248 reputation
1210
bio website
location London, United Kingdom
age 22
visits member for 2 years, 8 months
seen Jul 2 at 11:51

Before posting in the SO please review SSCCE, With Regards!

Do The Simplest Thing That Could Possibly Work!


Mar
17
accepted How to appropriately secure a database using different db users
Feb
28
awarded  Critic
Feb
27
comment How to appropriately secure a database using different db users
I do agree on the points mentioned here, except with I'm not sure that separating by write and read would be worth it, as it will avoid the Bobby Tables case
Feb
27
awarded  Informed
Feb
26
asked How to appropriately secure a database using different db users
Sep
24
awarded  Autobiographer
Mar
15
awarded  Yearling
Feb
5
awarded  Nice Question
Jan
12
awarded  Famous Question
Oct
24
accepted ICO compliance and Google Cloud SQL
Oct
23
comment ICO compliance and Google Cloud SQL
Could you evaluate a little bit more about what should the 'contractual agreements' be? (I understand if you do not remember and would not recall on the statement, but it is easier for me to get it digested, as from time to time I do get very confused when it gets to legal stuff :) )
Oct
23
asked ICO compliance and Google Cloud SQL
Jul
25
awarded  Notable Question
Jul
24
awarded  Citizen Patrol
Jul
24
accepted PHP web application security
Jul
23
awarded  Editor
Jul
23
revised PHP web application security
added 466 characters in body
Jul
23
comment PHP web application security
@mgibsonbr yes the data is stored on a trusted server(the server the application is hosted) and the concerns are if an attacker could get access to the user data, and with lower priority is a user accesing other users data
Jul
23
comment PHP web application security
well I was thinking to use key and IV per user, so that the decryption of user information in case where an attacker has the data, not to be able to get all data with one try(meant to say, if he decrypts 1 entry). So my problem is with storing the Key and Vector for enc/dec. AFAIK if the keys are in the database it is useless to do the encryption, (the key is in the lock) a hard-coded key and vector are not an optionz cuz in case of a breach all data is exposed.
Jul
23
comment PHP web application security
as I mentioned in the comment to @AJ's answer the certificates will be created as an storage file, was thinking to use the certificates(certificates like those which are used in authentication for example *.pk12) and to use a part of their Footprints for encryption key and IV in CFB encryption.