Questions tagged [sensitive-data-exposure]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
1
vote
0answers
70 views

Employ fscrypt to securely protect, from data-at-rest exposure, all files+data installed after an initial Linux system build?

Our team's goal We want to protect our sensitive data from being potentially data-at-rest exposed after we relinquish a Linux VPS (see below) provided by a hosting service. We're exploring simple(r) ...
0
votes
0answers
32 views

Securing user secrets in KeyChain vs Keychain+Biometrics

The common approach to secure user secrets in native applications seems to be storing the secret in keychain and adding an additional layer of protection by way of biometrics/touchId/FaceID. My ...
0
votes
1answer
57 views

Windows Encrypted temp directory for files at rest in Windows?

It would be nice if there was an area on my computer where I could work with temp files that may contain sensitive information that could be encrypted with bitlocker or something similar when the ...
23
votes
12answers
12k views

Is there a way to hide HTML source code yet keeping it effective?

I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP): <form action="mailto:someone@example.com"> Email Adress:<br> ...
0
votes
1answer
61 views

Exposing a version number through the assets urls

I just received a blackbox pentesting report where the security company recommended to hide the version number from the page (be it returned to the user as a text or used as a cache-buster in the css/...
0
votes
0answers
132 views

Securing Clipboard Memory

Sometimes sensitive data is copied from/to processes and external devices like (long)passwords, usernames and so forth , but also often people don't get this always in mind and forget to clean that ...
9
votes
1answer
1k views

Employer stores plain text personal data in a 'data warehouse' [closed]

I'm unsure if I have posted this in the correct community but the organisation I am currently working for currently uses an SQL 'data warehouse' which contains a bunch of tables from various sources, ...
0
votes
0answers
31 views

Is it a security concern that nginx ingress controller in kubernetes exposes well known endpoints? (/healthz)

If one uses nignx ingress controller in a kubernetes cluster, it exposes something that is called a "default backend" that is used each time no internal routing is found. E.g. if one uses an IP in a ...
25
votes
3answers
7k views

Computer name naming convention for security

I've been doing a security audit and found out you can easily identify host roles and running services just by their computer name (using nslookup). I would like to report this so that they use less ...
0
votes
1answer
56 views

How could you safeguard your data traces when using USB Drive?

I have a very serious question with regard to data security with regard to usage of USB Drive when transmitting, storing or even clearing data with it. When one is going to use USB Drive for ...
0
votes
2answers
190 views

Local File Inclusion [ Post-Exploitation ]

I am curious what kind of sensitive files should I look for on a Windows server which is vulnerable to LFI compared to Linux? I mean the first file or common files which a pentester or an ...
0
votes
0answers
40 views

Does Eraser tool overwrites all data regardless different drives?

I previously had used Eraser tool for clearing all my usage data of laptop before formally disposing it at a generic recycle centre. I used the tool for possibly wiping off my laptop 3 times in a ...
2
votes
2answers
163 views

Does “Restore Factory Defaults” Wipe Out My Data Completely?

I used to have a IBM Thinkpad (Lenovo) T440. I have been using that laptop for over 8 years. This device has been reset to factory default multiple times (probably up to 6-10 times if not more) ...
1
vote
1answer
62 views

How we can PoC our product that needs training data for our machine learning algorithm of the the bank clients?

Recently, we have had a challenge with potential future clients which are the bank. Our product requires to gather static data (e.g. address, loans, last 50 transactions, etc) of banks clients. These ...
1
vote
1answer
65 views

Encrypting data as a middleman

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money. As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
1
vote
0answers
57 views

How to treat SSN passing through web server

I am working on a platform that does temp labor and we are needing to run background checks. That means collecting scary data like SSNs, Names, Addresses, Dates Of Birth, and sending them to the ...
1
vote
2answers
91 views

How to securely transfer data from a public website, to a VPN-secured website?

I'm (currently) a VPN newby. I have a VPS with a few websites on it, hosted by liquid web. I have installed a medical records package (openEMR) in a sub-domain, in its own cPanel account. I intend to ...
25
votes
4answers
5k views

Do my Windows system binaries contain sensitive information?

I have a dataset from a malware detection project that others want to use. Part of that dataset is system binaries that I had retrieved from my PC by searching for *.exe files (to serve as a benign ...
2
votes
3answers
159 views

Are there examples of implementing security as a side effect?

I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
0
votes
1answer
51 views

Which is more secure: saving reference link to file in file system in the database, or save the entire file into the database?

We have forms where we get clients to upload images of very sensitive information (passport, signature, etc.). We will store their written information into a database. However, there is the issue of ...
0
votes
0answers
24 views

How secure will it be to use “Google Docs long url” like authentication scheme for orders in my online shop? [duplicate]

For the sake of simplicity, instead of full-fledged authentication with login and password, I want to create "Google Docs long url" authentication scheme for my internet shop for the users. To let ...
0
votes
1answer
171 views

Sensitive data transmission over Internet

I was wondering how we should transfer our sensitive data (identity card softcopy, plaintext-password, secret documents, etc) over the internet securely, the following are a few related questions: Is ...
5
votes
2answers
861 views

How does full disk encryption cater for overprovisoned disk space in flash devices and can this result in data leakage?

