Questions tagged [databases]

Security related aspects of databases and database access.

Filter by
Sorted by
Tagged with
13
votes
4answers
10k views

What is the right way of storing database connection strings from the security point of view?

What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
12
votes
3answers
29k views

How to read the key3.db file?

The file key3.db contains the key that is used to encrypt the Firefox passwords stored in logins.json file. I don't use master password in Firefox, but according to this article, my passwords are ...
12
votes
3answers
2k views

How do poor-quality initialization vectors affect the security of CBC mode?

(If the consensus is that this question belongs on crypto, rather than here, please feel free to [tell me to] migrate it.) From what I have read (looking specifically at AES in Cipher Block Chaining ...
12
votes
5answers
3k views

Encrypting IP addresses in a MySQL database

I'd like to encrypt IP addresses in my MySQL database, with the following constraints: Does not need to be resistant to attackers that can execute queries. Must be resistant to attackers that have ...
12
votes
3answers
2k views

Is it preferable to perform encryption using database functions or code?

Several databases I am familiar with provide functions or modules for encryption. Examples include dbms_crypto for oracle databases and built-in functions for MySQL. Most of the commonly used ...
12
votes
3answers
308 views

Different MySQL Users Security Benefits

Anyone with a brain cell knows that using a user that isn't root/dbo/etc adds a lot to security and how effective SQL injection attacks can be. I'm wondering if taking that idea a step further is a ...
11
votes
4answers
5k views

What's more secure? Hard coding credentials or storing them in a database? [duplicate]

I wonder which of these things is more secure. Imagine hard coded credentials, similar to this: if user.Equals("registereduser") && (password.Equals(encryptedpassword)) { Give access to ...
11
votes
5answers
4k views

What are the likely threats to a public-facing DB instance?

Quick intro: Small company, VERY limited resources. I pretty much do everything including take out the trash. We've been running an instance of MySQL internally for years and it's worked OK, but I ...
11
votes
4answers
14k views

Are MySQL's database files encrypted?

I'm trying to securely store user credentials in a MySQL database which is hosted on a different server than the application (the communication between the two is secure). I have initially assumed ...
11
votes
2answers
2k views

What are the SQL-injections issues of parameterized queries?

I've written some code to generate an SQL query in ASP classic. I'm not sure if it's secure or not: Set adoCon = Server.CreateObject("ADODB.Connection") adoCon.Open "Provider=Microsoft.Jet.OLEDB.4.0; ...
11
votes
2answers
6k views

Encrypting with Mongo

How can I achieve the following goals? All compute and storage to be located in the cloud. Encryption in transit of all data between web nodes and db nodes running MongoDB. How to set up tunnels? ...
10
votes
4answers
3k views

How to upgrade the hashing method of a live database without compromising security?

I'm working on an Intranet project that is accessible from the outside. The password are stored in a Sql Server database in the normal Hash and salt method. The problem lies in the hashing algorithm. ...
10
votes
3answers
6k views

Security/Malware implications of storing data in a BLOB as opposed to the file system

From a programming perspective, there has long been a debate over whether to store files in a BLOB or Binary field in a database, or on the file system. The debate always seems to center around ...
10
votes
3answers
45k views

Where/How is an ODBC password stored when 'saved' in Access?

I have been working on a program that uses MS Access and ODBC to connect to an SQL server. One of the requirements is that the user need not know the password for the connection to the SQL server, so ...
10
votes
2answers
4k views

Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code

Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality. Apart from the generic arguments about 'security through obscurity' are there ...
10
votes
2answers
2k views

Online SQL Server database for a Business app. Security considerations

A business application works with a SQL Server database. A SQL Server 2008 is installed on one of the computers of the local network. Technically this app works OK if the server computer with the SQL ...
10
votes
2answers
1k views

Why java.sql.ResultSet.getString is an Information Leakage vulnerability

Recently I started using LAPSE+ for static code analysis and it kept on pointing java.sql.ResultSet.getString as an Information Leakage. The ResultSet is properly closed after its usage. LAPSE+ does ...
9
votes
3answers
7k views

Client-side BCrypt, store salt and hash separately in MySQL database [duplicate]

I’m developing an Android app with a MySQL database for storing user login credentials. I’m using jBCrypt for hashing passwords before storing them in the database. On registration, the password is ...
9
votes
3answers
5k views

Risk of configuring MySQL for remote access with a dynamic IP address?

