Questions tagged [sensitive-data-exposure]
The sensitive-data-exposure tag has no usage guidance.
136
questions
0
votes
0
answers
18
views
Why is one particular page not being cached, and the others are? all have same caching headers [migrated]
I've been reading a bunch on how caching of web pages is handled, I feel like I have a good grasp on everything, but I've encountered something I don't understand.
I'm testing a site and it sends the ...
- 121
2
votes
1
answer
56
views
ListDLLs command (Listdlls.exe) Shady EULA
This dialog pops up upon running the command.
The dialog is essentially saying: "By using this software, it is the user's sole responsibility for any sensitive information provided to Microsoft ...
- 21
0
votes
0
answers
28
views
Are unlisted links to sensitive data acceptable? [duplicate]
A third-party vendor that hosts our data is sending us links to an s3 amazon server to download reports of our data as a CSV. The endpoint does not check any permissions of the person trying to ...
1
vote
1
answer
81
views
Encrypted user data and storing hashed RSA keys on the server for backup reasons
Imagine a mobile app that connects to an API server.
Disclaimer
I'm not sure if RSA is the right technique for this, please feel free to recommend alternatives.
The goal
The backend/database super ...
- 111
1
vote
1
answer
816
views
Microsoft Purview Sensitivity labels, best practices for setup?
Background
There have been more than a handful of recent security breaches at my company, involving social engineering and spoofed emails.
A malicious actor fraudulently spoofing one of our customers, ...
- 111
1
vote
1
answer
146
views
Would my hypothetical Opsec setup with the goal of compartmentalizing sensitive areas from an insecure sandbox be sensible?
The root cause of my problem stems from the fact that I need to run untrustworthy software on a bare metal windows machine, which means that I can't just have it in a VM because of major performance ...
0
votes
0
answers
84
views
Requests to malicious IP being sent by background process on Windows
Whenever an internet connection is established on my pc, I am repeatedly getting warnings from QuickHeal like this:
I am getting such warnings repeatedly with different IP addresses. In the above ...
- 1
0
votes
0
answers
668
views
Can I know if someone transferred files from my mobile to their computer
If someone connected my phone through USB to computer or laptop and transferred files from my mobile, is there any option to check in my mobile that they used particular apps or opened and transferred ...
0
votes
1
answer
68
views
Secret security in containerised environment
I've been having a discussion with a developer about storing sensitive information in environment variables. Specifically within a containerised environment such as Azures Container apps.
Background ...
- 123
0
votes
0
answers
24
views
How do I report that the organization is using common passwords for the backend [duplicate]
I was surfing on a big company's website, and I tried to make an account on it. I found that the account registration was quite buggy so I checked the page source. I found that there were error logs ...
- 101
1
vote
2
answers
202
views
What is the reason for Sensitive But Unclassified (SBU)?
I've been reading about security classifications, and have a fundamental question I can't seem to find an answer to. Why does the designation Sensitive But Unclassified (SBU) exist? Why not just ...
- 171
0
votes
0
answers
168
views
sensitive data exposure from RAM memory [duplicate]
I have software written in C# and compiled as a .exe file.
How can I read sensitive data (like usernames, passwords, etc.) from RAM while it runs?
0
votes
1
answer
306
views
Another browser opens URL without logging in
I was required to log in and pay an invoice but for some reason the website did not work with Safari due to a cookie issue as suggested by the alert banner and asked me to use a different browser. I ...
- 3
0
votes
2
answers
2k
views
How secure is R and RStudio?
I work at a clinic where we need to pseudonymize patient data. I wrote a small app for this using R (RStudio). R will be installed on computers with access to internet but my idea is to use R offline, ...
- 103
2
votes
0
answers
122
views
Kaspersky Total Security Data Vault encryption AES256 BUT with "effective key-length 56bit"
While comparing Kaspersky Total Security (KST) with Kaspersky Internet Security (KIS). One of the "extras" of KTS is the added "feature" of "Data Vaults", which "...
- 454
0
votes
2
answers
73
views
How to classify data sensitivity including accessibility & numbers
When classifying data sensitivity I generally run into a few standard categories such as:
Public
Internal
Confidential
Restricted
Which do generally cover the sensitivity levels but don't make it ...
