data like certificates, private keys, etc. It should comply with following requirements: Sensitive data, stored in protected ...
1
vote
1answer
167 views

Does anything stop applications from reading your saved passwords and cookies from your browser's AppData folder?

Obviously the first answer is "a malicious application can do much worse than that." However, it seems like a really easy thing for an application to read your cookies, saved passwords, etc. from your ...
1
vote
1answer
58 views

Battery Backed SRAM (and Digital Forensics)

Is it feasible to create a portable battery powered drive out of RAM that could sustain its data via the charge of a battery? From my understanding it doesn't require much power. Combining this ...
1
vote
1answer
143 views

Secure backup on online Cloudstorage

i own a small private server (@home) with all necessary features for my backup purposes (Owncloud, SVN, GIT). My target now is to ensure the safety of my data in emergency cases like fire/flood. For ...
1
vote
1answer
30 views

Can I keep large encrypted files in my mailbox on mail provider server?

Is there any restriction or policy of large e-mail providers (such as GMail, Yahoo, Hotmail and similar) for keeping/storing large encrypted files by the users within their disk quota in 3rd party ...
1
vote
1answer
303 views

Can any malware access the OSX keychain data

I'm working on a security project. I have sensitive data that I would like to store in OS X's keychain. I'm able to add the data programmatically into the OS X keychain by using RHKeychain. But after ...