I'm looking to make a MySQL database on a VPS, accessible to my home PC through cPanel. cPanel wants the domain name or IP address of the remote machine. However, with standard DSL, I have a dynamic ...
9
votes
1answer
2k views

How does Google save our passwords on their server?

My friend recently told me that: Google doesn't have our passwords saved on their database. Instead they put our password when typed on browser, through an algorithm and it'll produce a unique ...
9
votes
2answers
2k views

How dangerous are direct references to database keys?

An OWASP note suggests that direct object references are considered insecure in some contexts. They defined "direct object reference" as follows: “A direct object reference occurs when a developer ...
9
votes
4answers
972 views

Worthwhile from security standpoint to limit database server user for ASP.NET website to only EXECUTE on stored procedures?

I know that obviously we must avoid sql injection attacks through user input validation and parametrized queries. There's already a firewall in place on the database server to limit remote ...
9
votes
5answers
2k views

Should I authenticate user on every request?

I'm working on a social network using Vue.js on frontend, and Node/Express on backend. To store user sessions I'm using Redis. I'm wondering if I should hit Redis everytime user requests content, or ...
9
votes
1answer
1k views

Employer stores plain text personal data in a 'data warehouse' [closed]

I'm unsure if I have posted this in the correct community but the organisation I am currently working for currently uses an SQL 'data warehouse' which contains a bunch of tables from various sources, ...
9
votes
3answers
9k views

Is AES encryption vulnerable?

I was reading weaknesses in AES encryption. Unfortunately, I have a website that uses AES: Its database is almost entirely AES encrypted. Is there a real threat? Would it be worth to refactor the web ...
9
votes
2answers
10k views

Building a web app with encrypted MySQL database entries?

I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be ...
9
votes
1answer
2k views

How to make SQL injection in PostgreSQL's tsquery?

I think there is SQL injection vulnerability in an application I'm testing. This is seen when I enter malformed parameters into a search form. All exceptions are shown in format: PHP raised unknown ...
9
votes
1answer
371 views

Why would I use at-rest encryption over a DB's key-based encryption?

Goal I want to store encrypted data in a database. Constraints Application-level encryption (encrypting before sending to the DB) is not a reasonable option for my use case. The DB providers I'm ...
9
votes
2answers
8k views

How to secure API (private key) for mobile apps

I am building a web service that has to be only accessible for iOS apps. In the future I want to expand to a mobile web-site to make my service also available for other mobile operating systems. Now,...
8
votes
3answers
842 views

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked?

How are large tech sites such as LivingSocial, Zappos, LinkedIn and Evernote hacked? (i.e. how is their entire dataset of users obtained?) LivingSocial - 50 Million Users Exposed Zappos - 24 Million ...
8
votes
3answers
11k views

Advantages of separating Web server from Database

What are the security advantages of installing the database of a web application on a server other than the one containing the web server?
8
votes
2answers
345 views

What's ownership concept for?

I fail to grasp the necessity of using concept of owner (ownership) and find clear explanation of its necessity. What cannot be done without concept of owner(ownership) in filesystem/database object ...
8
votes
3answers
3k views

Is it safe to store a single symmetric key encrypted with several different RSA public keys?

For the field-based encryption of a database containing sensitive information, I was thinking of the following design: Every user has a smartcard used for client certificate login. After login the ...
8
votes
1answer
4k views

Does it make sense to encrypt database to comply with GDPR?

