Linked Questions

7
votes
5answers
3k views

Is storing sensitive data in files instead of a database safe?

Say I have a hypothetical PHP application which will store hashed passwords in a file in the same directory. At first, this seems like it would be very insecure, since one could guess at the name of ...
35
votes
2answers
27k views

How should an application store its credentials

Context When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, ...
1
vote
1answer
128 views

Is it secure to store a cryptographic key in a class member variable?

Consider an application that runs locally on a Windows PC. The application uses a local folder for reading/storing encrypted data (i.e. images). A user logs in (authenticated from a local encrypted DB)...
16
votes
2answers
2k views

How to use AWS KMS securely?

I am investigating using AWS KMS (Amazon Web Services Key Management Service) to decrypt an encrypted symmetric key (i.e: envelope encryption). However, to use the KMS, I need to pass it my amazon ...
0
votes
2answers
180 views

Is it necessary to encrypt messages client side if using HTTPS?

I am creating a messaging service for an app I'm developing and right now the data flow is as follows: Send: message sent to server => message encrypted based on user's public key and signed using ...
3
votes
1answer
7k views

Need advices on API key & secret generation?

While working on a Java project using Spring-boot, Spring-security and JWT token, I need to provide access via API key and secret. After searching on Google for a while about key/secret generation, ...
8
votes
5answers
9k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
1
vote
1answer
149 views

How background services perform token based Api Authentication?

I am implementing JWT token based authentication for our WebAPI in order to restrict data access through the API (e.g. client sends username / password and the api provides a jwt token valid for x ...
1
vote
0answers
34 views

Securing data tokens [duplicate]

What is the proper way to save and access database and API credentials in my node js application? Currently I use a dotenv package and store them in a .env file. I am not uploading my code to github ...
1
vote
3answers
235 views

How strong should a database password be?

Seems like a trivial question, but I couldn't find other questions that address the following. So I'm simply asking, how strong would my (super user) database credentials ideally be? I simply figured ...
1
vote
1answer
157 views

How to store encrypted confidential user information in the database, which will need to be decrypted at runtime? [duplicate]

This Question has been reposted from StackOverflow according to the suggestion given in comments I am creating an application where I need to store client's information(Like their API Keys and API ...
0
votes
1answer
2k views

Php two-way encryption to mysql database [duplicate]

I would like to learn / know how other companies deal with the problem of storing the encryption keys. I want to encrypt the user's email address (and other sensitive information) but (because I want ...
0
votes
2answers
995 views

How secure is encrypting & decrypting strings with OpenSSL? [closed]

I am wondering how secure it is to encrypt and decrypt strings using OpenSSL using Salts and an Initialisation Vector. If the salt and initialisation vector are both going to be stored in a database ...
1
vote
1answer
276 views

which places are used to store the the encryption key? [duplicate]

So i have an encryption key which i will use to encrypt data or sign data with it. But in order make it possible to ensure the data integrity, i have to keep the key secret. So i thought of spliting ...
1
vote
2answers
2k views

How to store an AES Key? an Initialization Vector(IV)?

I'm currently developing an authentication service for our company. I somehow understand how to store a salt used in hashing a password in that it should be stored together with the hashed password. ...
2
votes
0answers
31 views

Which is better for storing private key in .NET - Windows application secure registry or encrypted configuration? [duplicate]

We are building an integration with a third party. We have decided to share a private key with the 3rd party app. What will be the best strategy to allow access for the key? Should the key be saved in ...
1
vote
0answers
45 views

Encrypt content on Azure without using KeyVault? [duplicate]

Need to store some content in Azure Blob Storage, and want to encrypt prior to storing it on Azure Blob (we don't want to rely on Azure storage encryption on-rest). The issue is we do not want to ...
1
vote
1answer
94 views

How to use encrypted internal strings and config? [duplicate]

I was reading the CIA leaked documents on wikileaks, I saw in their "best practices" section that it was advised to encrypt all strings and config information and to de-crypt in memory when needed. ...
1
vote
1answer
161 views

Alternative to storing passwords when dealing with integrations that only allow username/password authentication? [duplicate]

I'm working on an integration with an external service that requires per-user authentication, like Facebook for example, but unlike Facebook only allows username+password for this authentication. My ...
2
votes
1answer
93 views

Keeping software signing keys secure

I am creating an application that will automatically sign code with secure keys (.key). The app will run on Windows environment developed in .NET environment (C#). Signing is simple: source code + ...
1
vote
2answers
160 views

What is the Best Method to Store SQL Host, Username and Password for Multiple Databases?

I have a large project which has multiple web servers (one for each client), one application (for all clients), and multiple SQL databases (one for each client) as pictured below. . For security ...
53
votes
5answers
51k views

Standards for encrypting passwords in configuration files?

My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they don'...
1
vote
1answer
1k views

Is it secured to store the encrypted key in the database (encrypted by other cipher)?

I want to improve the encryption flow used by my application. Today I use the AES cipher while its key and its IvBuffer are hardcoded in the code. I know it is not secured and I want to improve this. ...
1
vote
2answers
2k views

How can I safely store a password in a .class file?

I have some .java files containing some password variables, and these variables have values: String password = "xyz"; Now after run, when I open the .class file, it contains those passwords. How can ...
5
votes
2answers
1k views

How to make Automated API calls which are at least minimally secure? [duplicate]

How do I go about writing scripts (for automation) in Powershell (and possibly even Python) that help me access APIs while keeping the credentialing information either secure IN the script and/or ...
1
vote
1answer
2k views

Storing data encryption key in the DB. Safe or not?

I'm currently taking over a service and while looking through the DB, I noticed that we encrypt some of our data using a function in the DB where the encryption key is hardcoded in the DB function. ...
0
votes
1answer
151 views

Storing passwords for personal app [duplicate]

I am currently writing a script on a raspberryPi (in python) to automate some tasks in online accounts. While some of these online accounts have nice APIs I can use, others do not and I have to resort ...
4
votes
4answers
2k views

Where to store a key for system wide encryption/decryption?

I have a web application where (among other things) customers can upload files and administrators can then download those files. The uploaded files are stored on ServerA and the web application used ...
2
votes
2answers
356 views

Using a hash in place of user data

I'm storing client data and they are sensitive about privacy and security of the data. In some cases, I don't need the actual data, but could work with a hash of the data. For example, in the case of ...
1
vote
0answers
165 views

How do I securely encrypt and store database encryption keys? [duplicate]

I have a database with encrypted information, and want to encrypt each entry with a different key. Then I want to store the encrypted keys in another database. I know I have to encrypt the keys before ...

15 30 50 per page