Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

learn more… | top users | synonyms

28
votes
8answers
6k views

How can I reliably erase all information on a hard drive?

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also. Methods for flash drives ...
28
votes
4answers
10k views

Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?

Lots of different programs, such as Darik's Boot and Nuke, let you write over a hard drive multiple times under the guise of it being more secure than just doing it once. Why?
8
votes
1answer
2k views

When using AES and CBC, is it necessary to keep the IV secret?

If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key? ...
13
votes
2answers
480 views

Secure wiping of EEPROM and flash memory

Older magnetic storage exhibited some data remanence, so a recommendation emerged to wipe data by overwriting it multiple times with varying patterns — the “Gutmann wipe”. More recent hard disk ...
8
votes
2answers
1k views

How should an application store its credentials

When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
6
votes
4answers
2k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
4
votes
1answer
121 views

Keeping a user's passwords, but can't hash them

I'm making a web application to provide intermediary service for customers to facilitate their interaction with a set of other web applications. A simplified example would be to let a user access his ...
2
votes
1answer
25 views

Tools for Verifying Secure Deletion

It is recommended to verify the zeroing-out was done properly when you try to secure delete a HDD. From this post, some drives with firmware bugs prevent secure erase from working properly. What are ...
1
vote
2answers
1k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...