I have a question about implementing user password-based encryption in a database injunction with the Social Login feature. User private data in my database should be encrypted in order to provide security at rest, and for that, I'm planning to use a user password-derived key.
Also, my application will need the Social Login function (Google, Facebook, etc). In the case of user registration through the Social Login, he will not provide a password to encrypt with (It is required not to complicate user registration, so I can't request a password myself). There are my thoughts:
- Use some "default" password, defined in the application server (bad, in case of application server breach it will be hacked immediately)
- Derive password from some info, provided by Social Login. User Id maybe? (bad, it is public information)
So, my question is - what can I use to encrypt user data in the case of Social Login registration?