1

I have a question about implementing user password-based encryption in a database injunction with the Social Login feature. User private data in my database should be encrypted in order to provide security at rest, and for that, I'm planning to use a user password-derived key.

Also, my application will need the Social Login function (Google, Facebook, etc). In the case of user registration through the Social Login, he will not provide a password to encrypt with (It is required not to complicate user registration, so I can't request a password myself). There are my thoughts:

  1. Use some "default" password, defined in the application server (bad, in case of application server breach it will be hacked immediately)
  2. Derive password from some info, provided by Social Login. User Id maybe? (bad, it is public information)

So, my question is - what can I use to encrypt user data in the case of Social Login registration?

4
  • 2
    You explain why you want to have such encryption in general but not what it should protect from ("security at rest" is not a threat description). If you aim is to derive the encryption key from something only the user knows (i.e. password) then you definitely need something only known to the user - and social login does not provide this to you. Oct 17 at 20:51
  • Doesn't the system need to read the private data? Or it is only relevant to the user?
    – kelalaka
    Oct 17 at 20:53
  • 1) What will you do if user changes password? 2) Think of Kerckhoffs's principle: You should assume that an attacker know everything about the user except the password and will be able to derive the same password as you.
    – mentallurg
    Oct 17 at 21:17
  • @mentallurg the first one easy with the usual Key Encryption key
    – kelalaka
    Oct 17 at 21:58
2

Simply Ask the User

Ask them if they would like to encrypt their data with a password or private key. If a user has registered with you directly, instead of some third-party authentication service, you can also offer to encrypt with the user password.

You could also hide this in a settings menu. Users who don't know what that means or don't care won't be bothered by it, while more security conscious users will likely go the extra way.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.