Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sensitive-data-exposure]

The tag has no usage guidance.

1
vote
1answer
54 views

How we can PoC our product that needs training data for our machine learning algorithm of the the bank clients?

Recently, we have had a challenge with potential future clients which are the bank. Our product requires to gather static data (e.g. address, loans, last 50 transactions, etc) of banks clients. These ...
1
vote
1answer
44 views

Encrypting data as a middleman

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money. As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
1
vote
0answers
45 views

How to treat SSN passing through web server

I am working on a platform that does temp labor and we are needing to run background checks. That means collecting scary data like SSNs, Names, Addresses, Dates Of Birth, and sending them to the ...
1
vote
2answers
71 views

How to securely transfer data from a public website, to a VPN-secured website?

I'm (currently) a VPN newby. I have a VPS with a few websites on it, hosted by liquid web. I have installed a medical records package (openEMR) in a sub-domain, in its own cPanel account. I intend to ...
25
votes
4answers
5k views

Do my Windows system binaries contain sensitive information?

I have a dataset from a malware detection project that others want to use. Part of that dataset is system binaries that I had retrieved from my PC by searching for *.exe files (to serve as a benign ...
2
votes
3answers
133 views

Are there examples of implementing security as a side effect?

I have long since felt that one of the best ways to effectively implement new security constructs is to implement it in the background, where it is not the primary feature of some new construct. This ...
0
votes
1answer
45 views

Which is more secure: saving reference link to file in file system in the database, or save the entire file into the database?

We have forms where we get clients to upload images of very sensitive information (passport, signature, etc.). We will store their written information into a database. However, there is the issue of ...
0
votes
0answers
21 views

How secure will it be to use “Google Docs long url” like authentication scheme for orders in my online shop? [duplicate]

For the sake of simplicity, instead of full-fledged authentication with login and password, I want to create "Google Docs long url" authentication scheme for my internet shop for the users. To let ...
0
votes
2answers
133 views

Sensitive data transmission over Internet

I was wondering how we should transfer our sensitive data (identity card softcopy, plaintext-password, secret documents, etc) over the internet securely, the following are a few related questions: Is ...
5
votes
2answers
789 views

How does full disk encryption cater for overprovisoned disk space in flash devices and can this result in data leakage?

My understanding is that flash based devices such as SSDs are over-provisioned and do not advertise the additional blocks of storage available to the operating system. The over-provisioned blocks of ...
27
votes
4answers
5k views

Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?

Working with a non-profit organization,it's common to reuse hard drives that have previously stored highly sensitive information such as medical and financial records. This is primarily driven by cost-...
1
vote
1answer
99 views

When is Veracrypt an acceptable solution?

To manage security risks effectively, a non-profit organization has the following high level requirements; Limit access to authorized staff. Sensitive data is only accessible to authorized staff. ...
5
votes
2answers
189 views

How important is it to delete disk partitions when wiping devices?

The command lsblk returns the following output that lists 4 partitions. sda 8:0 0 931.5G 0 disk ├─sda1 8:1 0 8M 0 part ├─sda2 8:2 0 40G 0 part / ├─sda3 8:3 0 883.8G ...
1
vote
0answers
37 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
3
votes
2answers
140 views

Can a data requester get the sender when “Sealed sender” is enabled in Signal?

The Signal app offers to seal the sender. The whole process can be summarized in the following steps: The app encrypts the message using Signal Protocol, as usual. Include the sender certificate and ...
1
vote
1answer
119 views

How to protect devices that are reliant on Bitlocker and a password without TPM?

In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker ...
0
votes
1answer
29 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
0
votes
0answers
73 views

Why do people redact MAC addresses? [duplicate]

What are the security implications of sharing a MAC address online? How important is it really, to redact this information; and why? I see it a lot, and I'm in the habit of doing it myself. 1. ...
2
votes
2answers
110 views

Sensitive data enumeration via HTTP error codes

Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user Bob a message to his cell phone which he registered on our ...
3
votes
1answer
286 views

Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?

I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
1
vote
0answers
44 views

Is creating a derived password safe?

I need to store really sensitive data in a client-hosted database. Since there's no way I can protect this database (because I don't own it), my idea was to encrypt it by using the user's password, so ...
1
vote
1answer
411 views

Is it safe to use unencrypted rsync when my backup is encrypted?

I've configured something usually advised against, but so far I have evaluated it seems perfectly safe to me. I'd like some opinions since playing with non-encrypted connections for my very sensitive ...
0
votes
0answers
62 views

Protecting sensitive data in cache

I have a java application which is reading sensitive data from database (open symmetric key, read data from database) and storing it in-memory cache. I want to make sure that no one should able to ...
7
votes
1answer
316 views

What are good methods of visual security?

What are good methods of visually securing sensitive information that might appear on your screen from the outside world? An example to illustrate my question would be the following: You're sat in ...
0
votes
2answers
113 views

User generated search queries

Are user generated search queries classed as sensitive data? For example, if an application put PII from a search query such as names, date of birth, addresses etc. in the query string of a URL (...
3
votes
1answer
75 views

Are there regulations that govern how social security numbers are stored and viewed?

