Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [sensitive-data-exposure]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
9 votes
5 answers
5k views

Hash as filename to protect data

Requirement: Users fill out a form which includes sensitive personal data and need to be able to download the content of this form for a limited time. Question: How useful / secure is it to create a ...
Larzan's user avatar
  • 255
0 votes
2 answers
240 views

Is this solution I have programmed 100% hack-proof?

I have programmed something at work, and I believe it's been done in a way that's effectively 100% hack-proof even if I give full admin rights to the server. In short, I have some legally sensitive ...
user1758433's user avatar
0 votes
2 answers
168 views

How bad would a Hash algorithm leak would be?

Context: When the Twitch whole code repository was leaked, it created multiple discussions on social medias. And one day I was on Reddit and said that the leak of the hashing algorithm and the salt ...
CARLOS EDUARDO NISHI's user avatar
0 votes
0 answers
83 views

Any "smart" way to disable telemetry of a web application on OS/hardware level? Any specific guide/tool recommend if we use linux and lnmp env

Let's say we know as a fact that a php web application baked in telemetry to collection data. Without scanning through the codebase, any quick hack tool that we can force the telemetry become useless ...
Maxfield's user avatar
  • 157
2 votes
1 answer
403 views

What are good data-at-rest encryption strategies for sensitive data?

I need to protect sensitive data by doing data encryption at rest. Context : I have at least the data of 20 app to protect. I want protection from those with legitimate access to the virtual machine ...
loic midy's user avatar
0 votes
0 answers
148 views

How to implement secure E2EE for a managing App

TL;DR Is it possible to create an end-to-end encrypted web application where newly created users are able to access data encrypted before their creation? My plan is to develop a (let's call it a ...
Kndo2378's user avatar
2 votes
1 answer
111 views

ListDLLs command (Listdlls.exe) Shady EULA

This dialog pops up upon running the command. The dialog is essentially saying: "By using this software, it is the user's sole responsibility for any sensitive information provided to Microsoft ...
Marinn's user avatar
  • 21
1 vote
1 answer
150 views

Encrypted user data and storing hashed RSA keys on the server for backup reasons

Imagine a mobile app that connects to an API server. Disclaimer I'm not sure if RSA is the right technique for this, please feel free to recommend alternatives. The goal The backend/database super ...
Laisender's user avatar
  • 111
1 vote
1 answer
2k views

Microsoft Purview Sensitivity labels, best practices for setup?

Background There have been more than a handful of recent security breaches at my company, involving social engineering and spoofed emails. A malicious actor fraudulently spoofing one of our customers, ...
Jacob K's user avatar
  • 111
1 vote
1 answer
249 views

Would my hypothetical Opsec setup with the goal of compartmentalizing sensitive areas from an insecure sandbox be sensible?

The root cause of my problem stems from the fact that I need to run untrustworthy software on a bare metal windows machine, which means that I can't just have it in a VM because of major performance ...
NocturnalMoon's user avatar
0 votes
0 answers
185 views

Requests to malicious IP being sent by background process on Windows

Whenever an internet connection is established on my pc, I am repeatedly getting warnings from QuickHeal like this: I am getting such warnings repeatedly with different IP addresses. In the above ...
DevRish's user avatar
1 vote
0 answers
2k views

Can I know if someone transferred files from my mobile to their computer

If someone connected my phone through USB to computer or laptop and transferred files from my mobile, is there any option to check in my mobile that they used particular apps or opened and transferred ...
Shekar Bodhanapu's user avatar
0 votes
1 answer
140 views

Secret security in containerised environment

I've been having a discussion with a developer about storing sensitive information in environment variables. Specifically within a containerised environment such as Azures Container apps. Background ...
Drifter104's user avatar
0 votes
0 answers
24 views

How do I report that the organization is using common passwords for the backend [duplicate]

I was surfing on a big company's website, and I tried to make an account on it. I found that the account registration was quite buggy so I checked the page source. I found that there were error logs ...
pjmathematician's user avatar
1 vote
2 answers
591 views

What is the reason for Sensitive But Unclassified (SBU)?

I've been reading about security classifications, and have a fundamental question I can't seem to find an answer to. Why does the designation Sensitive But Unclassified (SBU) exist? Why not just ...
Russ's user avatar
  • 171
0 votes
0 answers
242 views

sensitive data exposure from RAM memory [duplicate]

I have software written in C# and compiled as a .exe file. How can I read sensitive data (like usernames, passwords, etc.) from RAM while it runs?
p.soheyli's user avatar
0 votes
1 answer
625 views

Another browser opens URL without logging in

I was required to log in and pay an invoice but for some reason the website did not work with Safari due to a cookie issue as suggested by the alert banner and asked me to use a different browser. I ...
SaraSato's user avatar
1 vote
2 answers
4k views

How secure is R and RStudio?

