255 reputation
bio website lebenplusplus.de
location Hanover, Germany
visits member for 3 years
seen Jul 22 at 9:02

comment User data encryption/decryption in a database (PHP)
If the SQL injection leads to full access of the whole server then you're right. If the SQL injection just exposes the encrypted contents of the fields and the key is stored somewhere else on the server (your application code, some file or in shared memory), the data is still secure.
comment Is it generally a bad idea to encrypt database fields?
If the web app is compromised, what's stopping the attacker from sending crypttext to the crypto service and getting plain text back? No need for a key there.
comment How to anonymize contributors while still keeping attribution?
I was always imagining "If someone can steal the database", he will most likely be able to steal any file on the computer. So I'm quite reluctant to just encrypt the info and keep the decryption key on the same machine. Any tips on how to keep them on the same machine in a secure fashion?
comment Which hard disk encryptions schemes are tied to the original hardware?
I don't know and I don't want to. I thought there might some schemes that do it, especially when they use the TPM. That's why I asked this question - just to be sure I can access my data when the rest of the computer is gone.
comment Which hard disk encryptions schemes are tied to the original hardware?
And this software is not tying the encryption to some hardware id, right? The passphrase protects the encryption key which is stored somewhere on the hard drive?
comment How to Securely Implement a “Remember Me” Feature?
Thanks. I've expanded my answer and retracted my question. Comments are welcome.
comment Is sending password to user email secure?
Why hash the token in the DB? What attack does that protect against?