- 123
0
votes
1
answer
461
views
What hidden metadata might be embedded in a PDF that is not visible "to the naked eye"?
I have edited a PDF file in Acrobat, which left some metadata and I am wondering:
What metadata might be possible to discern from the end file if I were to send it to external parties?
What actions ...
- 101
1
vote
0
answers
66
views
How are DDOS protection mechanisms setup when confidential data is involved?
Scenario:
A hospital has the records of all patients. There is an online portal where patients can login to see their personal medical data.
Since a hospital is an obvious target for any type of hack, ...
- 11
2
votes
1
answer
134
views
What should I do if my sensitive information is potentially leaked?
I sold an laptop recently, but didn’t care to do a secure erase to make sure there wasn’t any data left. After a long time, I suddenly realized that I shouldn’t have be so careless and began to worry ...
- 23
0
votes
1
answer
698
views
Can adblocker plus read your sensitive data or spy you? [duplicate]
Do adblockers read your sensitive data?
https://adblockplus.org/
I'm referring to this, its open-source but I feel worried.
- 1
1
vote
1
answer
300
views
How to secure data on production environment
Question
Suppose you design a data lake with sensitive data. Due to immaturity of tools, dynamic data masking is unavailable. You have MFA, encryption at rest, audit logging, ETL processing data and ...
- 225
2
votes
1
answer
199
views
How to prevent small mistakes that have massive impact?
I frequently have very personal files temporarily on my virtual desktop.
I sometimes download a new program, which is going into a VM. Before sending it in there, I tend to VirusTotal scan it.
I load ...
- 21
-2
votes
1
answer
137
views
Is it fine to save contact information on a ssh sever and is it secure?
My mom wants to find a way to store information securely and host it remotely and wants to host our own mini-server on a Raspberry Pi that'll have contact information of the customers.
My sister said ...
1
vote
0
answers
101
views
How to protect PII data from being sold or exposed by employees
For PII, we capture mostly emails, mobile and name of users who signup on our website. Along with this purchases made by users are also a sensitive data. Protecting this data for users privacy is as ...
- 159
0
votes
1
answer
115
views
How can I obliterate information on a defunct device, and should I?
I have old cell phones with problems that make them useless (non-responsive touch screen, black-on-black display, will not power up). I also have a bunch of solid-state USB memory devices that don't ...
- 101
1
vote
2
answers
9k
views
Local IndexedDB in Browser - is it really a security risk?
We have a web application that stores cached information in browser (both is firefox and chrome).
When we subjected it to Penetration Testing, a finding was filed saying that "Senstive Data such ...
2
votes
1
answer
472
views
PII Data Masking rules - what's acceptable and what's not
Is there a security rule on correct masking for sensitive information? Let's say we want to use prod data in our UAT environment. We're thinking of creating a masking logic when we transfer prod data ...
2
votes
1
answer
419
views
Website showing entered credit card number as valid or invalid [duplicate]
I noticed on a website that when I entered my credit card number, the entry box was highlighted blue:
I then tried a dummy credit card number, which made the box highlight red, indicating that credit ...
- 63
20
votes
2
answers
8k
views
Pwned by a website I never subscribed to - How do they have my e-mail address?
I searched my email addresses in https://haveibeenpwned.com/.
One of my e-mail addresses results as having been pwned, and is present in a data breach, in particular the Apollo data breach:
Apollo: ...
- 517
1
vote
2
answers
281
views
How is DNS sinkhole being use?
I had some difficulty in grasping the concept on how "DNS sinkhole" is being utilize.
Is it like setting up something similar to a honeypot to lure attackers away from the actual network, so ...
1
vote
0
answers
205
views
Temporary storage of sensitive information in Javascript
I am working at a university where we are creating a Website that allows students to apply for scholarships. Rather than print the application form, sign it then scan it then return it back, the ...
1
vote
2
answers
161
views
How can I give users access to thier data without requiring any authentication? [closed]
The premise of this question boils down to frictionless access to data. I have User A whose records I have kept on a database.
I want to send them a link to their records such that they can access ...
