Questions tagged [sensitive-data-exposure]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
2 answers
55 views

How secure is R and RStudio?

I work at a clinic where we need to pseudonymize patient data. I wrote a small app for this using R (RStudio). R will be installed on computers with access to internet but my idea is to use R offline, ...
user avatar
2 votes
0 answers
30 views

Kaspersky Total Security Data Vault encryption AES256 BUT with "effective key-length 56bit"

While comparing Kaspersky Total Security (KST) with Kaspersky Internet Security (KIS). One of the "extras" of KTS is the added "feature" of "Data Vaults", which "...
user avatar
  • 111
0 votes
2 answers
38 views

How to classify data sensitivity including accessibility & numbers

When classifying data sensitivity I generally run into a few standard categories such as: Public Internal Confidential Restricted Which do generally cover the sensitivity levels but don't make it ...
user avatar
  • 113
0 votes
1 answer
78 views

What hidden metadata might be embedded in a PDF that is not visible "to the naked eye"?

I have edited a PDF file in Acrobat, which left some metadata and I am wondering: What metadata might be possible to discern from the end file if I were to send it to external parties? What actions ...
user avatar
  • 101
1 vote
0 answers
58 views

How are DDOS protection mechanisms setup when confidential data is involved?

Scenario: A hospital has the records of all patients. There is an online portal where patients can login to see their personal medical data. Since a hospital is an obvious target for any type of hack, ...
user avatar
2 votes
1 answer
118 views

What should I do if my sensitive information is potentially leaked?

I sold an laptop recently, but didn’t care to do a secure erase to make sure there wasn’t any data left. After a long time, I suddenly realized that I shouldn’t have be so careless and began to worry ...
user avatar
  • 23
0 votes
1 answer
103 views

Can adblocker plus read your sensitive data or spy you? [duplicate]

Do adblockers read your sensitive data? https://adblockplus.org/ I'm referring to this, its open-source but I feel worried.
user avatar
0 votes
1 answer
151 views

How to secure data on production environment

Question Suppose you design a data lake with sensitive data. Due to immaturity of tools, dynamic data masking is unavailable. You have MFA, encryption at rest, audit logging, ETL processing data and ...
user avatar
  • 215
2 votes
1 answer
165 views

How to prevent small mistakes that have massive impact?

I frequently have very personal files temporarily on my virtual desktop. I sometimes download a new program, which is going into a VM. Before sending it in there, I tend to VirusTotal scan it. I load ...
user avatar
-2 votes
1 answer
131 views

Is it fine to save contact information on a ssh sever and is it secure?

My mom wants to find a way to store information securely and host it remotely and wants to host our own mini-server on a Raspberry Pi that'll have contact information of the customers. My sister said ...
user avatar
1 vote
0 answers
88 views

How to protect PII data from being sold or exposed by employees

For PII, we capture mostly emails, mobile and name of users who signup on our website. Along with this purchases made by users are also a sensitive data. Protecting this data for users privacy is as ...
user avatar
  • 149
0 votes
1 answer
110 views

How can I obliterate information on a defunct device, and should I?

I have old cell phones with problems that make them useless (non-responsive touch screen, black-on-black display, will not power up). I also have a bunch of solid-state USB memory devices that don't ...
user avatar
  • 101
1 vote
2 answers
3k views

Local IndexedDB in Browser - is it really a security risk?

We have a web application that stores cached information in browser (both is firefox and chrome). When we subjected it to Penetration Testing, a finding was filed saying that "Senstive Data such ...
user avatar
2 votes
1 answer
207 views

PII Data Masking rules - what's acceptable and what's not

Is there a security rule on correct masking for sensitive information? Let's say we want to use prod data in our UAT environment. We're thinking of creating a masking logic when we transfer prod data ...
user avatar
2 votes
1 answer
221 views

Website showing entered credit card number as valid or invalid [duplicate]

I noticed on a website that when I entered my credit card number, the entry box was highlighted blue: I then tried a dummy credit card number, which made the box highlight red, indicating that credit ...
user avatar
21 votes
2 answers
7k views

Pwned by a website I never subscribed to - How do they have my e-mail address?

I searched my email addresses in https://haveibeenpwned.com/. One of my e-mail addresses results as having been pwned, and is present in a data breach, in particular the Apollo data breach: Apollo: ...
user avatar
1 vote
2 answers
166 views

How is DNS sinkhole being use?

