Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

learn more… | top users | synonyms

3
votes
5answers
598 views

PCI-DSS and salt storage

PCI-DSS states the following: 3.5 Protect any keys used to secure cardholder data against disclosure and misuse I have a service which stores a salted bcrypt hash of the user's PAN. Assuming the ...
3
votes
2answers
133 views

Is there a way to guarantee removal of data after closing Facebook / Gmail / Dropbox account? [closed]

Of course my default way of thinking is: deleted: true while keeping all the data in place. In fact I would be interested in knowing what standard operating procedures are in place for retention of ...
3
votes
3answers
351 views

How is truncation according to PCI DSS secure?

In section 3.3 of the PCI standard, it says that when displaying PANs, limiting visibility to the first 6 and last 4 digits of the PAN is considered secure. Doing some quick math, on a 16 digit PAN, ...
3
votes
1answer
152 views

Optimise user data fetch using S3

I'm writing a mobile app that communicates with my server using REST. Upon every launch, the app makes a call to the server api to check whether there was a change in the user details (using a ...
3
votes
2answers
1k views

Shutdown: Clear virtual memory pagefile

I was reading about Windows Local Policy of "Shutdown: Clear virtual memory pagefile". I need some clarification on this brief policy description: What do it mean by operating system that allow ...
3
votes
3answers
140 views

Good way of storing lots of third-party passwords

I've consulted this question, but I'd like to hear some more input. I'm building a scraping app that is going to act as an aggregator of sorts for a large number of businesses which use a few popular ...
3
votes
1answer
186 views

Using Google Cloud Platform to store credit card data

I have made an iPhone app for users to book hotel rooms. A third party provides the service for booking the hotel rooms and charging the credit cards. At the moment, my app makes no attempt to save ...
3
votes
1answer
69 views

Is it safer to store valuable information on a unsecure client or send the data through the internet?

Background: I'm creating a secure web app with the purpose to act as a no-knowledge storage for small data (we're talking a few bytes). Since all the encryption and decryption happens client-side, ...
3
votes
1answer
234 views

Remote System Administration of an Encryption-Switch-Encrypted Infrastructure

I can't seem to find a decent explanation anywhere of the practicalities of remote system administration (e.g. SSH) of an encryption-switch-encrypted SAN-stored infrastructure. The environment will ...
3
votes
1answer
200 views

Updating stored, encrypted containers on a server

My scenario is this -- I want to store an encrypted container on a network server. This encrypted container should be accessible to others to download and decrypt/mount locally provided they have the ...
2
votes
4answers
101 views

Are there any quick-erase devices with a small memory available for storing key information?

I would like to set up my computer's full disk encryption to unlock with a key file (preferably one that uses the SD card interface, but I'm not particularly picky) because it's annoying to enter in ...
2
votes
1answer
199 views

Xbox 360 Security - Why must you be the data owner to move content?

Xbox 360 does not allow you to move content (such as to a usb), unless you are the owner of the content (Same gamertag as save file). This seems pointless considering, I can simply sign into any ...
2
votes
3answers
355 views

PCI Compliance Problem

My company is trying to become fully PCI Compliant and we are switching our outdated systems to use Authorize.net CIM among other things. But, currently we're all over the place and until our new ...
2
votes
1answer
1k views

How to Protect the Password Stored in a Configuration File? [duplicate]

Possible Duplicate: Standards for encrypting passwords in configuration files? I am not sure if this question has been asked before here, I wasn't able to find it. So, please feel free to ...
2
votes
1answer
53 views

Recommendation Key Management and Storage in Cloud Storage

I am currently researching about key management in the cloud storage and looking for alternative for it. The current system stores encryption key for each file in the server and each key is encrypted ...
2
votes
1answer
409 views

What evidence is there that SpiderOak is significantly different from Lavabit?

In 2013 Lavabit shut down because a US agency was demanding access to its private SSL keys and basically the deets on whatever users the US was interested in. Lavabit shut down rather than give the US ...
2
votes
1answer
717 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
2
votes
2answers
187 views

Password verification scheme (used in eg. MS Office) - more secure than just a hash?

Usual password verification schemes stores a salted password hash and the salt. If the hash is good and computational costly, it is considered secure. However an alternate version (used in Microsoft ...
2
votes
1answer
583 views

Are there any secure ways to store the secret key used in a TOTP scheme?

I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
2
votes
3answers
15k views

Database field type for password storage?

In the past I used varchar(255) for storing hashed passwords (no salt). Is this still enough? Or are longer fields required?
2
votes
1answer
102 views

Can we determine how securely files are stored on a cloud storage service?

After asking two questions about the security of online cloud storage, it seems to me that we can only at best speculate as to the security practices of the hosting company, and believe what they tell ...
2
votes
1answer
985 views

Secure private key storage

In light of BadUSB, storing private keys on a USB flash drive is not the best way. What about writing private keys to a CD? What I am worried about is whenever I plug my private key storage device ...
2
votes
1answer
5k views

What method of secure erase is sufficient for MacBook Pro SSD Drives? [duplicate]

I would like to securely erase the hard drive of a SSD in a MacBook Pro. The Disk Utility does not give me the option to wipe this drive even when I boot into the System Partition. (it is greyed ...
2
votes
2answers
231 views

Best reasonable way to store a secret safely

I'm working on a software that need to store and use secrets. These secrets can be for example: a password to connect to a database a client secret for an OAuth 2.0 client_credentials grant. I ...
2
votes
1answer
142 views

How to store client login credentials?

My company has to constantly connect to remote server where there are numerous way to access, often via vpn and remote desktop connections, as well as SQL servers. There are over 50 clients that this ...
2
votes
2answers
996 views

How to safely store bearer tokens on server?

