759 reputation
1020
bio website
location
age
visits member for 2 years, 3 months
seen Jul 28 at 8:34

Dec
16
awarded  Notable Question
Oct
12
awarded  Popular Question
Sep
22
awarded  Popular Question
Aug
30
asked Requiring regular password change but storing previous paswords?
Aug
23
accepted Do you need to encrypt session data?
Aug
23
accepted Are there technical disadvantages in using free ssl certificates?
Aug
23
awarded  Constituent
Aug
20
accepted Signed request vs HTTP digest auth for API authentication?
Aug
20
accepted HTTP Basic auth password storage more secure than Digest auth
Aug
20
accepted Does truncating the cryptographic hash make it impossible to crack?
Aug
20
asked Are there technical disadvantages in using free ssl certificates?
Aug
20
comment Do you need to encrypt session data?
So to summarize, there's NO need for encryption if there's NO sensitive info in session data, whether on shared hosting or private hosting.
Aug
19
comment Do you need to encrypt session data?
Ok you mention personal / sensitive information, so if I'm not storing this kind of info (i.e., I only store loggedin = true), then there's no need for encryption?
Aug
19
comment Do you need to encrypt session data?
Thanks, BTW here's an example of the script I'm talking about zimuel.it/en/encrypt-php-session-data it's unclear what's his purpose. Maybe he's storing sensitive info in sessions? He stores the key in the user cookie and encrypted data remains in /tmp (or the designated session path). Regardless, my question is more on why is it necessary to encrypt it? For example, if I don't encrypt data and if /tmp was compromised, an attacker really can't do anything with it right as long as there is session hijacking prevention?
Aug
19
comment Do you need to encrypt session data?
@Polynomial That's exactly what I mean. Do you think it's necessary to encrypt it if you're not storing sensitive info in the session data?
Aug
19
comment Do you need to encrypt session data?
@curiousguy I am not sure what tmpfs is but /tmp is usually just a regular folder in windows or linux. More info about it here: php.net/manual/en/…
Aug
19
comment Do you need to encrypt session data?
@curiousguy What do you mean? If you mean /tmpthen /tmp is PHP's default session folder in a shared hosting environment.
Aug
19
revised Do you need to encrypt session data?
added 91 characters in body
Aug
19
asked Do you need to encrypt session data?
Aug
14
revised HTTP Basic auth password storage more secure than Digest auth
added 37 characters in body