Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sensitive-data-exposure]

The tag has no usage guidance.

-3
votes
0answers
45 views

Password Transmitted over Query String [on hold]

I developed an web application. I was sending password information on query string. I got a password transmitting over query string warning when security scanning with netsparker. After that i fixed ...
0
votes
2answers
85 views

Sensitive data transmission over Internet

I was wondering how we should transfer our sensitive data (identity card softcopy, plaintext-password, secret documents, etc) over the internet securely, the following are a few related questions: Is ...
5
votes
2answers
752 views

How does full disk encryption cater for overprovisoned disk space in flash devices and can this result in data leakage?

My understanding is that flash based devices such as SSDs are over-provisioned and do not advertise the additional blocks of storage available to the operating system. The over-provisioned blocks of ...
27
votes
4answers
5k views

Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?

Working with a non-profit organization,it's common to reuse hard drives that have previously stored highly sensitive information such as medical and financial records. This is primarily driven by cost-...
1
vote
1answer
77 views

When is Veracrypt an acceptable solution?

To manage security risks effectively, a non-profit organization has the following high level requirements; Limit access to authorized staff. Sensitive data is only accessible to authorized staff. ...
5
votes
2answers
186 views

How important is it to delete disk partitions when wiping devices?

The command lsblk returns the following output that lists 4 partitions. sda 8:0 0 931.5G 0 disk ├─sda1 8:1 0 8M 0 part ├─sda2 8:2 0 40G 0 part / ├─sda3 8:3 0 883.8G ...
1
vote
0answers
37 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
3
votes
2answers
123 views

Can a data requester get the sender when “Sealed sender” is enabled in Signal?

The Signal app offers to seal the sender. The whole process can be summarized in the following steps: The app encrypts the message using Signal Protocol, as usual. Include the sender certificate and ...
1
vote
1answer
95 views

How to protect devices that are reliant on Bitlocker and a password without TPM?

In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker ...
0
votes
1answer
26 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
0
votes
0answers
58 views

Why do people redact MAC addresses? [duplicate]

What are the security implications of sharing a MAC address online? How important is it really, to redact this information; and why? I see it a lot, and I'm in the habit of doing it myself. 1. ...
2
votes
2answers
100 views

Sensitive data enumeration via HTTP error codes

Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user Bob a message to his cell phone which he registered on our ...
3
votes
1answer
183 views

Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?

I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
1
vote
0answers
42 views

Is creating a derived password safe?

I need to store really sensitive data in a client-hosted database. Since there's no way I can protect this database (because I don't own it), my idea was to encrypt it by using the user's password, so ...
1
vote
1answer
346 views

Is it safe to use unencrypted rsync when my backup is encrypted?

I've configured something usually advised against, but so far I have evaluated it seems perfectly safe to me. I'd like some opinions since playing with non-encrypted connections for my very sensitive ...
0
votes
0answers
48 views

Protecting sensitive data in cache

I have a java application which is reading sensitive data from database (open symmetric key, read data from database) and storing it in-memory cache. I want to make sure that no one should able to ...
7
votes
1answer
312 views

What are good methods of visual security?

What are good methods of visually securing sensitive information that might appear on your screen from the outside world? An example to illustrate my question would be the following: You're sat in ...
0
votes
2answers
110 views

User generated search queries

Are user generated search queries classed as sensitive data? For example, if an application put PII from a search query such as names, date of birth, addresses etc. in the query string of a URL (...
2
votes
1answer
58 views

Are there regulations that govern how social security numbers are stored and viewed?

I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few ...
12
votes
1answer
293 views

Browser cache information disclosure

Observing the time needed by a browser to load external resources such as images potentially discloses information about whether those resources have been accessed before. Explanation: For example, ...
2
votes
2answers
62 views

Ways to protect private data from other applications I installed

What methods can I use to protect certain important and private data like my ssh keys from other applications I might install? Is there anyway to block access to these files and restrict the access ...
3
votes
3answers
177 views

Is it safe to accept a file upload without any file extension?

Currently working on a website which allows users to upload data files for automated processing. For both security and user guidance purposes, we implemented an extension whitelist both client and ...
0
votes
2answers
105 views

How to give a web application a key in order to decrypt data in a database

My situation is that I need to store sensitive data in a database for a web application. The sensitive data includes things like refresh tokens for Oauth2 systems, secret keys for other APIs etc. I'm ...
0
votes
1answer
47 views

Processing sensitive user data on a server without the possibility of data theft?

I have written an application which I would like to offer via REST API to customers. In the task which is executed on the server there is some sensitive user data involved, e.g. the user's login to a ...
2
votes
1answer
73 views

Ways to impress children about web privacy violations and concerns

I would like to make a simple lesson to some children about the bad web surfing consequences for their privacy and personal data leaks. E.g. privacy issues by using social networks, visiting websites ...
4
votes
2answers
136 views

Same sensitive info in HTML reply that was posted before

Is it an issue to send back the same sensitive (PCI, PII) information from the server in the HTML reply that a user previously posted to the server? On our webpage, the user enters some key info (...
5
votes
1answer
179 views

Working on sensitive data on the cloud

In my current project for an NGO, I have to set up a system that allows members of the organisation to perform basic analysis on highly sensitive data. The data (reports, or form submissions) is ...
2
votes
1answer
99 views

Secure, Portable Bookmarks

A constant bugbear is my bookmarks being synced to my Google accounts, meaning access to them outside that Google account requires various manual steps. So it got me thinking of a roll your own way ...
2
votes
2answers
308 views

False acceptance rate in biometric authentication for sensitive information

Every type of biometric authentication will have a false acceptance rate, which is the likelihood that the system will incorrectly accept an access attempt by an unauthorized user. Of course, when ...
-1
votes
1answer
81 views

How can MyKi transfer data from iOS to macOS without a server?

