Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [sensitive-data-exposure]

The tag has no usage guidance.

1
vote
0answers
34 views

Are missing access logs for a non-production environment populated with over 5 million patient records a big deal?

LOL. I have no background in infosec, so I was hoping to get some input on a very strange thing that has come up involving my local health service provider. Any input would be swell! - A case ...
3
votes
2answers
101 views

Can a data requester get the sender when “Sealed sender” is enabled in Signal?

The Signal app offers to seal the sender. The whole process can be summarized in the following steps: The app encrypts the message using Signal Protocol, as usual. Include the sender certificate and ...
1
vote
1answer
57 views

How to protect devices that are reliant on Bitlocker and a password without TPM?

In working with a number of non-profit organizations, devices such as laptops used by staff are encrypted using Bitlocker. Unfortunately since the devices (often donated) do not feature TPM, Bitlocker ...
0
votes
1answer
25 views

Is there any other way through which an attacker can obtain user data from HTTP response except MITM and CORS attack?

I am doing some research for my college project and I want to ask is there any other way through which an attacker can obtain data from HTTP response except MITM and CORS attack. For an example, If I ...
0
votes
0answers
55 views

Why do people redact MAC addresses? [duplicate]

What are the security implications of sharing a MAC address online? How important is it really, to redact this information; and why? I see it a lot, and I'm in the habit of doing it myself. 1. ...
0
votes
0answers
54 views

Technical Repercussions of SSN briefly touching a server

I need to safely pass a SSN to Stripe from a web page. (We are doing taxes for our contractors) I am well aware that storing a SSN is not a good idea. We don't need to. Stripe can handle it, but I am ...
0
votes
0answers
22 views

How to prevent Oracle TNS protocol sending data in plaintext?

I am doing a security audit and discovered an Oracle Server pulling data from an ODS server in plaintext. I am able to sniff the traffic from one of the internal servers. Essentially, the Oracle ...
2
votes
2answers
95 views

Sensitive data enumeration via HTTP error codes

Let's assume there is a website with an API that supports the following REST call in which authenticated user Alice can send registered user Bob a message to his cell phone which he registered on our ...
3
votes
1answer
98 views

Is cache-control: no-cache enough for sensitive information like bank accounts, etc.?

I have read somewhere that when storing sensitive information on a website you should include cache-control: no-store for telling the browser not to store that information on the local system. But I ...
1
vote
0answers
41 views

Is creating a derived password safe?

I need to store really sensitive data in a client-hosted database. Since there's no way I can protect this database (because I don't own it), my idea was to encrypt it by using the user's password, so ...
1
vote
1answer
263 views

Is it safe to use unencrypted rsync when my backup is encrypted?

I've configured something usually advised against, but so far I have evaluated it seems perfectly safe to me. I'd like some opinions since playing with non-encrypted connections for my very sensitive ...
0
votes
0answers
42 views

Protecting sensitive data in cache

I have a java application which is reading sensitive data from database (open symmetric key, read data from database) and storing it in-memory cache. I want to make sure that no one should able to ...
7
votes
1answer
309 views

What are good methods of visual security?

What are good methods of visually securing sensitive information that might appear on your screen from the outside world? An example to illustrate my question would be the following: You're sat in ...
0
votes
2answers
110 views

User generated search queries

Are user generated search queries classed as sensitive data? For example, if an application put PII from a search query such as names, date of birth, addresses etc. in the query string of a URL (...
2
votes
1answer
53 views

Are there regulations that govern how social security numbers are stored and viewed?

I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few ...
12
votes
1answer
259 views

Browser cache information disclosure

Observing the time needed by a browser to load external resources such as images potentially discloses information about whether those resources have been accessed before. Explanation: For example, ...
2
votes
2answers
62 views

Ways to protect private data from other applications I installed

What methods can I use to protect certain important and private data like my ssh keys from other applications I might install? Is there anyway to block access to these files and restrict the access ...
3
votes
3answers
147 views

Is it safe to accept a file upload without any file extension?

Currently working on a website which allows users to upload data files for automated processing. For both security and user guidance purposes, we implemented an extension whitelist both client and ...
0
votes
2answers
101 views

How to give a web application a key in order to decrypt data in a database

My situation is that I need to store sensitive data in a database for a web application. The sensitive data includes things like refresh tokens for Oauth2 systems, secret keys for other APIs etc. I'm ...
0
votes
1answer
47 views

Processing sensitive user data on a server without the possibility of data theft?

I have written an application which I would like to offer via REST API to customers. In the task which is executed on the server there is some sensitive user data involved, e.g. the user's login to a ...
2
votes
1answer
73 views

Ways to impress children about web privacy violations and concerns

I would like to make a simple lesson to some children about the bad web surfing consequences for their privacy and personal data leaks. E.g. privacy issues by using social networks, visiting websites ...
4
votes
2answers
132 views

Same sensitive info in HTML reply that was posted before

Is it an issue to send back the same sensitive (PCI, PII) information from the server in the HTML reply that a user previously posted to the server? On our webpage, the user enters some key info (...
5
votes
1answer
178 views

Working on sensitive data on the cloud

In my current project for an NGO, I have to set up a system that allows members of the organisation to perform basic analysis on highly sensitive data. The data (reports, or form submissions) is ...
2
votes
1answer
96 views

Secure, Portable Bookmarks

A constant bugbear is my bookmarks being synced to my Google accounts, meaning access to them outside that Google account requires various manual steps. So it got me thinking of a roll your own way ...
2
votes
2answers
268 views

False acceptance rate in biometric authentication for sensitive information

Every type of biometric authentication will have a false acceptance rate, which is the likelihood that the system will incorrectly accept an access attempt by an unauthorized user. Of course, when ...
-1
votes
1answer
75 views

How can MyKi transfer data from iOS to macOS without a server?

