250 reputation
27
bio website lebenplusplus.de
location Hanover, Germany
age
visits member for 2 years, 3 months
seen Oct 16 at 9:11

Jun
19
comment User data encryption/decryption in a database (PHP)
If the SQL injection leads to full access of the whole server then you're right. If the SQL injection just exposes the encrypted contents of the fields and the key is stored somewhere else on the server (your application code, some file or in shared memory), the data is still secure.
Jun
19
comment Is it generally a bad idea to encrypt database fields?
If the web app is compromised, what's stopping the attacker from sending crypttext to the crypto service and getting plain text back? No need for a key there.
Jun
18
comment How to anonymize contributors while still keeping attribution?
I was always imagining "If someone can steal the database", he will most likely be able to steal any file on the computer. So I'm quite reluctant to just encrypt the info and keep the decryption key on the same machine. Any tips on how to keep them on the same machine in a secure fashion?
Jan
30
comment Which hard disk encryptions schemes are tied to the original hardware?
I don't know and I don't want to. I thought there might some schemes that do it, especially when they use the TPM. That's why I asked this question - just to be sure I can access my data when the rest of the computer is gone.
Jan
29
comment Which hard disk encryptions schemes are tied to the original hardware?
And this software is not tying the encryption to some hardware id, right? The passphrase protects the encryption key which is stored somewhere on the hard drive?
Jan
4
comment How to Securely Implement a “Remember Me” Feature?
Thanks. I've expanded my answer and retracted my question. Comments are welcome.
Aug
2
comment Is sending password to user email secure?
Why hash the token in the DB? What attack does that protect against?