I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few ...
12
votes
1answer
320 views

Browser cache information disclosure

Observing the time needed by a browser to load external resources such as images potentially discloses information about whether those resources have been accessed before. Explanation: For example, ...
2
votes
2answers
62 views

Ways to protect private data from other applications I installed

What methods can I use to protect certain important and private data like my ssh keys from other applications I might install? Is there anyway to block access to these files and restrict the access ...
3
votes
3answers
219 views

Is it safe to accept a file upload without any file extension?

Currently working on a website which allows users to upload data files for automated processing. For both security and user guidance purposes, we implemented an extension whitelist both client and ...
0
votes
2answers
110 views

How to give a web application a key in order to decrypt data in a database

My situation is that I need to store sensitive data in a database for a web application. The sensitive data includes things like refresh tokens for Oauth2 systems, secret keys for other APIs etc. I'm ...
0
votes
1answer
47 views

Processing sensitive user data on a server without the possibility of data theft?

I have written an application which I would like to offer via REST API to customers. In the task which is executed on the server there is some sensitive user data involved, e.g. the user's login to a ...
2
votes
1answer
75 views

Ways to impress children about web privacy violations and concerns

I would like to make a simple lesson to some children about the bad web surfing consequences for their privacy and personal data leaks. E.g. privacy issues by using social networks, visiting websites ...
4
votes
2answers
140 views

Same sensitive info in HTML reply that was posted before

Is it an issue to send back the same sensitive (PCI, PII) information from the server in the HTML reply that a user previously posted to the server? On our webpage, the user enters some key info (...
5
votes
1answer
179 views

Working on sensitive data on the cloud

In my current project for an NGO, I have to set up a system that allows members of the organisation to perform basic analysis on highly sensitive data. The data (reports, or form submissions) is ...
2
votes
1answer
99 views

Secure, Portable Bookmarks

A constant bugbear is my bookmarks being synced to my Google accounts, meaning access to them outside that Google account requires various manual steps. So it got me thinking of a roll your own way ...
3
votes
2answers
355 views

False acceptance rate in biometric authentication for sensitive information

Every type of biometric authentication will have a false acceptance rate, which is the likelihood that the system will incorrectly accept an access attempt by an unauthorized user. Of course, when ...
-1
votes
1answer
82 views

How can MyKi transfer data from iOS to macOS without a server?

MyKi.co claims to be able to transfer your passwords securely from your iOS device to the macOS without having to relay through their own servers. But how is this possible? "Your sensitive data is ...
6
votes
3answers
798 views

Which is a safe way to transfer a copy of a sensitive document?

A reputable and clearly identified institution asked me, for legitimate reasons, to e-mail a scan of the passport. However, I regard the passport as a sensitive document and am pretty reluctant to use ...
8
votes
2answers
360 views

How to separate storing sensitive data and hash passwords?

Scenario: I have a web application with an authentication system (classic). The application is basically an interface to a DB (MongoDB) which holds sensitive data. I properly hash the stored passwords....
0
votes
1answer
26 views

Medicare card & SSN - What can be done to prevent unauthorized SSN disclosure?

Those of us on Medicare realize that the card displays our SSNs just like the Social Security card. There was the case of the guy from LifeLock who published his, promising that his company would ...
0
votes
1answer
68 views

Privacy alternatives to keep sensible data secure? [closed]

I often find myself connecting to the internet through the University network and since I have to authenticate in order to navigate I guess that the system administrator can easily see any connection ...
1
vote
2answers
213 views

User name and password is passed in custom headers

Is it safe to pass username and password in two separate custom header tags in Web services/Web application Post request over https. How is it different from using from Authorization header. Which ...
3
votes
5answers
3k views

How to make an encrypted field searchable?

I am using attr_encrypted to store many fields. Trouble is I need to be able to search some of these fields. Take User.name. My current database has User.e_name and User.e_name_iv. While this seems ...
1
vote
1answer
91 views

Erasing the contents of a photocopier hard drive, in such a way that the copier can use it again

http://www.idtheftcenter.org/Identity-Theft/photocopying-sensitive-documents-you-might-want-to-think-again.html How do I erase the copier hard drive if I take it out, without damaging it so the ...
1
vote
1answer
243 views

secure mysql against data tempering? [closed]

As stated in the title, how do I secure mysql against data tempering? I have been searching the internet for a solution but did not find one that fills my needs. Let me describe my problem, assume I ...
3
votes
4answers
326 views

How to mitigate damage from a database dump?

Is there any good practice to mitigate potential damage from a potential database dump? I know the best practice is to not store any data at all, but we know that there is always sensitive data to ...
0
votes
2answers
173 views

How to create a format that is very difficult to reverse engineer? [closed]

I am learning about file formats. I have an application that will do analytics and will have some personal information. I need to make it such that only some people are able to access data and even ...
16
votes
6answers
4k views

How do I investigate where personal information in a fraudulent email was leaked from?

I have seen an email which is obvious from the content that it's a phishing/spurious email. However, the personal content is quite revealing and specific to that individual. How could I go about ...
1
vote
1answer
218 views

sensitive data temporarily stored, then redacted: PCI compliant?

I am at a startup where we have chat support. Agents chat with customers and sensitive data may be transmitted during the chat session window. We store this sensitive data in our database for the ...
0
votes
1answer
483 views

Data Masking in a database [closed]

Background The development team is receiving production data (as Database backup files) in order to fix bugs and application enhancements. The Development team restore these backups in their ...