I've got information security as high as possible with my Flutter app so far with encryption and proper storage for data at rest as well as data in transit. With this question I'm only aiming for protecting data at rest.

If I did something like in this "sketch" below:

  1. Load data from persistent memory (also decrypt)
  2. Do something with the data immediately (load into list view or something)
  3. Immediately re-encrypt data in memory with different cryptography than used for persistent storage and re-store encryption keys in secure storage
  4. Repeat the process if data becomes required again
  5. Lastly, delete data from memory manually upon page exit or app kill (deleted data would always be encrypted first just in case)

As an FYI my software won't be too much of a resource pig so there shouldn't be a major issue with eating memory or processor time.

Would this be overkill or good practice? Or any other recommendations, help etc?

  • What is your threat model?
    – hft
    Jul 15, 2021 at 3:15
  • A threat model is way over my head, I'll leave that to the expert I hire to side-check my software before launch. Right now I am learning and I want to learn a high level of security in a simple sense. My users' data will be highly private and sensitive & if the app does well from a business standpoint, will include very high profile persons data. I am mostly concerned with memory dumps or unauthorized system access in this aspect of protection. From my research those attacks would be the most worrisome for data in use- as far as I've found.
    – RobbB
    Jul 15, 2021 at 3:37
  • 2
    Probably best to get this expert involved at the design stage.
    – hft
    Jul 15, 2021 at 3:55
  • But, based on your concern described in your comment it seems like this might be overkill if the attacker already has the ability to dump memory (from the running process?). It's hard to say for sure. Maybe someone else will be able to answer.
    – hft
    Jul 15, 2021 at 3:56
  • Advice taken, he will be involved when I begin the creation. dump memory (from the running process?) - this is very interesting, no matter how remote a possibility. It begs the question in my mind of such an attack. Is a memory dump a continuous stream of memory or an instantaneous executed command of one point in time?
    – RobbB
    Jul 15, 2021 at 4:06


You must log in to answer this question.

Browse other questions tagged .