Tag Info

Hot answers tagged

40

Summary: it was marginally better on older drives, but doesn't matter now. Multiple passes erase a tree with overkill but miss the rest of the forest. Use encryption. The origin lies in work by Peter Gutmann, who showed that there is some memory in a disk bit: a zero that's been overwritten with a zero can be distinguished from a one that's been overwritten ...


16

Back then, tapes were just binary data on a magnetic film, with no "hidden" channels or out-of-band capabilities. Manufacturers that claimed to make tape-to-tape recording impossible often just made the tape look different, to deter would-be pirates. A regular tape recorder module was usually used to read them, so making "special" tapes couldn't really work. ...


14

The only NIST approved method to securely erase a hard drive is by utilizing the secure erase internal command - documented at the Center for Magnetic Recording Research (CMRR) - and that is what everyone should be doing. It is an ATA command, and covers (S)ATA interfaces. After that, you can optionally degauss the drive to erase the firmware itself. Lots ...


12

From Wikipedia: An initialization vector has different security requirements than a key, so the IV usually does not need to be secret. However, in most cases, it is important that an initialization vector is never reused under the same key. For CBC and CFB, reusing an IV leaks some information about the first block of plaintext, and about any common ...


11

The most sensible approach is to assume you cant rely on their privacy - it isn't their responsibility, although there are some services whose selling point is securing this data. If you take that stance, as long as you encrypt all data before it goes to the cloud you can be safe (decide on what level of encryption you need in order to be safe) This ...


10

From a theoretical standpoint the idea of total drive destruction may be the only way of destroying data on a hard drive fully. From a practical standpoint, I've not seen any evidence that it's possible to recover meaningful data from a standard hard drive (ie, not taking SSDs or other devices that use wear levelling or similar technologies) after a once ...


10

If I recall correctly, some games even managed to defeat direct tape-to-tape copying. In principle, this couldn't be possible, as the audio track on the tape contained all the information required. In practice, by using a custom loader which operated on data files encoded at a higher frequency than the standard Spectrum data files, low-quality ...


9

I would say no its not suitable for storing criticial information, From the sound of their terms Google essentially owns everyting you upload as well as anything derivitive of your data as well. Here is an excerpt from the verge.com explaining the differences of the 3 major players, notice Google is very liberal with what they can do with your data. ...


9

Keeping information in RAM can enhance security, if done right and if the requirements allow it. I'm going to show two security architectures where keeping the data in RAM provides a security benefit. These are fairly specific scenarios; most of the time keeping data in RAM doesn't help. Protection against file dump attacks Consider a web application that ...


9

I will try to answer your question as specifically as possible. I contacted Intel tech support to ask them exactly this question: Is the AES key on the Intel 520 encrypted with the ATA password. After weeks of back and forth, I finally received an explicit confirmation from them. I quote: Yes, ATA password is used to encrypt the encryption keys stores ...


9

If you're talking about a Windows desktop application, you should use the CryptProtectData API, which stores the credentials in protected memory regions and encrypts them with a key that is part of the user profile. This is the standard protection mechanism for Windows applications. On Linux you could look into using the GNOME keyring or KDE wallet, and OS ...


7

Consider this from an Information Management or Information Assurance question rather than an Information Protection question. To the question if a service provider's level of security is "safe" (sufficient and appropriate), the answer is YES and NO - depending on the level of protection the specific information requires. My suggestion is you create three ...


7

Create a new user. Give that user access rights to only the folders you want to share. You can use the File and Folder Permission options on Windows, and simple chmod on Linux. Run your application (Dropbox, for example) under that user. You can use runas on Windows, and sudo -u on Linux. Please note that you might have to allow access to other folders ...


6

They are feeling comforted by a false sense of security by obscurity If someone gains root access to your machine then they can see all the contents of everything that any application can. Encryption won't help if the application has to be able to work with the plain text since the application will have to store the keys somewhere. Hiding those keys is ...


6

There is a well-known reference article by Peter Gutmann on the subject. However, that article is a bit old (15 years) and newer harddisks might not operate as is described. Some data may fail to be totally obliterated by a single write due to two phenomena: We want to write a bit (0 or 1) but the physical signal is analog. Data is stored by manipulating ...