MyKi.co claims to be able to transfer your passwords securely from your iOS device to the macOS without having to relay through their own servers. But how is this possible? "Your sensitive data is ...
6
votes
3answers
774 views

Which is a safe way to transfer a copy of a sensitive document?

A reputable and clearly identified institution asked me, for legitimate reasons, to e-mail a scan of the passport. However, I regard the passport as a sensitive document and am pretty reluctant to use ...
8
votes
2answers
336 views

How to separate storing sensitive data and hash passwords?

Scenario: I have a web application with an authentication system (classic). The application is basically an interface to a DB (MongoDB) which holds sensitive data. I properly hash the stored passwords....
0
votes
1answer
24 views

Medicare card & SSN - What can be done to prevent unauthorized SSN disclosure?

Those of us on Medicare realize that the card displays our SSNs just like the Social Security card. There was the case of the guy from LifeLock who published his, promising that his company would ...
0
votes
1answer
67 views

Privacy alternatives to keep sensible data secure? [closed]

I often find myself connecting to the internet through the University network and since I have to authenticate in order to navigate I guess that the system administrator can easily see any connection ...
1
vote
2answers
163 views

User name and password is passed in custom headers

Is it safe to pass username and password in two separate custom header tags in Web services/Web application Post request over https. How is it different from using from Authorization header. Which ...
3
votes
5answers
2k views

How to make an encrypted field searchable?

I am using attr_encrypted to store many fields. Trouble is I need to be able to search some of these fields. Take User.name. My current database has User.e_name and User.e_name_iv. While this seems ...
1
vote
1answer
90 views

Erasing the contents of a photocopier hard drive, in such a way that the copier can use it again

http://www.idtheftcenter.org/Identity-Theft/photocopying-sensitive-documents-you-might-want-to-think-again.html How do I erase the copier hard drive if I take it out, without damaging it so the ...
1
vote
1answer
224 views

secure mysql against data tempering? [closed]

As stated in the title, how do I secure mysql against data tempering? I have been searching the internet for a solution but did not find one that fills my needs. Let me describe my problem, assume I ...
3
votes
4answers
302 views

How to mitigate damage from a database dump?

Is there any good practice to mitigate potential damage from a potential database dump? I know the best practice is to not store any data at all, but we know that there is always sensitive data to ...
0
votes
2answers
170 views

How to create a format that is very difficult to reverse engineer? [closed]

I am learning about file formats. I have an application that will do analytics and will have some personal information. I need to make it such that only some people are able to access data and even ...
16
votes
6answers
4k views

How do I investigate where personal information in a fraudulent email was leaked from?

I have seen an email which is obvious from the content that it's a phishing/spurious email. However, the personal content is quite revealing and specific to that individual. How could I go about ...
1
vote
1answer
201 views

sensitive data temporarily stored, then redacted: PCI compliant?

I am at a startup where we have chat support. Agents chat with customers and sensitive data may be transmitted during the chat session window. We store this sensitive data in our database for the ...
0
votes
1answer
454 views

Data Masking in a database [closed]

Background The development team is receiving production data (as Database backup files) in order to fix bugs and application enhancements. The Development team restore these backups in their ...
2
votes
1answer
615 views

How can I prevent all Windows 10 Telemetry?

Let's assume I'm connecting to a network, and I need absolutely no data sent to any Microsoft servers at any time. Is there a way to do that? For the sake of argument, assume I'm running Enterprise.
1
vote
2answers
58 views

In what cases should applications be prepared for brute force?

Today I had an idea: I've been thinking that one can use brute force to get some data from a university from our country. It turned out my thoughts were true: an attacker can use brute force to ...
0
votes
1answer
46 views

Using Uber, Amazon apps in public networks

Everybody knows that one should not enter sensitive data in public wifi networks. Checking bank account using bar's wifi is not the best idea. But what about applications that also use sensitive ...
1
vote
4answers
99 views

Taking credit card info online recommendations

I have an online store in which customers can purchase a code which enables them to have use of a bot service I run. Part of the bot needs customers sensitive information to be entered, address, and ...
1
vote
2answers
74 views

When writing an API an that connects to the database, what information is sensitive and should be protected?

I am on a team that is writing a .NET Core API to service a desktop application. This application used to manage its own database connection through an OracleConnection, and all the values used to ...
1
vote
1answer
173 views

How to enter sensitive information securely?

I'm interested in finding out what is the best method to enter sensitive information somewhere given an insecure computer. Granted, I know that if the computer has a keylogger or some other malware ...
1
vote
0answers
54 views

Does using Oracle TDE guarantees compliance to HIPAA, for persisting sensitive data?

Persisting sensitive customer pharma data is becoming more challenging with stricter HIPAA compliance guidelines, wondering if TDE solves it entirely or are there any gaps that a developer/dba should ...