My understanding is that flash based devices such as SSDs are over-provisioned and do not advertise the additional blocks of storage available to the operating system. The over-provisioned blocks of ...
27
votes
4answers
5k views

Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?

Working with a non-profit organization,it's common to reuse hard drives that have previously stored highly sensitive information such as medical and financial records. This is primarily driven by cost-...
1
vote
1answer
177 views

When is Veracrypt an acceptable solution?

To manage security risks effectively, a non-profit organization has the following high level requirements; Limit access to authorized staff. Sensitive data is only accessible to authorized staff. ...
5
votes
2answers
195 views

How important is it to delete disk partitions when wiping devices?

The command lsblk returns the following output that lists 4 partitions. sda 8:0 0 931.5G 0 disk ├─sda1 8:1 0 8M 0 part ├─sda2 8:2 0 40G 0 part / ├─sda3 8:3 0 883.8G ...
1
vote
0answers
44 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
3
votes
2answers
182 views

Can a data requester get the sender when “Sealed sender” is enabled in Signal?

The Signal app offers to seal the sender. The whole process can be summarized in the following steps: The app encrypts the message using Signal Protocol, as usual. Include the sender certificate and ...
1
vote
1answer
159 views

How to protect devices that are reliant on Bitlocker and a password without TPM?

In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker ...
0
votes
1answer
38 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
0
votes
0answers
86 views

Why do people redact MAC addresses? [duplicate]

What are the security implications of sharing a MAC address online? How important is it really, to redact this information; and why? I see it a lot, and I'm in the habit of doing it myself. 1. ...
2
votes
2answers
137 views

Sensitive data enumeration via HTTP error codes

Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user Bob a message to his cell phone which he registered on our ...
3
votes
1answer
553 views

Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?

I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
1
vote
0answers
48 views

Is creating a derived password safe?

I need to store really sensitive data in a client-hosted database. Since there's no way I can protect this database (because I don't own it), my idea was to encrypt it by using the user's password, so ...
1
vote
1answer
561 views

Is it safe to use unencrypted rsync when my backup is encrypted?

I've configured something usually advised against, but so far I have evaluated it seems perfectly safe to me. I'd like some opinions since playing with non-encrypted connections for my very sensitive ...
0
votes
0answers
190 views

Protecting sensitive data in cache

I have a java application which is reading sensitive data from database (open symmetric key, read data from database) and storing it in-memory cache. I want to make sure that no one should able to ...
7
votes
1answer
332 views

What are good methods of visual security?

What are good methods of visually securing sensitive information that might appear on your screen from the outside world? An example to illustrate my question would be the following: You're sat in ...
0
votes
2answers
121 views

User generated search queries

Are user generated search queries classed as sensitive data? For example, if an application put PII from a search query such as names, date of birth, addresses etc. in the query string of a URL (...
5
votes
1answer
166 views

Are there regulations that govern how social security numbers are stored and viewed?

I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few ...
12
votes
1answer
409 views

Browser cache information disclosure

Observing the time needed by a browser to load external resources such as images potentially discloses information about whether those resources have been accessed before. Explanation: For example, ...
2
votes
2answers
65 views

Ways to protect private data from other applications I installed

What methods can I use to protect certain important and private data like my ssh keys from other applications I might install? Is there anyway to block access to these files and restrict the access ...
3
votes
3answers
416 views

Is it safe to accept a file upload without any file extension?

Currently working on a website which allows users to upload data files for automated processing. For both security and user guidance purposes, we implemented an extension whitelist both client and ...
0
votes
2answers
132 views

How to give a web application a key in order to decrypt data in a database

My situation is that I need to store sensitive data in a database for a web application. The sensitive data includes things like refresh tokens for Oauth2 systems, secret keys for other APIs etc. I'm ...
0
votes
1answer
48 views

Processing sensitive user data on a server without the possibility of data theft?

I have written an application which I would like to offer via REST API to customers. In the task which is executed on the server there is some sensitive user data involved, e.g. the user's login to a ...
2
votes
1answer
77 views

Ways to impress children about web privacy violations and concerns

I would like to make a simple lesson to some children about the bad web surfing consequences for their privacy and personal data leaks. E.g. privacy issues by using social networks, visiting websites ...
4
votes
2answers
153 views

Same sensitive info in HTML reply that was posted before

Is it an issue to send back the same sensitive (PCI, PII) information from the server in the HTML reply that a user previously posted to the server? On our webpage, the user enters some key info (...
5
votes
1answer
189 views

Working on sensitive data on the cloud

In my current project for an NGO, I have to set up a system that allows members of the organisation to perform basic analysis on highly sensitive data. The data (reports, or form submissions) is ...
2
votes
1answer
107 views

Secure, Portable Bookmarks

A constant bugbear is my bookmarks being synced to my Google accounts, meaning access to them outside that Google account requires various manual steps. So it got me thinking of a roll your own way ...
3
votes
2answers
441 views

False acceptance rate in biometric authentication for sensitive information

Every type of biometric authentication will have a false acceptance rate, which is the likelihood that the system will incorrectly accept an access attempt by an unauthorized user. Of course, when ...
-1
votes
1answer
97 views

How can MyKi transfer data from iOS to macOS without a server?

MyKi.co claims to be able to transfer your passwords securely from your iOS device to the macOS without having to relay through their own servers. But how is this possible? "Your sensitive data is ...