I work at a clinic where we need to pseudonymize patient data. I wrote a small app for this using R (RStudio). R will be installed on computers with access to internet but my idea is to use R offline, ...
LulY's user avatar
  • 113
2 votes
0 answers
206 views

Kaspersky Total Security Data Vault encryption AES256 BUT with "effective key-length 56bit"

While comparing Kaspersky Total Security (KST) with Kaspersky Internet Security (KIS). One of the "extras" of KTS is the added "feature" of "Data Vaults", which "...
ARGYROU MINAS's user avatar
0 votes
2 answers
152 views

How to classify data sensitivity including accessibility & numbers

When classifying data sensitivity I generally run into a few standard categories such as: Public Internal Confidential Restricted Which do generally cover the sensitivity levels but don't make it ...
Light44's user avatar
  • 123
0 votes
1 answer
2k views

What hidden metadata might be embedded in a PDF that is not visible "to the naked eye"?

I have edited a PDF file in Acrobat, which left some metadata and I am wondering: What metadata might be possible to discern from the end file if I were to send it to external parties? What actions ...
Ohan's user avatar
  • 101
1 vote
0 answers
101 views

How are DDOS protection mechanisms setup when confidential data is involved?

Scenario: A hospital has the records of all patients. There is an online portal where patients can login to see their personal medical data. Since a hospital is an obvious target for any type of hack, ...
groundwine's user avatar
2 votes
1 answer
173 views

What should I do if my sensitive information is potentially leaked?

I sold an laptop recently, but didn’t care to do a secure erase to make sure there wasn’t any data left. After a long time, I suddenly realized that I shouldn’t have be so careless and began to worry ...
Rukord's user avatar
  • 23
0 votes
1 answer
1k views

Can adblocker plus read your sensitive data or spy you? [duplicate]

Do adblockers read your sensitive data? https://adblockplus.org/ I'm referring to this, its open-source but I feel worried.
Mekatoo's user avatar
1 vote
1 answer
378 views

How to secure data on production environment

Question Suppose you design a data lake with sensitive data. Due to immaturity of tools, dynamic data masking is unavailable. You have MFA, encryption at rest, audit logging, ETL processing data and ...
VB_'s user avatar
  • 225
2 votes
1 answer
242 views

How to prevent small mistakes that have massive impact?

I frequently have very personal files temporarily on my virtual desktop. I sometimes download a new program, which is going into a VM. Before sending it in there, I tend to VirusTotal scan it. I load ...
M. Moyna's user avatar
-1 votes
1 answer
165 views

Is it fine to save contact information on a ssh sever and is it secure?

My mom wants to find a way to store information securely and host it remotely and wants to host our own mini-server on a Raspberry Pi that'll have contact information of the customers. My sister said ...
thecomplexer's user avatar
1 vote
0 answers
133 views

How to protect PII data from being sold or exposed by employees

For PII, we capture mostly emails, mobile and name of users who signup on our website. Along with this purchases made by users are also a sensitive data. Protecting this data for users privacy is as ...
Abhinav's user avatar
  • 179
0 votes
1 answer
145 views

How can I obliterate information on a defunct device, and should I?

I have old cell phones with problems that make them useless (non-responsive touch screen, black-on-black display, will not power up). I also have a bunch of solid-state USB memory devices that don't ...
user6726's user avatar
  • 101
2 votes
2 answers
12k views

Local IndexedDB in Browser - is it really a security risk?

We have a web application that stores cached information in browser (both is firefox and chrome). When we subjected it to Penetration Testing, a finding was filed saying that "Senstive Data such ...
lecarpetron dookmarion's user avatar
2 votes
1 answer
727 views

PII Data Masking rules - what's acceptable and what's not

Is there a security rule on correct masking for sensitive information? Let's say we want to use prod data in our UAT environment. We're thinking of creating a masking logic when we transfer prod data ...
lecarpetron dookmarion's user avatar
2 votes
1 answer
681 views

Website showing entered credit card number as valid or invalid [duplicate]

I noticed on a website that when I entered my credit card number, the entry box was highlighted blue: I then tried a dummy credit card number, which made the box highlight red, indicating that credit ...
user9506231's user avatar
20 votes
2 answers
8k views

Pwned by a website I never subscribed to - How do they have my e-mail address?