I had some difficulty in grasping the concept on how "DNS sinkhole" is being utilize. Is it like setting up something similar to a honeypot to lure attackers away from the actual network, so ...
user avatar
1 vote
0 answers
129 views

Temporary storage of sensitive information in Javascript

I am working at a university where we are creating a Website that allows students to apply for scholarships. Rather than print the application form, sign it then scan it then return it back, the ...
user avatar
1 vote
2 answers
143 views

How can I give users access to thier data without requiring any authentication? [closed]

The premise of this question boils down to frictionless access to data. I have User A whose records I have kept on a database. I want to send them a link to their records such that they can access ...
user avatar
3 votes
2 answers
167 views

Encryption as bijective data masking function

Context I'm building data lake from scratch within a small team (3-6 data engineers). I want to mask PII data when copying data from prod to dev/test environments. I'm particularly interested in the ...
user avatar
  • 215
2 votes
1 answer
163 views

Exposing employee numbers, how bad is it?

I've realised that there is an easy way for someone who is external to figure out valid employee numbers at my company. And I'm fairly sure they could then be linked to a full name easily too. I've ...
user avatar
0 votes
1 answer
130 views

Should encryption key be stored remotely?

Consider the following scenarios of storing sensitive data locally on a network connected always-on device: without any data encryption whatsoever with encryption, the key stored locally in the ...
user avatar
2 votes
3 answers
188 views

School Request: What can be done protect people's financial information?

This is a bit of an odd question, and if it doesn't belong on this forum feel free to retract. I was asked by a group of 7th graders to share my thoughts on the problem of credit card data breaches. ...
user avatar
0 votes
0 answers
83 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
user avatar
  • 51
7 votes
1 answer
701 views

Does WhatsApp's link preview on the link messages leak information?

When we want to send a message that contains only a link - such as a question from the Stack Exchange network - WhatsApp displays information from the website as below: Does this leak information ...
user avatar
  • 5,459
2 votes
1 answer
434 views

I snapped my micro SD card into 8 pieces before throwing it away. Should I be worried that someone can get my data?

The card was a 16gb SanDisk micro SD card (monolithic).
user avatar
30 votes
6 answers
6k views

As a contractor how do I work on multiple client networks without data leakage?

I am a contractor who does development for more than one client. Let's call them Client A, Client B, and Client X. I use my own laptop for all 3 clients. Throughout the day, I have to work on and ...
user avatar
  • 401
6 votes
3 answers
292 views

Using an example to comprehend why “safely” erasing a drive yields better results than filling it up with meaningless data

A hypothetical 1GB USB stick is full of sensitive documents/images/etc. and it is not encrypted. The owner wishes to discard it and is aware of having to safely erase it first. There are several tools ...
user avatar
1 vote
2 answers
222 views

How can one encrypt a file and be sure the original file can not be recovered on a SSD?

Let's say that I have an unencrypted file and I'm trying to encrypt it and make sure the original file can not be recovered from my disk. If I, for example, create an archive, put the file into it and ...
user avatar
0 votes
1 answer
92 views

Is it good idea to re-authenticate a user to access sensitive actions and data?

In a web application there are several pages in which you have sensitvie data and actions like access controls or user management page. Is it a good idea to re-authenticate user to access those pages? ...
user avatar
3 votes
0 answers
187 views

What is the Meow Attack and how can I guard my databases against it?

Recently, there has been some news articles about unsolicited attacks on unsecured public facing Elastic and Mongo databases. These are commonly being called "Meow" attacks, resulting in ...
user avatar
0 votes
3 answers
124 views

What security concerns are there regarding website users inputting personal financial data without putting in personally identifying data?

