0

I would like some expert insight. I want to know what my vulnerabilities for this model are.

This is a demo project that I will be following in my production app if all works out securely. My production app will include hybrid encryption for ALL user-sensitive data. Nothing sensitive will ever be stored on the server unencrypted. I know I lose query capabilities but that's not the intention of this post. I solely and only want to know the vulnerabilities (if any) of this model below + hybrid encryption. I'm using Parse & Back4App.

My main concern (possibly paranoia) is unauthorized access causing data corruption. So, using ACLs in this way plus encryption...

What I’m doing is having users share their user ID via the server and store it locally for a list of authorized users in a group. Authorized users' ACLs will always write to each crud action.

Is this method of using ACLs vulnerable in any way?

Improve this question
3
  • Okay point taken. Thing is, I'm not a formally trained engineer like yourself. So I simply wanted to know if "what I'm doing above" has any security vulnerabilities. I will try me best to adjust my post for this. I like to keep things simple, not easy when the terminology, techniques and other aspects of the technical trade aren't fully known as a formal art.
    – RobbB
    Jul 14, 2021 at 4:39
  • @RobbB In that specific case, I don't really understand the "authorize", "unauthorize" thing. Also it could be a good idea avoiding including your "api keys" and using gibberish instead to make sure hackers won't be tempted to try these against your domain.
    – dbrrt
    Jul 14, 2021 at 4:59
  • My apologies, I probably should have taken that out for the post. Thats just me gaining my own subjective reality on how the ACLs work with session tolken vs without. Yes I will have to look into how to hide the API keys for the production app if thats possible with Parse. But good to know thats an important area to secure, thanks!
    – RobbB
    Jul 14, 2021 at 5:18

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.