Linked Questions

53
votes
5answers
51k views

Standards for encrypting passwords in configuration files?

My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they don'...
35
votes
2answers
27k views

How should an application store its credentials

Context When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, ...
16
votes
2answers
2k views

How to use AWS KMS securely?

I am investigating using AWS KMS (Amazon Web Services Key Management Service) to decrypt an encrypted symmetric key (i.e: envelope encryption). However, to use the KMS, I need to pass it my amazon ...
11
votes
1answer
4k views

Storing OAuth and other authentication tokens

We all know that when to store passwords, we should store it with one-way hash such as a variant of SHA, bcrypt or scrypt to prevent plain-text password leaks when the database is hacked. But what ...
8
votes
5answers
9k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
7
votes
5answers
3k views

Is storing sensitive data in files instead of a database safe?

Say I have a hypothetical PHP application which will store hashed passwords in a file in the same directory. At first, this seems like it would be very insecure, since one could guess at the name of ...
7
votes
7answers
7k views

What is the best way to securely keep clear passwords?

I'm working on a web project that will connect to a database. For that, I will have to store the login/password of that database user in clear (encrypted in a symmetrical way) in order to be able to ...
7
votes
3answers
4k views

Is it a secure way to declare DB parameters in htaccess rather than in a PHP file?

It has been suggested in securing PHP article that using directive as below in htaccess is more secure than hardcoding it into your app: <VirtualHost ilia.ws> Include /home/ilia/sql.cnf </...
5
votes
2answers
1k views

How to make Automated API calls which are at least minimally secure? [duplicate]

How do I go about writing scripts (for automation) in Powershell (and possibly even Python) that help me access APIs while keeping the credentialing information either secure IN the script and/or ...
4
votes
3answers
1k views

Is it secure to centralize database information?

I would know if it is secure to centralize database information into one file like this : db_infos.php: $server = "localhost"; $user = "root"; $password = "1234"; $database = "foo"; $table = "bar"; ...
4
votes
4answers
2k views

Where to store a key for system wide encryption/decryption?

I have a web application where (among other things) customers can upload files and administrators can then download those files. The uploaded files are stored on ServerA and the web application used ...
3
votes
2answers
2k views

How to store an encryption key on shared hosting?

I am designing a simple online patient management system that is running on shared hosting. According to national regulation sensitive data should be encrypted when used online, so I have encrypted ...
3
votes
1answer
7k views

Need advices on API key & secret generation?

While working on a Java project using Spring-boot, Spring-security and JWT token, I need to provide access via API key and secret. After searching on Google for a while about key/secret generation, ...
2
votes
1answer
776 views

What is the best way to protect an encryption key? [duplicate]

I am using few secret keys to encrypt sensible date. What is the best way/place to protect the keys ? In a file located on my server ? Within the SGBG databse itself ? Or ... ?
2
votes
3answers
267 views

How should SSL traffic be treated once it has been terminated?

Ideally, how should SSL traffic be treated once it has been terminated at an SSL appliance especially if the traffic contains sensitive information like personal financial information before it's ...

15 30 50 per page