I am a web developer, but I have only a rudimentary grasp of security, e.g., be careful to sanitize inputs, store as little user data as possible, encrypt passwords, keep up with security issues of ...
user avatar
  • 103
1 vote
1 answer
83 views

Autofilling sensitive information for publicly available form

We are in the process of designing an app which, simply put, will allow people to accept payments easily. The customer won't need an account and we'll be linking customer data (name, address, and ...
user avatar
  • 217
0 votes
0 answers
146 views

Ionic local storage store sensitive data for private app

I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
user avatar
  • 1
3 votes
3 answers
557 views

Does GDPR apply for volatile data

GDPR aims to set standards (and requirements) on how sensitive data should be stored. Although, I couldn't find any information on how (or if even) GDPR applies for sensitive data in a volatile state. ...
user avatar
  • 133
2 votes
1 answer
451 views

Off-Facebook activities received from apps and websites NEVER logged in via Facebook

Facebook has recently launched "off facebook activity" which lets you see all the activities shared by other apps/websites that you have interacted with. But how did those apps and websites share ...
user avatar
1 vote
5 answers
664 views

Username in browser history (url) - is this a security problem?

We have a client complaining that there is PII in the browser history (as in the persistent history you get to through your browser's menu - Ctrl + H in Chrome). For example, the URL for editing a ...
user avatar
  • 149
3 votes
1 answer
730 views

URL Contains Sensitive Data - Alternative Besides Switching To Post?

One of my company's clients recently produced an application security assessment report, noting a list of violations based on OWASP's top 10 list of web application security risks. One of the ...
user avatar
  • 149
1 vote
3 answers
100 views

What are the best practices in a manufacturing/production facility for data retention?

My scenario: A production facility that uses data sets provided by customer(s) to produce personalized goods in bulk. Data sets can range from 100,000 to 2,000,000 names and addresses in the US. ...
user avatar
1 vote
3 answers
584 views

Is it safe and permissive to remember devices to skip two factor authentication when dealing with sensitive information?

We're a small UK startup building a small service that allows certain special people (e.g. journalists) to access non-public court information. This information includes a ton of private and ...
user avatar
  • 111
5 votes
1 answer
358 views

Is it possible to use WeChat (Weixin) more safely in recent versions of Android by using permissions?

I assume that anything written or read on WeChat is read by the government of the People's Republic of China. I understand the risks of that. However, I would like to understand the implications of ...
user avatar
  • 172
1 vote
1 answer
328 views

Would there be a secure way to store an encryption key on server side for front-end decryption?

I am currently working on a web application with sensitive data to store (personal medical data). The app is on the very first stages of conception and I am to quickly produce a beta version that ...
user avatar
3 votes
1 answer
181 views

A workaround for external website's HTTP registration page

There is a website which I want to register for but it is a internship/job-seeking website and thus on registration some VERY sensitive data is required. When registering Firefox alerted me that the ...
user avatar
19 votes
3 answers
2k views

How to deal with a company that doesn't fix (potential) security vulnerabilities in their web app?

About 2 weeks ago, I stumbled across a web application, that can be used by gyms to manage the information about their members. This includes data like the name, billing address, birth date, and ...
user avatar
  • 193
1 vote
1 answer
111 views

Can any of your recognisable personal information be linked to your device fingerprint?

I learned that a device probably has a device fingerprint to the eyes of a company that operates online. I'm not sure how this fingerprint is managed by its collectors, but it's plausible that it ...
user avatar
0 votes
1 answer
141 views

What kind of local information are desktop applications capable to retrieve (and use) from my computer?

I've already seen on Windows what kind of information the Steam application is sending online: time, place and device of the connection, time passed playing the games, payments, mail, numbers, etc. ...
user avatar
1 vote
1 answer
130 views

Posting from HTTPS without specifying protocol - secure?

I have a form that is on a secure (HTTPS) page, which posts to another page. In the form action, the protocol is not specified but I would assume uses the same protocol as the page that it came from, ...
user avatar
  • 119
2 votes
2 answers
166 views

User passwords printed on paperwork at a dental office?

My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork. I asked on Law.stackexchange and it doesn't sound like this is a ...
user avatar
  • 21
4 votes
0 answers
125 views

Zeroization of sensitive data in Functional Programming Languages

Concerning the very familiar (and sensible) security practice of Zeroizing sensitive data from memory after you're finished with it, such as Cryptographic keys, passwords, etc, I was pondering how you ...
user avatar
  • 61
2 votes
1 answer
1k views

Employ fscrypt to securely protect, from data-at-rest exposure, all files+data installed after an initial Linux system build?

Our team's goal We want to protect our sensitive data from being potentially data-at-rest exposed after we relinquish a Linux VPS (see below) provided by a hosting service. We're exploring simple(r) ...
user avatar