Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

learn more… | top users | synonyms

6
votes
4answers
705 views

Where should a team store server credentials [duplicate]

Imagine we are working in a team of around 5 people. We all install new servers on a monthly base and need to find a better way of storing and sharing the server credentials (offline-location/...
1
vote
2answers
38 views

Undeletable logging or file-writing

I want to log or write files automatically to a un-deletable storage device. Even if the attacker had offline access to the storage device he/she shouldn't be able to delete the files or logs. If ...
1
vote
2answers
79 views

Store passwords as integers

I just came up with this idea that I can store passwords as integers which take up 4 or 8 bytes as opposed to a hash that takes like 150 bytes or something. I wrote this function that converts a ...
2
votes
1answer
66 views

How well does FDE protect against disk firmware malware?

In early 2015 news broke that the NSA was installing firmware backdoors in many hard drives. I was wondering, if there was a BIOS and Hard Drive backdoor how well would full disk encryption protect ...
0
votes
1answer
47 views

Grabbing ChaCha20 key from ram

There are various other posts which talk about grabbing a key from ram such as http://electronics.stackexchange.com/questions/198274/storing-a-secure-key-in-an-embedded-devices-memory How would you ...
1
vote
1answer
46 views

PCI Compliance requirement when storing card data on user's device

I have an application where I take the user to a PCI compliant payment gateway for completing the payment. I want to give the functionality of "Remember my card" so that the user does not have to ...
-1
votes
0answers
16 views

Can't find what is filling up hard drive [migrated]

I have a computer I am working on, it says the drive is almost full and it goes up and down in space randomly but when I run Windrstat it doesn't show what is taking up space. When I right click on ...
0
votes
0answers
28 views

Need computer forensic case citation (urgent) [migrated]

My mother is about to attend court over a car which was written off by a lorry. The CCTV video recording of the accident was mishandled, such as the storage SD card not being imaged, it was also ...
1
vote
2answers
428 views

How can Stolen Laptop tracking softwares survive OS reinstall?

Some softwares such as Computertrace claim that it can survive on a laptop even if the thief successfully reinstalls the operating system, reformats the hard drive, or (in some laptop models) swaps ...
1
vote
1answer
109 views

How to implement iterations when hashing passwords?

To securely hash passwords, algorithms such as PBKDF2 do many iterations of a common hash such as SHA1. Are there certain ways that these iterations need to be done to be safe? In particular, from ...
17
votes
2answers
6k views

How should an application store its credentials

When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
2
votes
0answers
42 views

What is the current consensus on storage of primary credentials or long-lived cryptographic tokens?

The problem: some environments need to use plain text credentials or long-lived tokens in order to unlock a specific functionality. Examples include third party legacy services which need a login/...
0
votes
0answers
46 views

Risks with shared informations of an Network Attached Storage

I'm trying to create a file server with my RaspberryPi to deploy all over the private network. I therefore mounted my disks on installed Samba and began to modify the settings. By default shared ...
2
votes
4answers
105 views

Are there any quick-erase devices with a small memory available for storing key information?

I would like to set up my computer's full disk encryption to unlock with a key file (preferably one that uses the SD card interface, but I'm not particularly picky) because it's annoying to enter in ...
-2
votes
1answer
34 views

Is it fundamentally possible to prove a current industry standard end-to-end system of secure data storage and transfer?

I know we can design an ultra simple system that is proven to perform one thing with perfect security. We've done that. That's called a proven system, and it has been done with micro-kernels. (An ...
23
votes
3answers
3k views

To what extent does formatting a disk (securely) remove its data?

If the goal is to make data no longer retrievable, how secure is it to format the disk? I assumed formatting the disk overwrites free space (thus making it a safe bet no one's going to be able to ...
0
votes
1answer
66 views

Store password ciphers using Powershell ? DPAPI/AES

Hi and sorry if it is in wrong place I am making a script that requires to have a lot of server's IP and their passwords stored into a file. I wanted to use Windows DPAPI, but as we can easily ...
0
votes
0answers
50 views

Handling Credit Card info in Source Code

Background Info I am using an API to make donation to charities (First Giving API). The API only supports credit card info for making a donation. Due to the requirements of the application, donors ...
-3
votes
2answers
115 views

Is it more secure to delete emails from the server once a client has downloaded them?

From this email provider We strongly adivse people to download their email whenever possible, so as to lessen the amount of personal private data present at any time on the servers. Does ...
6
votes
2answers
5k views

Security of Microsoft OneDrive

A friend asked about putting some of his data on Microsoft's OneDrive. I did some research, and what I learned seems very surprising. It appears that all the user data on MS OneDrive is store ...
2
votes
1answer
65 views

Recommendation Key Management and Storage in Cloud Storage

I am currently researching about key management in the cloud storage and looking for alternative for it. The current system stores encryption key for each file in the server and each key is encrypted ...
1
vote
2answers
156 views

How secure is a BIOS/UEFI hard drive password? [duplicate]

I'm buying some new machines and am concerned about security of the data should the machine be physically stolen. It's easy to take out the drive, image it, and read what you want. I could use file ...
1
vote
0answers
110 views

How can I safely store a password during a user session

I am writing an Java application that is using OAuth to authentificate against a server API. The server is offering the OAuth secrets for users to copy from its website. Because each request needs ...
0
votes
0answers
30 views

How to know who and when files and folders have been deleted in CentOS? [duplicate]