I had a hard time phrasing the question. I'd rather ask, "How do I comply with GDPR?" But that would probably be too broad of a question. Database encryption concerns me the most, since that's what ...
8
votes
2answers
3k views

Is it good to store passwords in a separate table/database and manage them in a separate process?

I'm quite a newbie at systems architecture and security so I just want to check that this plan makes sense. I'm building a web app and I need to store a password for each user. I've already read ...
8
votes
2answers
30k views

How to securely connect to a database with PHP?

Currently in PHP (in the file /var/www/website.com/public_html/functions.php). I am connecting to the database like this: function connect(){ $config = parse_ini_file('/var/www/website.com/db.ini'...
8
votes
3answers
383 views

What kind of certificate should I get If I want to secure a connection between a web server and a database?

I know people buy SSL certificates to secure their sites. What kind of certificate should I get if I want to encrypt a connection between an application server and a database? Application server may ...
8
votes
1answer
4k views

Database encryption or filesystem encryption?

Recently I've been working on some data which, although not directly governed by any infosec laws, is sensitive enough to warrant being encrypted. I'm interested in finding out about best practises ...
8
votes
1answer
8k views

Store user passwords in NoSQL database?

I am currently coding the backend of a website and I have not come across an article where this is discussed. I want to store all my application data in MongoDB but I'd like to split out my sensitive ...
8
votes
1answer
3k views

Are there any secure ways to store the secret key used in a TOTP scheme?

I'm writing a little webapp that demonstrates 2 factor authentication. I'm using the TOTP protocol as described in RFC 6238. In our scheme, we are storing, in addition to a b-crypted password hash ...
8
votes
2answers
483 views

How to separate storing sensitive data and hash passwords?

Scenario: I have a web application with an authentication system (classic). The application is basically an interface to a DB (MongoDB) which holds sensitive data. I properly hash the stored passwords....
7
votes
3answers
9k views

Does mysql_escape_string have any security vulnerabilities if all tables using Latin1 encoding?

I have heard that the PHP function mysql_escape_string has security vulnerabilities related to mult-byte characters. Are there any vulnerabilities if all tables are using Latin1 encoding?
7
votes
4answers
2k views

Proper credit card encryption for use in a blacklist

I have a general encryption question. I have read through many of the encryption related questions here and I can't find any specifically addressing my concern. This is the hypothetical scenario: I ...
7
votes
2answers
3k views

If encrypted data in a database are accessed by application, does that mean that the application has the decryption key?

I'm using an application linked to a database which holds confidential data (numbers). According to the developer, this data is encrypted. However, i can easily generate a report that will show the ...
7
votes
1answer
5k views

How does Shodan crawl internet-connected devices?

I wonder how Shodan crawls internet-connected devices and adds them to its database. I know Google, for instance, finds new websites by following links in websites it already found, but that strategy ...
7
votes
2answers
2k views

Sending data form registration forms

I understand that sending data from the user to the server, unencrypted, is a bad practice. That is logical. So how do I encrypt 'userside' and send the data to the server in encrypted form? Can ...
7
votes
1answer
1k views

HIPAA Compliance or What measures would you recommend to secure PHI for devs?

I work with a company that sells medical supplies and equipment. As part of this, we retain patient information or Protected Health Information (PHI). What measures have you taken when providing ...
7
votes
4answers
20k views

What can I do with an SQL shell using SQLMap?

I was just messing around with SQLMap on Kali and I have now got an --sql-shell on the main database. With this, I wondered what I can do now with this access. How would I insert data into the ...
7
votes
1answer
787 views

SQL Server of my hosting provider allows me to see all databases. How secure is my mine?

My hosting provider allows access to its SQL Server. When I connected to it by SQL Management Studio, all hosted databases were visible. I can't get the details on these databases, I get this error: ...
7
votes
2answers
3k views

Keeping user data private in a cloud environment like Google App Engine

I am writing an open-source Java application for Google App Engine (GAE). The application will let users create content that is intended to be private. I want to provide reasonable assurances that ...

1
2
3 4 5
14