221 reputation
128
bio website
location London, United Kingdom
age 22
visits member for 2 years, 2 months
seen Oct 28 at 21:22

Before posting in the SO please review SSCCE, With Regards!

Do The Simplest Thing That Could Possibly Work!


Sep
24
awarded  Autobiographer
Mar
15
awarded  Yearling
Feb
5
awarded  Nice Question
Jan
12
awarded  Famous Question
Oct
24
accepted ICO compliance and Google Cloud SQL
Oct
23
comment ICO compliance and Google Cloud SQL
Could you evaluate a little bit more about what should the 'contractual agreements' be? (I understand if you do not remember and would not recall on the statement, but it is easier for me to get it digested, as from time to time I do get very confused when it gets to legal stuff :) )
Oct
23
asked ICO compliance and Google Cloud SQL
Jul
25
awarded  Notable Question
Jul
24
awarded  Citizen Patrol
Jul
24
accepted PHP web application security
Jul
23
awarded  Editor
Jul
23
revised PHP web application security
added 466 characters in body
Jul
23
comment PHP web application security
@mgibsonbr yes the data is stored on a trusted server(the server the application is hosted) and the concerns are if an attacker could get access to the user data, and with lower priority is a user accesing other users data
Jul
23
comment PHP web application security
well I was thinking to use key and IV per user, so that the decryption of user information in case where an attacker has the data, not to be able to get all data with one try(meant to say, if he decrypts 1 entry). So my problem is with storing the Key and Vector for enc/dec. AFAIK if the keys are in the database it is useless to do the encryption, (the key is in the lock) a hard-coded key and vector are not an optionz cuz in case of a breach all data is exposed.
Jul
23
comment PHP web application security
as I mentioned in the comment to @AJ's answer the certificates will be created as an storage file, was thinking to use the certificates(certificates like those which are used in authentication for example *.pk12) and to use a part of their Footprints for encryption key and IV in CFB encryption.
Jul
23
comment PHP web application security
+1 for the note, it should always be kept in mind that no matter what the encryption used is, the basics should always be applied
Jul
23
comment PHP web application security
Well I think that the problem is the late time I wrote the question(an even l8er now) But my question was not that. I am experienced enough to be able to protect from CSRF, SQLInjection and etc. I was thinking of generating the certificates on registration and use part of the footprint of a certificate to encrypt the user's data. so the SHA1 or MD5 footprint could do as key and IV. and to remove them form the folders of the application. Please if you could make an edit to the question, please do cuz I see that it is awful, but at 4am I am a bit stuck .. Thanks!
Jul
23
asked PHP web application security
Apr
29
awarded  Popular Question
Dec
29
accepted Security comparsion of 3DES and AES