Questions tagged [sensitive-data-exposure]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
0answers
58 views

Reference request: Password disclosure regulations and practices [closed]

Note: This is an comprehensive version of the question asked on Law SE. As also suggested in the (so far) only answer there, the question would be better served here. It's well known that you should ...
0
votes
0answers
45 views

Is there any Windows HIPS software that supports file and registry access control?

I Have been using COMODO Firewall and HIPS for many years, which can block writes and executes but not reads. My threat model has changed to include spyware with trusted digital signature, which by ...
1
vote
1answer
36 views

Autofilling sensitive information for publicly available form

We are in the process of designing an app which, simply put, will allow people to accept payments easily. The customer won't need an account and we'll be linking customer data (name, address, and ...
0
votes
0answers
53 views

Ionic local storage store sensitive data for private app

I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
2
votes
3answers
116 views

Does GDPR apply for volatile data

GDPR aims to set standards (and requirements) on how sensitive data should be stored. Although, I couldn't find any information on how (or if even) GDPR applies for sensitive data in a volatile state. ...
1
vote
1answer
80 views

Off-Facebook activities received from apps and websites NEVER logged in via Facebook

Facebook has recently launched "off facebook activity" which lets you see all the activities shared by other apps/websites that you have interacted with. But how did those apps and websites share ...
1
vote
3answers
103 views

Username in browser history (url) - is this a security problem?

We have a client complaining that there is PII in the browser history (as in the persistent history you get to through your browser's menu - Ctrl + H in Chrome). For example, the URL for editing a ...
0
votes
0answers
76 views

Is it possible to fuzz/dirbuster a .onion website?

It's possible to fuzz/dirbuster a classic web site to search hidden or sensitive ressources/data. This command can do it : wfuzz -w wordlist/general/common.txt http://testphp.vulnweb.com/FUZZ My ...
2
votes
1answer
97 views

URL Contains Sensitive Data - Alternative Besides Switching To Post?

One of my company's clients recently produced an application security assessment report, noting a list of violations based on OWASP's top 10 list of web application security risks. One of the ...
1
vote
3answers
62 views

What are the best practices in a manufacturing/production facility for data retention?

My scenario: A production facility that uses data sets provided by customer(s) to produce personalized goods in bulk. Data sets can range from 100,000 to 2,000,000 names and addresses in the US. ...
1
vote
3answers
126 views

Is it safe and permissive to remember devices to skip two factor authentication when dealing with sensitive information?

We're a small UK startup building a small service that allows certain special people (e.g. journalists) to access non-public court information. This information includes a ton of private and ...
3
votes
1answer
84 views

Is it possible to use WeChat (Weixin) more safely in recent versions of Android by using permissions?

I assume that anything written or read on WeChat is read by the government of the People's Republic of China. I understand the risks of that. However, I would like to understand the implications of ...
1
vote
1answer
73 views

Would there be a secure way to store an encryption key on server side for front-end decryption?

I am currently working on a web application with sensitive data to store (personal medical data). The app is on the very first stages of conception and I am to quickly produce a beta version that ...
3
votes
1answer
137 views

A workaround for external website's HTTP registration page

There is a website which I want to register for but it is a internship/job-seeking website and thus on registration some VERY sensitive data is required. When registering Firefox alerted me that the ...
18
votes
3answers
2k views

How to deal with a company that doesn't fix (potential) security vulnerabilities in their web app?

About 2 weeks ago, I stumbled across a web application, that can be used by gyms to manage the information about their members. This includes data like the name, billing address, birth date, and ...
1
vote
1answer
62 views

Can any of your recognisable personal information be linked to your device fingerprint?

I learned that a device probably has a device fingerprint to the eyes of a company that operates online. I'm not sure how this fingerprint is managed by its collectors, but it's plausible that it ...
0
votes
1answer
97 views

What kind of local information are desktop applications capable to retrieve (and use) from my computer?

I've already seen on Windows what kind of information the Steam application is sending online: time, place and device of the connection, time passed playing the games, payments, mail, numbers, etc. ...
1
vote
1answer
64 views

Posting from HTTPS without specifying protocol - secure?

I have a form that is on a secure (HTTPS) page, which posts to another page. In the form action, the protocol is not specified but I would assume uses the same protocol as the page that it came from, ...
2
votes
2answers
125 views

User passwords printed on paperwork at a dental office?

My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork. I asked on Law.stackexchange and it doesn't sound like this is a ...
3
votes
0answers
66 views

Zeroization of sensitive data in Functional Programming Languages

Concerning the very familiar (and sensible) security practice of Zeroizing sensitive data from memory after you're finished with it, such as Cryptographic keys, passwords, etc, I was pondering how you ...
2
votes
0answers
390 views

Employ fscrypt to securely protect, from data-at-rest exposure, all files+data installed after an initial Linux system build?

Our team's goal We want to protect our sensitive data from being potentially data-at-rest exposed after we relinquish a Linux VPS (see below) provided by a hosting service. We're exploring simple(r) ...
0
votes
0answers
37 views

Securing user secrets in KeyChain vs Keychain+Biometrics

The common approach to secure user secrets in native applications seems to be storing the secret in keychain and adding an additional layer of protection by way of biometrics/touchId/FaceID. My ...
0
votes
1answer
107 views

Windows Encrypted temp directory for files at rest in Windows?

It would be nice if there was an area on my computer where I could work with temp files that may contain sensitive information that could be encrypted with bitlocker or something similar when the ...
23
votes
12answers
13k views

Is there a way to hide HTML source code yet keeping it effective?

