Linked Questions

7
votes
5answers
4k views

Is storing sensitive data in files instead of a database safe?

Say I have a hypothetical PHP application which will store hashed passwords in a file in the same directory. At first, this seems like it would be very insecure, since one could guess at the name of ...
7
votes
7answers
9k views

What is the best way to securely keep clear passwords?

I'm working on a web project that will connect to a database. For that, I will have to store the login/password of that database user in clear (encrypted in a symmetrical way) in order to be able to ...
9
votes
5answers
10k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
17
votes
2answers
3k views

How to use AWS KMS securely?

I am investigating using AWS KMS (Amazon Web Services Key Management Service) to decrypt an encrypted symmetric key (i.e: envelope encryption). However, to use the KMS, I need to pass it my amazon ...
7
votes
3answers
4k views

Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?

It has been suggested in securing PHP article that using directive as below in htaccess is more secure than hardcoding it into your app: <VirtualHost ilia.ws> Include /home/ilia/sql.cnf </...
4
votes
4answers
2k views

Where to store a key for system wide encryption/decryption?

I have a web application where (among other things) customers can upload files and administrators can then download those files. The uploaded files are stored on ServerA and the web application used ...
4
votes
1answer
9k views

Need advices on API key & secret generation?

While working on a Java project using Spring-boot, Spring-security and JWT token, I need to provide access via API key and secret. After searching on Google for a while about key/secret generation, ...
4
votes
3answers
1k views

Is it secure to centralize database information?

I would know if it is secure to centralize database information into one file like this : db_infos.php: $server = "localhost"; $user = "root"; $password = "1234"; $database = "foo"; $table = "bar"; ...
3
votes
2answers
2k views

How to store an encryption key on shared hosting?

I am designing a simple online patient management system that is running on shared hosting. According to national regulation sensitive data should be encrypted when used online, so I have encrypted ...
1
vote
2answers
3k views

How can I safely store a password in a .class file?

I have some .java files containing some password variables, and these variables have values: String password = "xyz"; Now after run, when I open the .class file, it contains those passwords. How can ...
11
votes
1answer
4k views

Storing OAuth and other authentication tokens

We all know that when to store passwords, we should store it with one-way hash such as a variant of SHA, bcrypt or scrypt to prevent plain-text password leaks when the database is hacked. But what ...
1
vote
2answers
3k views

How to store an AES Key? an Initialization Vector(IV)?

I'm currently developing an authentication service for our company. I somehow understand how to store a salt used in hashing a password in that it should be stored together with the hashed password. ...
1
vote
1answer
2k views

Storing data encryption key in the DB. Safe or not?

I'm currently taking over a service and while looking through the DB, I noticed that we encrypt some of our data using a function in the DB where the encryption key is hardcoded in the DB function. ...
1
vote
1answer
1k views

Is it secured to store the encrypted key in the database (encrypted by other cipher)?

I want to improve the encryption flow used by my application. Today I use the AES cipher while its key and its IvBuffer are hardcoded in the code. I know it is not secured and I want to improve this. ...
0
votes
3answers
394 views

What benefit to use different encryption key (passphrase) for different customers?

When we store confidential information in our database, we encrypt it using AES. In addition, when customers install our product, they protect their machines using a firewall. Should we use different ...

15 30 50 per page