3
votes
2
answers
194
views
Encryption as bijective data masking function
Context
I'm building data lake from scratch within a small team (3-6 data engineers). I want to mask PII data when copying data from prod to dev/test environments.
I'm particularly interested in the ...
- 225
3
votes
1
answer
175
views
Exposing employee numbers, how bad is it?
I've realised that there is an easy way for someone who is external to figure out valid employee numbers at my company.
And I'm fairly sure they could then be linked to a full name easily too.
I've ...
- 133
0
votes
1
answer
190
views
Should encryption key be stored remotely?
Consider the following scenarios of storing sensitive data locally on a network connected always-on device:
without any data encryption whatsoever
with encryption, the key stored locally in the ...
- 103
2
votes
3
answers
209
views
School Request: What can be done protect people's financial information?
This is a bit of an odd question, and if it doesn't belong on this forum feel free to retract. I was asked by a group of 7th graders to share my thoughts on the problem of credit card data breaches. ...
- 123
0
votes
0
answers
88
views
Web Browser Forgetting Between Users
I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
- 51
7
votes
1
answer
853
views
Does WhatsApp's link preview on the link messages leak information?
When we want to send a message that contains only a link - such as a question from the Stack Exchange network - WhatsApp displays information from the website as below:
Does this leak information ...
- 5,504
2
votes
1
answer
931
views
I snapped my micro SD card into 8 pieces before throwing it away. Should I be worried that someone can get my data?
The card was a 16gb SanDisk micro SD card (monolithic).
user242798
30
votes
6
answers
6k
views
As a contractor how do I work on multiple client networks without data leakage?
I am a contractor who does development for more than one client. Let's call them Client A, Client B, and Client X.
I use my own laptop for all 3 clients.
Throughout the day, I have to work on and ...
- 401
6
votes
3
answers
303
views
Using an example to comprehend why “safely” erasing a drive yields better results than filling it up with meaningless data
A hypothetical 1GB USB stick is full of sensitive documents/images/etc. and it is not encrypted.
The owner wishes to discard it and is aware of having to safely erase it first.
There are several tools ...
1
vote
2
answers
307
views
How can one encrypt a file and be sure the original file can not be recovered on a SSD?
Let's say that I have an unencrypted file and I'm trying to encrypt it and make sure the original file can not be recovered from my disk. If I, for example, create an archive, put the file into it and ...
0
votes
1
answer
115
views
Is it good idea to re-authenticate a user to access sensitive actions and data?
In a web application there are several pages in which you have sensitvie data and actions like access controls or user management page. Is it a good idea to re-authenticate user to access those pages? ...
3
votes
0
answers
206
views
What is the Meow Attack and how can I guard my databases against it?
Recently, there has been some news articles about unsolicited attacks on unsecured public facing Elastic and Mongo databases. These are commonly being called "Meow" attacks, resulting in ...
- 968
0
votes
3
answers
127
views
What security concerns are there regarding website users inputting personal financial data without putting in personally identifying data?
I am a web developer, but I have only a rudimentary grasp of security, e.g., be careful to sanitize inputs, store as little user data as possible, encrypt passwords, keep up with security issues of ...
- 103
1
vote
1
answer
90
views
Autofilling sensitive information for publicly available form
We are in the process of designing an app which, simply put, will allow people to accept payments easily.
The customer won't need an account and we'll be linking customer data (name, address, and ...
- 227
0
votes
0
answers
194
views
Ionic local storage store sensitive data for private app
I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
- 1
3
votes
3
answers
907
views
Does GDPR apply for volatile data
GDPR aims to set standards (and requirements) on how sensitive data should be stored. Although, I couldn't find any information on how (or if even) GDPR applies for sensitive data in a volatile state. ...
- 133
2
votes
1
answer
507
views
Off-Facebook activities received from apps and websites NEVER logged in via Facebook
Facebook has recently launched "off facebook activity" which lets you see all the activities shared by other apps/websites that you have interacted with.
But how did those apps and websites share ...
- 121
1
vote
5
answers
1k
views
Username in browser history (url) - is this a security problem?
We have a client complaining that there is PII in the browser history (as in the persistent history you get to through your browser's menu - Ctrl + H in Chrome). For example, the URL for editing a ...
- 149