MyKi.co claims to be able to transfer your passwords securely from your iOS device to the macOS without having to relay through their own servers. But how is this possible? "Your sensitive data is ...
6
votes
3answers
756 views

Which is a safe way to transfer a copy of a sensitive document?

A reputable and clearly identified institution asked me, for legitimate reasons, to e-mail a scan of the passport. However, I regard the passport as a sensitive document and am pretty reluctant to use ...
8
votes
2answers
310 views

How to separate storing sensitive data and hash passwords?

Scenario: I have a web application with an authentication system (classic). The application is basically an interface to a DB (MongoDB) which holds sensitive data. I properly hash the stored passwords....
0
votes
1answer
24 views

Medicare card & SSN - What can be done to prevent unauthorized SSN disclosure?

Those of us on Medicare realize that the card displays our SSNs just like the Social Security card. There was the case of the guy from LifeLock who published his, promising that his company would ...
0
votes
1answer
65 views

Privacy alternatives to keep sensible data secure? [closed]

I often find myself connecting to the internet through the University network and since I have to authenticate in order to navigate I guess that the system administrator can easily see any connection ...
1
vote
2answers
143 views

User name and password is passed in custom headers

Is it safe to pass username and password in two separate custom header tags in Web services/Web application Post request over https. How is it different from using from Authorization header. Which ...
3
votes
5answers
2k views

How to make an encrypted field searchable?

I am using attr_encrypted to store many fields. Trouble is I need to be able to search some of these fields. Take User.name. My current database has User.e_name and User.e_name_iv. While this seems ...
1
vote
1answer
89 views

Erasing the contents of a photocopier hard drive, in such a way that the copier can use it again

http://www.idtheftcenter.org/Identity-Theft/photocopying-sensitive-documents-you-might-want-to-think-again.html How do I erase the copier hard drive if I take it out, without damaging it so the ...
1
vote
1answer
207 views

secure mysql against data tempering? [closed]

As stated in the title, how do I secure mysql against data tempering? I have been searching the internet for a solution but did not find one that fills my needs. Let me describe my problem, assume I ...
3
votes
4answers
285 views

How to mitigate damage from a database dump?

Is there any good practice to mitigate potential damage from a potential database dump? I know the best practice is to not store any data at all, but we know that there is always sensitive data to ...
0
votes
2answers
163 views

How to create a format that is very difficult to reverse engineer? [closed]

I am learning about file formats. I have an application that will do analytics and will have some personal information. I need to make it such that only some people are able to access data and even ...
16
votes
6answers
4k views

How do I investigate where personal information in a fraudulent email was leaked from?

I have seen an email which is obvious from the content that it's a phishing/spurious email. However, the personal content is quite revealing and specific to that individual. How could I go about ...
1
vote
1answer
187 views

sensitive data temporarily stored, then redacted: PCI compliant?

I am at a startup where we have chat support. Agents chat with customers and sensitive data may be transmitted during the chat session window. We store this sensitive data in our database for the ...
0
votes
1answer
432 views

Data Masking in a database [closed]

Background The development team is receiving production data (as Database backup files) in order to fix bugs and application enhancements. The Development team restore these backups in their ...
2
votes
1answer
585 views

How can I prevent all Windows 10 Telemetry?

Let's assume I'm connecting to a network, and I need absolutely no data sent to any Microsoft servers at any time. Is there a way to do that? For the sake of argument, assume I'm running Enterprise.
1
vote
2answers
57 views

In what cases should applications be prepared for brute force?

Today I had an idea: I've been thinking that one can use brute force to get some data from a university from our country. It turned out my thoughts were true: an attacker can use brute force to ...
0
votes
1answer
45 views

Using Uber, Amazon apps in public networks

Everybody knows that one should not enter sensitive data in public wifi networks. Checking bank account using bar's wifi is not the best idea. But what about applications that also use sensitive ...
1
vote
4answers
98 views

Taking credit card info online recommendations

I have an online store in which customers can purchase a code which enables them to have use of a bot service I run. Part of the bot needs customers sensitive information to be entered, address, and ...
1
vote
2answers
63 views

When writing an API an that connects to the database, what information is sensitive and should be protected?

I am on a team that is writing a .NET Core API to service a desktop application. This application used to manage its own database connection through an OracleConnection, and all the values used to ...
1
vote
1answer
172 views

How to enter sensitive information securely?

I'm interested in finding out what is the best method to enter sensitive information somewhere given an insecure computer. Granted, I know that if the computer has a keylogger or some other malware ...
1
vote
0answers
49 views

Does using Oracle TDE guarantees compliance to HIPAA, for persisting sensitive data?

Persisting sensitive customer pharma data is becoming more challenging with stricter HIPAA compliance guidelines, wondering if TDE solves it entirely or are there any gaps that a developer/dba should ...
0
votes
1answer
73 views

Identity exposure by using same proxy?

I read several times it is a very bad idea and a huge lack of security to use the same proxy for logging into facebook or other sites containing information about real personal details e.g. linkedin ...
5
votes
5answers
3k views

Hiding sensitive data in URIs

This is a potentially hypothetical question since it has not been determined whether we will be required to do this but I figure it's a question that will come up more often. Background When ...
1
vote
1answer
73 views

Capturing sensitive data within legal restrictions? [closed]

As a web development agency we're currently taking on a site rebuild for a recruitment agency. The current site allows applicants to register as temporary workers for the agency ( our client ) who ...
3
votes
1answer
174 views

Why is it better to encrypt data in an application server than in the database server?

This is when protecting sensitive data in an application. As given in the OWASP Top 10: A6 Sensitive Data Exposure.