I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP): <form action="mailto:someone@example.com"> Email Adress:<br> ...
0
votes
1answer
64 views

Exposing a version number through the assets urls

I just received a blackbox pentesting report where the security company recommended to hide the version number from the page (be it returned to the user as a text or used as a cache-buster in the css/...
0
votes
0answers
141 views

Securing Clipboard Memory

Sometimes sensitive data is copied from/to processes and external devices like (long)passwords, usernames and so forth , but also often people don't get this always in mind and forget to clean that ...
9
votes
1answer
1k views

Employer stores plain text personal data in a 'data warehouse' [closed]

I'm unsure if I have posted this in the correct community but the organisation I am currently working for currently uses an SQL 'data warehouse' which contains a bunch of tables from various sources, ...
0
votes
0answers
44 views

Is it a security concern that nginx ingress controller in kubernetes exposes well known endpoints? (/healthz)

If one uses nignx ingress controller in a kubernetes cluster, it exposes something that is called a "default backend" that is used each time no internal routing is found. E.g. if one uses an IP in a ...
25
votes
3answers
7k views

Computer name naming convention for security

I've been doing a security audit and found out you can easily identify host roles and running services just by their computer name (using nslookup). I would like to report this so that they use less ...
0
votes
1answer
67 views

How could you safeguard your data traces when using USB Drive?

I have a very serious question with regard to data security with regard to usage of USB Drive when transmitting, storing or even clearing data with it. When one is going to use USB Drive for ...
0
votes
2answers
1k views

Local File Inclusion [ Post-Exploitation ]

I am curious what kind of sensitive files should I look for on a Windows server which is vulnerable to LFI compared to Linux? I mean the first file or common files which a pentester or an ...
2
votes
2answers
183 views

Does “Restore Factory Defaults” Wipe Out My Data Completely?

I used to have a IBM Thinkpad (Lenovo) T440. I have been using that laptop for over 8 years. This device has been reset to factory default multiple times (probably up to 6-10 times if not more) ...
1
vote
1answer
64 views

How we can PoC our product that needs training data for our machine learning algorithm of the the bank clients?

Recently, we have had a challenge with potential future clients which are the bank. Our product requires to gather static data (e.g. address, loans, last 50 transactions, etc) of banks clients. These ...
1
vote
1answer
90 views

Encrypting data as a middleman

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money. As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
1
vote
0answers
67 views

How to treat SSN passing through web server

I am working on a platform that does temp labor and we are needing to run background checks. That means collecting scary data like SSNs, Names, Addresses, Dates Of Birth, and sending them to the ...
1
vote
2answers
161 views

How to securely transfer data from a public website, to a VPN-secured website?

I'm (currently) a VPN newby. I have a VPS with a few websites on it, hosted by liquid web. I have installed a medical records package (openEMR) in a sub-domain, in its own cPanel account. I intend to ...
26
votes
4answers
5k views

Do my Windows system binaries contain sensitive information?

I have a dataset from a malware detection project that others want to use. Part of that dataset is system binaries that I had retrieved from my PC by searching for *.exe files (to serve as a benign ...
2
votes
3answers
167 views

Are there examples of implementing security as a side effect?

I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
0
votes
1answer
54 views

Which is more secure: saving reference link to file in file system in the database, or save the entire file into the database?

We have forms where we get clients to upload images of very sensitive information (passport, signature, etc.). We will store their written information into a database. However, there is the issue of ...
0
votes
0answers
28 views

How secure will it be to use “Google Docs long url” like authentication scheme for orders in my online shop? [duplicate]

For the sake of simplicity, instead of full-fledged authentication with login and password, I want to create "Google Docs long url" authentication scheme for my internet shop for the users. To let ...
0
votes
1answer
180 views

Sensitive data transmission over Internet

I was wondering how we should transfer our sensitive data (identity card softcopy, plaintext-password, secret documents, etc) over the internet securely, the following are a few related questions: Is ...
5
votes
2answers
961 views

How does full disk encryption cater for overprovisoned disk space in flash devices and can this result in data leakage?

My understanding is that flash based devices such as SSDs are over-provisioned and do not advertise the additional blocks of storage available to the operating system. The over-provisioned blocks of ...
28
votes
4answers
5k views

Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?

Working with a non-profit organization,it's common to reuse hard drives that have previously stored highly sensitive information such as medical and financial records. This is primarily driven by cost-...
2
votes
1answer
369 views

When is Veracrypt an acceptable solution?

To manage security risks effectively, a non-profit organization has the following high level requirements; Limit access to authorized staff. Sensitive data is only accessible to authorized staff. ...
5
votes
2answers
201 views

How important is it to delete disk partitions when wiping devices?

The command lsblk returns the following output that lists 4 partitions. sda 8:0 0 931.5G 0 disk ├─sda1 8:1 0 8M 0 part ├─sda2 8:2 0 40G 0 part / ├─sda3 8:3 0 883.8G ...
1
vote
0answers
45 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
3
votes
2answers
256 views

Can a data requester get the sender when “Sealed sender” is enabled in Signal?

The Signal app offers to seal the sender. The whole process can be summarized in the following steps: The app encrypts the message using Signal Protocol, as usual. Include the sender certificate and ...
1
vote
1answer
217 views

How to protect devices that are reliant on Bitlocker and a password without TPM?

In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker ...
0
votes
1answer
45 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
0
votes
0answers
110 views

Why do people redact MAC addresses? [duplicate]

What are the security implications of sharing a MAC address online? How important is it really, to redact this information; and why? I see it a lot, and I'm in the habit of doing it myself. 1. ...