Tag Info

New answers tagged

1

I have not used these technologies before but what I can tell you is if you decrypt the password in your SQL query then anyone on your network can sniff and get the passwords as plain text. If I understand correctly, your C# will get the decrypted passwords? If so I would recommend you have something such as in your C# application: C# generate a random ...


1

Could it? Yes. Is it? That's less certain. If your MySQL server is configured properly, it isn't accessible from the Internet at large, and the credentials are useless to anyone who doesn't have the ability to run code on the server. Of course, this assumes that the username and password are unique to the server.


0

(Disclaimer: I'm a "security student" myself, so I'm not 100% sure if this is correct.) I don't understand why you would want to keep private keys on the server after they are transferred to the user. There is no use for them. If they are lost - create new ones. Keys have a public and a private part. The public part can really be public and may be ...


2

You are asking to generate secret data from a single, non-secret source. It can't be done under those exact conditions. You need a 'source of secrecy'. You can try to squirrel a key away in a config file, perhaps encrypted with yet another key, or you can move some aspect to a different, secure machine, such as using a Hardware Security Module (HSM) to host ...


1

HIPAA doesn't specifically prohibit shared infrastructure. If you are going to be a neutral firm offering SaaS to numerous practices, this architecture will be fine. Ensure that your logical security is top notch such that no client can access data for any other client. This is fairly easy, but needs to be a deliberate, documented and demonstrable ...


-1

Here is a checklist for MongoDB security Enable auth – Even if you have deployed your Mongodb servers in a trusted network it is good security practice to enable auth. It provides you “Defense in depth” if your network is compromised. Edit your mongod configuration file to enable auth Don’t expose your production db to the internet – Restricting physical ...


0

I know I am three years late to the party, but I like to point out something I missed in the answers for those finding this in Google. Most "leaks" from hacked websites are the result of SQL Injection, and much less from a root-ed server where the hacker has full access to the raw database files. SQL injection is an attack technique where the hacker can ...


3

What is the best method for securing PHP scripts that contain database passwords? One common approach is to put these sort of details into an own file, which is not directly accessible through the webserver, e.g. something like a config directory outside the webserver's document root. You can always include this file whereever it is needed. If for ...


1

This feels more like a point of discussion, rather than a question. This is because there is no definitive answer to your question, merely conjecture. The best method for answering your question is to conduct a risk assessment. This will encompass your risk appetite and thus give a better indication as to which method is best suited to gathering and storing ...


0

No, its not inherently bad to store a malicious file, as long as no one can execute it. Anti-virus softwares do this all the time when they "quarantine" malware. Another possible problem that you can highlight to them is that a malicious user can upload illegal content on their service, for example, someone can upload child pornography there and it will ...



Top 50 recent answers are included