6

Do you need to erase the data, or do you need to persuade other people that the data has been erased? (I will only talk about 'entire disk' wiping; I'm not talking about wiping single files or slack space.) As far as I am aware there is no software package that claims to be able to recover data that has had a single overwrite. There are no companies that ...


6

Never hardcode passwords or crypto keys in your program. The general rule of thumb is: the only credentials you should store on a user's machine are credentials associated with that user, e.g., credentials that enable that user to log into his/her account. You should not store your developer credentials on the user's machine. That's not safe. You have to ...


6

There is no hard disk drive, or a solid state drive, or any other non-volatile computer memory on the market that would have self-destruct capabilities and a casual customer could buy. There's also a good reason for this. Let's, as an example, see what a military grade RunCore's InVincible SSD does: ...


6

Well fairly obviously what happened was not ideal security pracitce, as the agent you spoke to now knows (if they did not before) your username/password. In terms of storage it would be speculation to say they held it in clear text. That is one possibility given what you've said. However if they asked for your whole password then it could be that the ...


5

As others have mentioned, general-purpose cloud storage providers, like Microsoft, Google, Apple, and DropBox are not completely safe, since although they encrypt your files, they have copies of the keys (needed so they can index your files for search purposes). And as Rory points out, you can make this super-secure pretty easily: encrypt the backups ...


5

Yes, TrueCrypt volumes look like random data. This is mentioned in the Plausible deniability section of the TrueCrypt FAQ. The FAQ even mentions that having just erased a disk is an excuse for having a volume full of random data. I hate to call it a plausible excuse because as a rule people don't keep such volumes around. If your disk is seized and found to ...


5

No. The API keys need to be stored in cleartext. They are not passwords: they are cryptographic keys. These keys are used for things like authenticating requests (using SHA1-HMAC). The server needs to know the crypto key to apply the cryptographic algorithms. Therefore, the API key needs to be stored in cleartext on the server. If the server stored ...


5

Hashing is not storage; it irreversibly destroys data. We can get away with calling password hashing as "password storage" because when we actually need the password, we have a handy human operator to type it in. Indeed, when we hash the password we do not store the password, but only a token sufficient to verify the typed-in password. An API key must be ...


5

In the general case I would agree with you that cloud services are no more inherently risky than e-mail providers. Any time you store data with a 3rd party there are security risks, especially if you're using a consumer grade service which doesn't have things like contracts in place where you can specify security/audit requirements. I'd say that there's a ...


5

EEPROMs work by storing charge in floating-gate transistors. Think of these transistors like tiny capacitors that leak extremely slowly (typically with retention lifetimes of 10+ years), except with the added provision that you can tell whether it's charged or uncharged. Programming one simply involves feeding it a power source and pulling the gate to high ...


5

Something like this may be of use, but your best bet would be to customize it using a 3G modem wired up internally that's 'always on' so you can remote kill-switch it. I remember seeing, years ago, a couple of demo units of hard-drives for servers where if they were removed without authorization, the would inject a tube of magnetic particles and sand into ...


5

Deduplication works on detection of identical files or blocks of data. Such duplicates occur only with negligible probability in random data, and properly encrypted data ought to be indistinguishable from randomness. Encryption is there to ensure confidentiality and this includes, in particular, hiding from any eavesdropper whether two source data files are ...


5

Unfortunately, we can only speculate. Given the very limited information we have about the customer service representative's abilities with regards to your password, there are several possibilities. Data storage method aside, the customer service representative needed one of two things to be able to verify your password: The ability to actually see the ...


5

There is an interesting point in your question: I thought about storing his password on his computer, and getting the web page to send it to me. I don't think that would make them feel safer though. Do you want the users to be safe, or to feel safe ? That's not the same thing. If you store the password on your server, you become responsible for it. ...


5

If your computer is able to use the API without a password, then the information has to be stored somewhere on your system. The point of storing it in the environment variable is to make it so that you don't check it in to the version control along with the source, however really, the ideal would be to use something like a HSM or TPM to store the API key in ...



Only top voted, non community-wiki answers of a minimum length are eligible