I searched my email addresses in https://haveibeenpwned.com/. One of my e-mail addresses results as having been pwned, and is present in a data breach, in particular the Apollo data breach: Apollo: ...
robertspierre's user avatar
1 vote
2 answers
373 views

How is DNS sinkhole being use?

I had some difficulty in grasping the concept on how "DNS sinkhole" is being utilize. Is it like setting up something similar to a honeypot to lure attackers away from the actual network, so ...
1g0tquestions's user avatar
1 vote
0 answers
279 views

Temporary storage of sensitive information in Javascript

I am working at a university where we are creating a Website that allows students to apply for scholarships. Rather than print the application form, sign it then scan it then return it back, the ...
lecarpetron dookmarion's user avatar
1 vote
2 answers
240 views

How can I give users access to thier data without requiring any authentication? [closed]

The premise of this question boils down to frictionless access to data. I have User A whose records I have kept on a database. I want to send them a link to their records such that they can access ...
Mohamad Abdel Rida's user avatar
3 votes
2 answers
231 views

Encryption as bijective data masking function

Context I'm building data lake from scratch within a small team (3-6 data engineers). I want to mask PII data when copying data from prod to dev/test environments. I'm particularly interested in the ...
VB_'s user avatar
  • 225
3 votes
1 answer
235 views

Exposing employee numbers, how bad is it?

I've realised that there is an easy way for someone who is external to figure out valid employee numbers at my company. And I'm fairly sure they could then be linked to a full name easily too. I've ...
chrispepper1989's user avatar
0 votes
1 answer
244 views

Should encryption key be stored remotely?

Consider the following scenarios of storing sensitive data locally on a network connected always-on device: without any data encryption whatsoever with encryption, the key stored locally in the ...
peter.babic's user avatar
2 votes
3 answers
247 views

School Request: What can be done protect people's financial information?

This is a bit of an odd question, and if it doesn't belong on this forum feel free to retract. I was asked by a group of 7th graders to share my thoughts on the problem of credit card data breaches. ...
Chris Camaratta's user avatar
0 votes
0 answers
112 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
Eliter's user avatar
  • 51
7 votes
1 answer
944 views

Does WhatsApp's link preview on the link messages leak information?

When we want to send a message that contains only a link - such as a question from the Stack Exchange network - WhatsApp displays information from the website as below: Does this leak information ...
kelalaka's user avatar
  • 5,559
2 votes
1 answer
1k views

I snapped my micro SD card into 8 pieces before throwing it away. Should I be worried that someone can get my data?

The card was a 16gb SanDisk micro SD card (monolithic).
user avatar
30 votes
6 answers
6k views

As a contractor how do I work on multiple client networks without data leakage?

I am a contractor who does development for more than one client. Let's call them Client A, Client B, and Client X. I use my own laptop for all 3 clients. Throughout the day, I have to work on and ...
duggulous's user avatar
  • 401
6 votes
3 answers
330 views

Using an example to comprehend why “safely” erasing a drive yields better results than filling it up with meaningless data

A hypothetical 1GB USB stick is full of sensitive documents/images/etc. and it is not encrypted. The owner wishes to discard it and is aware of having to safely erase it first. There are several tools ...
initiation14695's user avatar
1 vote
2 answers
373 views

How can one encrypt a file and be sure the original file can not be recovered on a SSD?

Let's say that I have an unencrypted file and I'm trying to encrypt it and make sure the original file can not be recovered from my disk. If I, for example, create an archive, put the file into it and ...
Usersasajid30832d's user avatar
0 votes
1 answer
152 views

Is it good idea to re-authenticate a user to access sensitive actions and data?

In a web application there are several pages in which you have sensitvie data and actions like access controls or user management page. Is it a good idea to re-authenticate user to access those pages? ...
yenafaramn's user avatar
3 votes
0 answers
235 views

What is the Meow Attack and how can I guard my databases against it?

Recently, there has been some news articles about unsolicited attacks on unsecured public facing Elastic and Mongo databases. These are commonly being called "Meow" attacks, resulting in ...
MDMoore313's user avatar
0 votes
3 answers
154 views

What security concerns are there regarding website users inputting personal financial data without putting in personally identifying data?

I am a web developer, but I have only a rudimentary grasp of security, e.g., be careful to sanitize inputs, store as little user data as possible, encrypt passwords, keep up with security issues of ...
user's user avatar
  • 103
1 vote
1 answer
116 views

Autofilling sensitive information for publicly available form

We are in the process of designing an app which, simply put, will allow people to accept payments easily. The customer won't need an account and we'll be linking customer data (name, address, and ...
Script47's user avatar
  • 227