Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

learn more… | top users | synonyms

22
votes
3answers
3k views

To what extent does formatting a disk (securely) remove its data?

If the goal is to make data no longer retrievable, how secure is it to format the disk? I assumed formatting the disk overwrites free space (thus making it a safe bet no one's going to be able to ...
0
votes
1answer
37 views

Store password ciphers using Powershell ? DPAPI/AES

Hi and sorry if it is in wrong place I am making a script that requires to have a lot of server's IP and their passwords stored into a file. I wanted to use Windows DPAPI, but as we can easily ...
0
votes
0answers
45 views

Handling Credit Card info in Source Code

Background Info I am using an API to make donation to charities (First Giving API). The API only supports credit card info for making a donation. Due to the requirements of the application, donors ...
2
votes
1answer
41 views

How well does FDE protect against disk firmware malware?

In early 2015 news broke that the NSA was installing firmware backdoors in many hard drives. I was wondering, if there was a BIOS and Hard Drive backdoor how well would full disk encryption protect ...
-1
votes
0answers
43 views

Best practices for encrypting passwords on a server [duplicate]

I have a web application where users can optionally choose to link their accounts with a third-party service provider to enable some additional features. Unfortunately, the third-party webservice API ...
-3
votes
2answers
110 views

Is it more secure to delete emails from the server once a client has downloaded them?

From this email provider We strongly adivse people to download their email whenever possible, so as to lessen the amount of personal private data present at any time on the servers. Does ...
6
votes
2answers
4k views

Security of Microsoft OneDrive

A friend asked about putting some of his data on Microsoft's OneDrive. I did some research, and what I learned seems very surprising. It appears that all the user data on MS OneDrive is store ...
2
votes
1answer
40 views

Recommendation Key Management and Storage in Cloud Storage

I am currently researching about key management in the cloud storage and looking for alternative for it. The current system stores encryption key for each file in the server and each key is encrypted ...
1
vote
2answers
72 views

How secure is a BIOS/UEFI hard drive password? [duplicate]

I'm buying some new machines and am concerned about security of the data should the machine be physically stolen. It's easy to take out the drive, image it, and read what you want. I could use file ...
1
vote
0answers
108 views

How can I safely store a password during a user session

I am writing an Java application that is using OAuth to authentificate against a server API. The server is offering the OAuth secrets for users to copy from its website. Because each request needs ...
0
votes
0answers
30 views

How to know who and when files and folders have been deleted in CentOS? [duplicate]

I have a dedicated web server and there is some files and folders have been deleted from my client's sub-domain accidentally and there are more than one user mange the client site. How to know who ...
2
votes
1answer
658 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
14
votes
1answer
2k views

Is a single pass enough when disposing of a HDD? [duplicate]

I am in the process of wiping a number of hard drives using DBAN. I always believed that a single pass makes the data near impossible to recover, but DBAN has a default of 3. Is it any more secure, ...
5
votes
3answers
5k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
0
votes
2answers
75 views

Personal Cloud Storage vs. File Sharing Services

In terms of maintaining Confidentiality, Integrity, and Availability, what are the risks and benefits associated with setting up a personal cloud storage device on your home network versus using a ...
2
votes
2answers
211 views

Best reasonable way to store a secret safely

I'm working on a software that need to store and use secrets. These secrets can be for example: a password to connect to a database a client secret for an OAuth 2.0 client_credentials grant. I ...
20
votes
2answers
8k views

When using AES and CBC, is it necessary to keep the IV secret?

If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key? ...
0
votes
0answers
24 views

What are the risks of sharing disk storage by NFS by two machines in different security zones?

In order to share files between two systems, an IT department has decided to share disk storage in a SAN device. The volumes are shared by NFS. The two machines mount the same volume in the SAN. The ...
1
vote
2answers
105 views

Keeping user files secure while allowing a web-application to use the files

Short background I am currently in the process of designing a web-application where the user uploads some files to the server and then asks the server to do some calculations based on these files ...
0
votes
2answers
178 views

how to store and retrieve nonce in practice

As nonce is supposed to be random and used only one time, when receiving a nonce, I need to check it with all past nonce records. That means I need a database to store every nonce I had before. Of ...
3
votes
3answers
134 views

Good way of storing lots of third-party passwords

I've consulted this question, but I'd like to hear some more input. I'm building a scraping app that is going to act as an aggregator of sorts for a large number of businesses which use a few popular ...
2
votes
0answers
28 views

OAuth2 client account & data storage [duplicate]

Context I have a REST API where a user can create an account from a web client. The password is saved as a salted hash in a database. When a user is authenticated they can save and retrieve private ...
3
votes
4answers
3k views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
58
votes
4answers
35k views

Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?

Lots of different programs, such as Darik's Boot and Nuke, let you write over a hard drive multiple times under the guise of it being more secure than just doing it once. Why?
12
votes
5answers
8k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
2
votes
1answer
126 views

How to store client login credentials?