I have a dedicated web server and there is some files and folders have been deleted from my client's sub-domain accidentally and there are more than one user mange the client site. How to know who ...
2
votes
1answer
768 views

storage of client credential on OAuth2 server

I'm developing an API and used a recommended implementation of OAuth2 protocol: PHP OAuth2 Server. This library stores client ID and client secret as plain text in a database table. Note that I ...
14
votes
1answer
3k views

Is a single pass enough when disposing of a HDD? [duplicate]

I am in the process of wiping a number of hard drives using DBAN. I always believed that a single pass makes the data near impossible to recover, but DBAN has a default of 3. Is it any more secure, ...
5
votes
3answers
5k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
0
votes
2answers
87 views

Personal Cloud Storage vs. File Sharing Services

In terms of maintaining Confidentiality, Integrity, and Availability, what are the risks and benefits associated with setting up a personal cloud storage device on your home network versus using a ...
2
votes
2answers
268 views

Best reasonable way to store a secret safely

I'm working on a software that need to store and use secrets. These secrets can be for example: a password to connect to a database a client secret for an OAuth 2.0 client_credentials grant. I ...
22
votes
2answers
8k views

When using AES and CBC, is it necessary to keep the IV secret?

If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key? ...
0
votes
0answers
31 views

What are the risks of sharing disk storage by NFS by two machines in different security zones?

In order to share files between two systems, an IT department has decided to share disk storage in a SAN device. The volumes are shared by NFS. The two machines mount the same volume in the SAN. The ...
1
vote
2answers
115 views

Keeping user files secure while allowing a web-application to use the files

Short background I am currently in the process of designing a web-application where the user uploads some files to the server and then asks the server to do some calculations based on these files (...
0
votes
2answers
209 views

how to store and retrieve nonce in practice

As nonce is supposed to be random and used only one time, when receiving a nonce, I need to check it with all past nonce records. That means I need a database to store every nonce I had before. Of ...
3
votes
3answers
145 views

Good way of storing lots of third-party passwords

I've consulted this question, but I'd like to hear some more input. I'm building a scraping app that is going to act as an aggregator of sorts for a large number of businesses which use a few popular ...
2
votes
0answers
28 views

OAuth2 client account & data storage [duplicate]

Context I have a REST API where a user can create an account from a web client. The password is saved as a salted hash in a database. When a user is authenticated they can save and retrieve private ...
4
votes
4answers
4k views

Storing CVC / CVV / CVV2 until payment is processed

I need to store the payment info of a transaction. We have a script that reads which transactions haven't yet been sent to our ERP (the business management software), to then send it. This script ...
59
votes
4answers
36k views

Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?

Lots of different programs, such as Darik's Boot and Nuke, let you write over a hard drive multiple times under the guise of it being more secure than just doing it once. Why?
14
votes
5answers
8k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
2
votes
1answer
165 views

How to store client login credentials?

My company has to constantly connect to remote server where there are numerous way to access, often via vpn and remote desktop connections, as well as SQL servers. There are over 50 clients that this ...
1
vote
2answers
34 views

Rembering password on client (not database) [closed]

I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again. Is there a secure way for my program to store this?...
3
votes
1answer
197 views

Using Google Cloud Platform to store credit card data

I have made an iPhone app for users to book hotel rooms. A third party provides the service for booking the hotel rooms and charging the credit cards. At the moment, my app makes no attempt to save ...
3
votes
2answers
133 views

Is there a way to guarantee removal of data after closing Facebook / Gmail / Dropbox account? [closed]

Of course my default way of thinking is: deleted: true while keeping all the data in place. In fact I would be interested in knowing what standard operating procedures are in place for retention of ...
3
votes
1answer
110 views

Secure sharing between Windows computers

I'm working on a project to setup a secure system to share files between 5 Windows computers. The computers are part of a domain so could have multiple different users logging in (based on an AD group)...
4
votes
4answers
181 views

Should I format storage after buying it?

I've just bought a new (unused) external HDD. Should I format it or is it save to use it directly? Did it already happen that a device was infected before the first customer use? Will formatting ...
2
votes
1answer
5k views

What method of secure erase is sufficient for MacBook Pro SSD Drives? [duplicate]

I would like to securely erase the hard drive of a SSD in a MacBook Pro. The Disk Utility does not give me the option to wipe this drive even when I boot into the System Partition. (it is greyed out)...
63
votes
8answers
17k views

How can I reliably erase all information on a hard drive?

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also. Methods for flash drives ...
6
votes
5answers
193 views

Can I show Credit Card Data to final customers and be PCI Compliant?

I work with reservation management syatems. In the hospitality industry there is the concept of credit card as guarantee. By it when making any kind of reservation you are asked for your credit card ...
2
votes
1answer
105 views

Can we determine how securely files are stored on a cloud storage service?

After asking two questions about the security of online cloud storage, it seems to me that we can only at best speculate as to the security practices of the hosting company, and believe what they tell ...
1
vote
2answers
188 views

How can a seamless cloud storage service be Zero-knowledge?

Cloud based storage services like Dropbox and Google Drive are a cause for concern when it comes to privacy. They store encryption keys for your files on their servers. Therefore, anyone who manage to ...
23
votes
5answers
3k views

ZX Spectrum tape loader: how was copy prevention implemented?

I am curious how copy prevention was implemented for games or other programs loaded from cassette on the micro computers of the early 1980s, such as the ZX Spectrum 48k. If I recall correctly, some ...