Questions tagged [databases]

Security related aspects of databases and database access.

Filter by
Sorted by
Tagged with
132
votes
3answers
14k views

Is HostGator storing my password in plaintext?

I want to bring this up to HostGator, but want to verify my suspicions before making a big fuss. I asked a customer care representative to help me add an SSL certificate to a site I host with them. ...
78
votes
7answers
50k views

SQL injection — why isn't escape quotes safe anymore?

Raw SQL When you're writing SQL -- for anything that takes human input really, a lot of things have been done to avoid the injection. Everyone that's heard of SQL injection knows that (I'm going to ...
73
votes
10answers
44k views

Why Disallow Special Characters In a Password?

The culprit in this case is a particular (and particularly large) bank that does not allow special characters (of any sort) in their passwords: Just [a-Z 1-9]. Is their any valid reason for doing ...
72
votes
4answers
77k views

Is it generally a bad idea to encrypt database fields?

I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that ...
64
votes
7answers
16k views

Is it safe/wise to store a salt in the same field as the hashed password?

In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"): $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
62
votes
2answers
7k views

Why is credit card information not stolen more often?

Nowadays there are a lot of hacked websites with stolen login information. In many cases the website states that no credit card data and/or payment information was stolen. Why is that? What I assume ...
61
votes
8answers
13k views

How do you explain to experts that a database server should not reside in the DMZ?

Our security experts, database administrators, network team and infrastructure team are all saying it's OK to have the database server located in the DMZ along with the HTTP server and middle-ware ...
52
votes
13answers
8k views

Sequential identifying string that can't be reverse engineered (the “invoice number” problem)

Let's say I operate a website where you can create cat pictures. I give every cat picture a unique identifier so that it can be shared on social media with http://catpictures.com/base62Identifier. I ...
41
votes
8answers
8k views

Does password-protecting a database living next to the application add any security?

I've seen setups where a password-protected database resided on the same server as an application holding the credentials to said database in plain text. What are the benefits of such a setup over a ...
38
votes
4answers
24k views

avoid hitting DB to authenticate a user on EVERY request in stateless web app architecture?

Summary Once a user logs into a web site and his username/password credentials are verified and an active session is established, is it possible to avoid hitting the DB for each and every request ...
36
votes
9answers
14k views

Can I conceal which account in my database is the admin account, so an attacker won't know which hash to crack first?

Say I had a database that looked like this: Name Password hash (bcrypt) Status ------------------------------------------------------------------------------...
36
votes
4answers
7k views

Is using a DB prefix for tables more secure?

I see systems that use database prefixes. Some call it a security feature. Some call it a way to have multiple installations in one database. The main pro is that it's harder to guess the whole table ...
34
votes
4answers
5k views

Is it okay to reveal database's table names?

I'm developing web application that uses database. I have to do some operations which needs database table names and db table schema. Will it be secure if I send this kind of information to client ...
34
votes
3answers
28k views

Is it safe to store the database password in a PHP file?

My connection.php file stores the credentials to connect to the database: <?php $objConnect = mysql_connect("localhost","username","password"); mysql_select_db("selectDB", $objConnect); ?...
28
votes
2answers
8k views

MySQL Server Hardening

Following the hardening theme.... What are some best practices, recommendations, required reading for securing MySQL.
28
votes
3answers
19k views

How to secure a MongoDB instance? [closed]

Does anybody have experience with securing/hardening MongoDB server? Check lists or guides would be welcome.
27
votes
12answers
8k views

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql_real_escape_string() function?
27
votes
6answers
7k views

Filter user input before the database or upon display?

Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
26
votes
4answers
4k views

Secure Implementation of Password Database

Disclaimer I am not a security professional, just a programmer trying to do my best. Additionally, this is my first post to this community so I appologise if this question is too broad. The ...
24
votes
4answers
9k views

Is Postgres password-based authentication secure?

According to Postgres's documentation, Postgres's password authentication method uses MD5 hashing to secure the password: The password-based authentication methods are md5 and password. These ...
24
votes
7answers
21k views

How can I avoid putting the database password in a perl script?

I have a cronned Perl script that connects to our database and does various kinds of lookups and integrity checks. The original script was written by someone long ago. My job is to make some changes ...
23
votes
4answers
34k views

Is “Why Should You Avoid AES In MySQL?” true?

From a 2012 Smashing Magazine article quite a bold statement is made to avoid AES in MySQL itself. Or as they put it "Why Should You Avoid AES In MySQL?". However, if you search for SQL encryption, ...
22
votes
3answers
5k views

Direct access to databases

Some of the non-DBA workers like Developers (for crises handling), Fraud (with read permissions only) analysts (with read permissions only) and a few more that's needs direct access to databases to ...
22
votes
4answers
28k views

What type of attacks can be used vs MongoDB?

I'm starting to learn MongoDB and was curious if it was susceptible to some type of injection attack similar to SQLi. Due to the nature of the DB, I don't think you can inject into it but... What ...
21
votes
6answers
24k views

Would removing spaces in a string protect against SQL injection?

I was curious if it's possible to protect against an SQL injection attack by removing all spaces from an String input? I have been reading up on SQL Injection at OWASP, but they don't mention anything ...
21
votes
4answers
26k views

When is it appropriate to SSL Encrypt Database connections?