My company has to constantly connect to remote server where there are numerous way to access, often via vpn and remote desktop connections, as well as SQL servers. There are over 50 clients that this ...
1
vote
2answers
32 views

Rembering password on client (not database) [closed]

I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again. Is there a secure way for my program to store ...
3
votes
1answer
169 views

Using Google Cloud Platform to store credit card data

I have made an iPhone app for users to book hotel rooms. A third party provides the service for booking the hotel rooms and charging the credit cards. At the moment, my app makes no attempt to save ...
3
votes
2answers
131 views

Is there a way to guarantee removal of data after closing Facebook / Gmail / Dropbox account? [closed]

Of course my default way of thinking is: deleted: true while keeping all the data in place. In fact I would be interested in knowing what standard operating procedures are in place for retention of ...
2
votes
1answer
98 views

Secure sharing between Windows computers

I'm working on a project to setup a secure system to share files between 5 Windows computers. The computers are part of a domain so could have multiple different users logging in (based on an AD ...
4
votes
4answers
178 views

Should I format storage after buying it?

I've just bought a new (unused) external HDD. Should I format it or is it save to use it directly? Did it already happen that a device was infected before the first customer use? Will formatting ...
2
votes
1answer
5k views

What method of secure erase is sufficient for MacBook Pro SSD Drives? [duplicate]

I would like to securely erase the hard drive of a SSD in a MacBook Pro. The Disk Utility does not give me the option to wipe this drive even when I boot into the System Partition. (it is greyed ...
63
votes
8answers
16k views

How can I reliably erase all information on a hard drive?

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also. Methods for flash drives ...
6
votes
5answers
166 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
2
votes
1answer
97 views

Can we determine how securely files are stored on a cloud storage service?

After asking two questions about the security of online cloud storage, it seems to me that we can only at best speculate as to the security practices of the hosting company, and believe what they tell ...
1
vote
2answers
168 views

How can a seamless cloud storage service be Zero-knowledge?

Cloud based storage services like Dropbox and Google Drive are a cause for concern when it comes to privacy. They store encryption keys for your files on their servers. Therefore, anyone who manage to ...
23
votes
5answers
3k views

ZX Spectrum tape loader: how was copy prevention implemented?

I am curious how copy prevention was implemented for games or other programs loaded from cassette on the micro computers of the early 1980s, such as the ZX Spectrum 48k. If I recall correctly, some ...
2
votes
0answers
103 views

How to store a file securely on the windows file system?

Problem: I have a windows service running under local system account. I have a blob of data that I want to store securely and persistently between reboots. I have decided to store it as afile( as ...
5
votes
1answer
535 views

Convenient Write Once Media to attach to a computer: A USB stick or device?

What is a convenient write once media to use with a Computer, preferably via the USB interface. I often see this use-case in several ways: I have a server whose logs need to be on a medium that ...
1
vote
2answers
921 views

How to safely store bearer tokens on server?

Imagine you're running a service that implements an OAuth 2.0 flow to allow your end users to log into 3rd party apps, and authorize those apps to consume your service's data through some API. Upon ...
0
votes
2answers
181 views

Saving passwords in database

I have recently been studying a lot on writing secure code and choosing secure methods for saving passwords to a database. I'm wondering if it's secure to use ready made libraries or APIs to do this ...
1
vote
4answers
282 views

What options exist for authenticated full-disk encryption?

Title says it all really. I'm toying with the idea of storing some disk images in "the cloud", but am concerned about the possibility of an attacker manipulating cipertext to do evil things once it's ...
0
votes
0answers
37 views

Is the SanDisk ULLtraDIMM secure after power-down?

I found an interesting product last night called the SanDisk ULLtradDimm SSD (product page), which essentially claims drastic performance gains by plugging an SSD into a standard DDR3 memory channel. ...
5
votes
2answers
299 views

How to securely store application data on mobile device

How can security be enhanced to the maximum in a messaging app storing messaging history on the device (like whatsapp)? I am specifically referring to methods to minimize the risk of the data being ...
19
votes
4answers
4k views

Why is writing zeros (or random data) over a hard drive used when writing all ones is more beneficial? [duplicate]

As far as I know, in order to securely delete the hard drive's contents, one should fill it with zeroes or, for added security and harder recoverability, random data first and then all zeroes. In ...
5
votes
1answer
113 views

If I fill a hypothetical 1gb HDD with 1024 single 1mb files, will all sectors be overwritten?

When a file is deleted, its only marked as an unused sector of a hard drive. Im wondering if it's possible to fill a 1gb HDD with 1024 individual 1mb files to completely use every sector?
19
votes
5answers
2k views

Considerations for long-term key storage (paper backup, media for vault storage)?

I'm reviewing our company's security procedures regarding cryptographic keys and master passwords, and also my private system at home. The key generation process is pretty much the same as that ...
-5
votes
1answer
93 views

Does Server Mistrust improve security? [closed]

By server mistrust, I mean the fully implemented lack of customer plaintext on a vendor's system, and lack of vendor access to customer plaintext. Specific case in question: Password and SSH key ...
3
votes
1answer
69 views

Is it safer to store valuable information on a unsecure client or send the data through the internet?

Background: I'm creating a secure web app with the purpose to act as a no-knowledge storage for small data (we're talking a few bytes). Since all the encryption and decryption happens client-side, ...
3
votes
3answers
321 views

How is truncation according to PCI DSS secure?

In section 3.3 of the PCI standard, it says that when displaying PANs, limiting visibility to the first 6 and last 4 digits of the PAN is considered secure. Doing some quick math, on a 16 digit PAN, ...