Imagine you're running a service that implements an OAuth 2.0 flow to allow your end users to log into 3rd party apps, and authorize those apps to consume your service's data through some API. Upon ...
2
votes
3answers
553 views

How can my bank issue a new credit card with the same pin number? [duplicate]

I live in France, and I have a debit card issued by my bank. When it expires, I receive a new one with the same pin number. I recently asked my banker to issue another card (a different one, for ...
2
votes
1answer
280 views

HIPAA compliant blob storage architecture

There is a task to design a system to store sensitive data securely (should be HIPAA compliant in the future). It's just a draft - this will not be used in production in a foreseeable future. I have a ...
2
votes
1answer
237 views

Tools for Verifying Secure Deletion [closed]

It is recommended to verify the zeroing-out was done properly when you try to secure delete a HDD. From this post, some drives with firmware bugs prevent secure erase from working properly. What are ...
2
votes
2answers
471 views

Locality Sensitive Hash (LSH) function to approximately match old passwords

Recently, I ran across a website that requires me to change my password after X number of days had passed since I had last created one. Intelligently, the service made sure that the password did not ...
2
votes
1answer
284 views

How to safely “remember” login information in a program [duplicate]

Possible Duplicate: How to Securely Implement a “Remember Me” Feature? I have a program that communicates with a server. The user must log in with the application which runs on their ...
2
votes
2answers
8k views

How to set up a user-friendly NAS encryption?

We recently installed one NAS drive (Buffalo LinkStation Pro Duo, LS-WVL, running the most recent Firmware version 1.6 to be precise) in our (small) company network. Currently, there is no encryption ...
2
votes
1answer
232 views

Which mobile phone OS implements or plan to implement data protection using keys derived from passwords per NIST SP800-132?

NIST has released Special Publication 800-132: Recommendation for Password-Based Key Derivation which is meant for protection of stored data using encryption keys derived from user password. This ...
2
votes
1answer
58 views

How well does FDE protect against disk firmware malware?

In early 2015 news broke that the NSA was installing firmware backdoors in many hard drives. I was wondering, if there was a BIOS and Hard Drive backdoor how well would full disk encryption protect ...
2
votes
0answers
28 views

OAuth2 client account & data storage [duplicate]

Context I have a REST API where a user can create an account from a web client. The password is saved as a salted hash in a database. When a user is authenticated they can save and retrieve private ...
2
votes
1answer
104 views

Secure sharing between Windows computers

I'm working on a project to setup a secure system to share files between 5 Windows computers. The computers are part of a domain so could have multiple different users logging in (based on an AD ...
2
votes
0answers
115 views

How to store a file securely on the windows file system?

Problem: I have a windows service running under local system account. I have a blob of data that I want to store securely and persistently between reboots. I have decided to store it as afile( as ...
1
vote
2answers
177 views

How can a seamless cloud storage service be Zero-knowledge?

Cloud based storage services like Dropbox and Google Drive are a cause for concern when it comes to privacy. They store encryption keys for your files on their servers. Therefore, anyone who manage to ...
1
vote
4answers
290 views

What options exist for authenticated full-disk encryption?

Title says it all really. I'm toying with the idea of storing some disk images in "the cloud", but am concerned about the possibility of an attacker manipulating cipertext to do evil things once it's ...
1
vote
2answers
967 views

Is a sensitive NAS behind a router safe?

I have four pcs connected to a switch connected to a router that gets connected directly to the internet. How safe is a NAS attached to the same router along with the switch plug? I'd like to have ...
1
vote
2answers
417 views

How can Stolen Laptop tracking softwares survive OS reinstall?

Some softwares such as Computertrace claim that it can survive on a laptop even if the thief successfully reinstalls the operating system, reformats the hard drive, or (in some laptop models) swaps ...
1
vote
1answer
144 views

How secure is the web-based file browser that comes with my NAS?

I have a Buffalo Linkstation Pro 2 Duo for home use. It has a web GUI for browsing the contents of the NAS (distinct from the admin interface). The idea is that you would expose the web GUI to the ...
1
vote
1answer
104 views

How to implement iterations when hashing passwords?

To securely hash passwords, algorithms such as PBKDF2 do many iterations of a common hash such as SHA1. Are there certain ways that these iterations need to be done to be safe? In particular, from ...
1
vote
2answers
109 views

Keeping user files secure while allowing a web-application to use the files

Short background I am currently in the process of designing a web-application where the user uploads some files to the server and then asks the server to do some calculations based on these files ...
1
vote
1answer
91 views

Can I store a GPG revoke certificate online?

It's clearly a good idea to store the revocation certificate in a way which is both secure and reliable. Cloud-based storage services are great for reliability, but of course they lack of security. ...
1
vote
2answers
1k views

How do you protect strings in code from users decompiling them and seeing them [duplicate]

For an example say we have an application such as a client based application which connects to an API using an api key. We are saying for this purpose there is no OAuth. How would a string or in this ...
1
vote
1answer
290 views

What are the implications of storing sensitive data in bookmarklets?

While discussing alternatives for asking the browser to remember your password, one guy suggested using a bookmarklet to store users' credentials. The original answer is in portuguese, but I'll ...
1
vote
2answers
1k views

How do i know if I have moved or copied a file from my SD card to PC? [closed]

is there any way to know if the file I have on my mini-SD card was moved or copied to my PC? i have sensitive files on my SD card which is stolen and i cant remember if I cut or copied the file from ...
1
vote
2answers
34 views

Rembering password on client (not database) [closed]

I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again. Is there a secure way for my program to store ...
1
vote
1answer
157 views

Strategy for encryption before cloud storage

Apologies if this has been asked before. I am looking to encrypt documents before storing in the cloud. There will be a separate metadata storage, which could be either internal or cloud hosted. My ...