Let's say I have a web server I setup, and then a database server. However, they are communicating locally and are behind firewall. In my opinion, no SSL is needed here right? The only time to use ...
20
votes
6answers
43k views

What is the best practice for placing database servers in secure network topologies

I have a classic DMZ architecture: My webserver is placed in the DMZ. The webserver needs to communicate with a database server. This database server is the most critical component of my network as ...
20
votes
3answers
2k views

Knowing when there has been a data breach from your database

How do companies know when there has been a data breach? For example, do they monitor event logs for login audits or do they wait until a paste is made of their data in a pastebin type site? Is it ...
20
votes
4answers
4k views

Do stored procedures prevent SQL Injection in PostgreSQL?

Is it true that stored procedures will prevent databases from being injected? I did a little research and I found out that SQL-Server, Oracle and MySQL are not safe against SQL injections if we only ...
20
votes
4answers
1k views

Protecting Health Care Database

I am doing a minor project on information security in which i am implementing techniques listed below to protect a HEALTH CARE database. Preventing SQL Injection (using prepared statements,validating,...
19
votes
10answers
5k views

Is this safe to display MySQL query error in webpage if something went wrong?

Is it safe to display the detailed query in the error webpage with the below details? **INSERT statement conflicted with the FOREIGN KEY constraint "ABC". The conflict occurred in database ** The ...
19
votes
4answers
3k views

Is this verbose error message on the DOT website a security issue?

I was looking for a form on the US Department of Transportations website, and I came to a page that gave me an error, with a full debug report and stack trace. Hopefully, you can get the same result ...
18
votes
4answers
3k views

What can an attacker do if he knew my database credentials?

If an attacker knows my database username and password, what can he possibly do if he doesn't have access to my server? Let's say my database is using Microsoft SQL Server. Is there a way he can use ...
18
votes
3answers
5k views

Data Encryption by Application vs Data Encryption in Database

For a GDPR (EU General Data Protection Regulation) implementation, I need to encrypt some personal information. There are two ways we can encrypt the data: Let the web application have the sole ...
18
votes
2answers
17k views

Where should I store OAuth2 access tokens?

I am building a REST API back-end, for a mobile application. In our design choice, we decided to let OAuth2 providers handle the login security. However, I am not sure what the best practice is for ...
18
votes
2answers
17k views

Practices for storing username/password in Web applications

I have read the following question: Storing password in Java application but I don't find the answers useful for my case. So here is my question somehow related to that. I have a Java Web application ...
17
votes
3answers
3k views

Exposing database fields names in HTML

I quite often see opportunities to optimise server-side code if HTML form names are exactly the same as the database field names they eventually update. The drawback obviously is that this is ...
17
votes
5answers
6k views

Is sending plaintext passwords to a SQL Server database a security risk?

I have a database which has stored procedures which take plaintext passwords. It hashes them and inserts them into the DB. If an attacker has access to the DB connection, it is possible to intercept ...
17
votes
2answers
9k views

Secure database password stored in an env variable

I need to somewhere store my DB password on my production environment to access the DB. At the moment the prod system is deployed in the cloud, so is the DB. The password, the username and some other ...
16
votes
5answers
7k views

KeePass security local malware

Can a malware that infected your local computer compromise a KeePass database stored locally in any way? If yes, what's the point for KeePass to have such strong security mechanisms if it cannot ...
16
votes
5answers
467 views

Business founder wants access to database but has no DB skills

Someone asked me to create a site for their online business which I did, handling a lot of the development myself. After I created my account on the site I told my employer "Hey, the site is ready you ...
16
votes
6answers
25k views

xp_cmdshell: should it ever be used?

Can xp_cmdshell ever be used safely within a stored proc and are there any situations for which there really is no other option? In other words, should its usage within a stored proc always be flagged ...
16
votes
3answers
5k views

When using AES and CBC, can the IV be a hash of the plaintext?

[Originally on programmers.stackexchange.com with title: Can you encrypt with AES+CBC and search the encrypted data] Basically, I'm going to go with Advanced Encryption Standard with either Cipher-...
15
votes
4answers
87k views

How to know which database is behind a web application?

I've read that different databases (mysql, sql server,...) have different vulnerabilities and that they are vulnerable to some specific sql injections. When attacker try to perform a database attack ...
14
votes
4answers
4k views

Is this passwordless system secure?

A person has a form that asks for a name and password. The password is sent to the server where a hash is created from hashing the name and password. This hash is converted into a number using the ...
14
votes
3answers
12k views

PostgreSQL Security Audit

Could anyone provide a good resource or check-list for a security review of PostgreSQL?
14
votes
1answer
2k views

Is there a list of default, standard or third-party “users” for Oracle?

When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle. Additionally, third-party software often has its own set of schemas/...
13
votes
3answers
3k views

Would encrypting a database protect against a compromised admin account?

I was discussing with someone ways to prevent data disclosure from a compromised admin account on a database server. The other person proposed encrypting the data at rest within the database. It ...
13
votes
3answers
7k views

What are the security benefits to a separate user database?

In the app I'm writing I separated the user and main databases a long time ago for "security reasons". However its getting harder and harder to justify the overhead and the difficulty of managing such ...
13
votes
3answers
861 views

Privacy violation even when queries with too few results are rejected

I was reading a Computing security book1 and saw a question regarding database security and privacy. I can't quite figure out the answer, so I thought I will ask here. One approach to ensure ...

1
2 3 4 5
14