Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

learn more… | top users | synonyms

35
votes
8answers
7k views

How can I reliably erase all information on a hard drive?

As storage technologies change over time, using different encodings and remappings to deal with sector errors, the best way to permanently erase/wipe/shred data changes also. Methods for flash drives ...
30
votes
4answers
12k views

Why is writing zeros (or random data) over a hard drive multiple times better than just doing it once?

Lots of different programs, such as Darik's Boot and Nuke, let you write over a hard drive multiple times under the guise of it being more secure than just doing it once. Why?
8
votes
1answer
3k views

When using AES and CBC, is it necessary to keep the IV secret?

If I encrypt some data with a randomly generated Key and Initialization Vector, then store all three pieces of information in the same table row; is it necessary to encrypt the IV as well as the Key? ...
13
votes
2answers
628 views

Secure wiping of EEPROM and flash memory

Older magnetic storage exhibited some data remanence, so a recommendation emerged to wipe data by overwriting it multiple times with varying patterns — the “Gutmann wipe”. More recent hard disk ...
8
votes
2answers
2k views

How should an application store its credentials

When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
5
votes
2answers
497 views

Encrypt user data when they log in with Facebook, Gmail, etc

I made a login system. The user can login by: using a normal email / password (bcrypted). using a service like facebook, gmail, etc. So far so good. Now I want to store sensitive information (ftp ...
8
votes
4answers
3k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
2
votes
2answers
2k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
4
votes
1answer
130 views

Keeping a user's passwords, but can't hash them

I'm making a web application to provide intermediary service for customers to facilitate their interaction with a set of other web applications. A simplified example would be to let a user access his ...
2
votes
1answer
40 views

Tools for Verifying Secure Deletion

It is recommended to verify the zeroing-out was done properly when you try to secure delete a HDD. From this post, some drives with firmware bugs prevent secure erase from working properly. What are ...