People who code: we want your input. Take the Survey

Questions tagged [sensitive-data-exposure]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0
votes
1answer
60 views

Is it fine to save contact information on a ssh sever and is it secure?

My mom wants to find a way to store information securely and host it remotely and wants to host our own mini-server on a Raspberry Pi that'll have contact information of the customers. My sister said ...
1
vote
0answers
49 views

How to protect PII data from being sold or exposed by employees

For PII, we capture mostly emails, mobile and name of users who signup on our website. Along with this purchases made by users are also a sensitive data. Protecting this data for users privacy is as ...
0
votes
1answer
67 views

How can I obliterate information on a defunct device, and should I?

I have old cell phones with problems that make them useless (non-responsive touch screen, black-on-black display, will not power up). I also have a bunch of solid-state USB memory devices that don't ...
0
votes
2answers
282 views

Local IndexedDB in Browser - is it really a security risk?

We have a web application that stores cached information in browser (both is firefox and chrome). When we subjected it to Penetration Testing, a finding was filed saying that "Senstive Data such ...
1
vote
1answer
43 views

PII Data Masking rules - what's acceptable and what's not

Is there a security rule on correct masking for sensitive information? Let's say we want to use prod data in our UAT environment. We're thinking of creating a masking logic when we transfer prod data ...
1
vote
1answer
99 views

Website showing entered credit card number as valid or invalid [duplicate]

I noticed on a website that when I entered my credit card number, the entry box was highlighted blue: I then tried a dummy credit card number, which made the box highlight red, indicating that credit ...
21
votes
2answers
7k views

Pwned by a website I never subscribed to - How do they have my e-mail address?

I searched my email addresses in https://haveibeenpwned.com/. One of my e-mail addresses results as having been pwned, and is present in a data breach, in particular the Apollo data breach: Apollo: ...
1
vote
2answers
80 views

How is DNS sinkhole being use?

I had some difficulty in grasping the concept on how "DNS sinkhole" is being utilize. Is it like setting up something similar to a honeypot to lure attackers away from the actual network, so ...
1
vote
0answers
51 views

Temporary storage of sensitive information in Javascript

I am working at a university where we are creating a Website that allows students to apply for scholarships. Rather than print the application form, sign it then scan it then return it back, the ...
1
vote
2answers
95 views

How can I give users access to thier data without requiring any authentication? [closed]

The premise of this question boils down to frictionless access to data. I have User A whose records I have kept on a database. I want to send them a link to their records such that they can access ...
3
votes
2answers
99 views

Encryption as bijective data masking function

Context I'm building data lake from scratch within a small team (3-6 data engineers). I want to mask PII data when copying data from prod to dev/test environments. I'm particularly interested in the ...
2
votes
1answer
108 views

Exposing employee numbers, how bad is it?

I've realised that there is an easy way for someone who is external to figure out valid employee numbers at my company. And I'm fairly sure they could then be linked to a full name easily too. I've ...
0
votes
1answer
84 views

Should encryption key be stored remotely?

Consider the following scenarios of storing sensitive data locally on a network connected always-on device: without any data encryption whatsoever with encryption, the key stored locally in the ...
2
votes
3answers
141 views

School Request: What can be done protect people's financial information?

This is a bit of an odd question, and if it doesn't belong on this forum feel free to retract. I was asked by a group of 7th graders to share my thoughts on the problem of credit card data breaches. ...
0
votes
0answers
47 views

Web Browser Forgetting Between Users

I am planning to go door-to-door and host events in which people use a computer to login to the Arizona Secretary of State website, enter sensitive information (like address, social security number, ...
7
votes
1answer
500 views

Does WhatsApp's link preview on the link messages leak information?

When we want to send a message that contains only a link - such as a question from the Stack Exchange network - WhatsApp displays information from the website as below: Does this leak information ...
2
votes
1answer
200 views
30
votes
6answers
6k views

As a contractor how do I work on multiple client networks without data leakage?

I am a contractor who does development for more than one client. Let's call them Client A, Client B, and Client X. I use my own laptop for all 3 clients. Throughout the day, I have to work on and ...
6
votes
3answers
248 views

Using an example to comprehend why “safely” erasing a drive yields better results than filling it up with meaningless data

A hypothetical 1GB USB stick is full of sensitive documents/images/etc. and it is not encrypted. The owner wishes to discard it and is aware of having to safely erase it first. There are several tools ...
1
vote
2answers
139 views

How can one encrypt a file and be sure the original file can not be recovered on a SSD?

Let's say that I have an unencrypted file and I'm trying to encrypt it and make sure the original file can not be recovered from my disk. If I, for example, create an archive, put the file into it and ...
0
votes
1answer
54 views

Is it good idea to re-authenticate a user to access sensitive actions and data?

In a web application there are several pages in which you have sensitvie data and actions like access controls or user management page. Is it a good idea to re-authenticate user to access those pages? ...
3
votes
0answers
142 views

What is the Meow Attack and how can I guard my databases against it?

Recently, there has been some news articles about unsolicited attacks on unsecured public facing Elastic and Mongo databases. These are commonly being called "Meow" attacks, resulting in ...
1
vote
3answers
88 views

What security concerns are there regarding website users inputting personal financial data without putting in personally identifying data?

I am a web developer, but I have only a rudimentary grasp of security, e.g., be careful to sanitize inputs, store as little user data as possible, encrypt passwords, keep up with security issues of ...
0
votes
0answers
93 views

Is there any Windows HIPS software that supports file and registry access control?

I Have been using COMODO Firewall and HIPS for many years, which can block writes and executes but not reads. My threat model has changed to include spyware with trusted digital signature, which by ...
1
vote
1answer
46 views

Autofilling sensitive information for publicly available form

We are in the process of designing an app which, simply put, will allow people to accept payments easily. The customer won't need an account and we'll be linking customer data (name, address, and ...
0
votes
0answers
93 views

Ionic local storage store sensitive data for private app

I'm new to the ionic framework and have some basics of it and currently I'm developing a private app for my family only that store some sensitive information in the localstorage. I used some crypto ...
3
votes
3answers
278 views

Does GDPR apply for volatile data

GDPR aims to set standards (and requirements) on how sensitive data should be stored. Although, I couldn't find any information on how (or if even) GDPR applies for sensitive data in a volatile state. ...
2
votes
1answer
372 views

Off-Facebook activities received from apps and websites NEVER logged in via Facebook

Facebook has recently launched "off facebook activity" which lets you see all the activities shared by other apps/websites that you have interacted with. But how did those apps and websites share ...
1
vote
3answers
267 views

Username in browser history (url) - is this a security problem?

We have a client complaining that there is PII in the browser history (as in the persistent history you get to through your browser's menu - Ctrl + H in Chrome). For example, the URL for editing a ...
2
votes
1answer
282 views

URL Contains Sensitive Data - Alternative Besides Switching To Post?

One of my company's clients recently produced an application security assessment report, noting a list of violations based on OWASP's top 10 list of web application security risks. One of the ...
1
vote
3answers
64 views

What are the best practices in a manufacturing/production facility for data retention?

My scenario: A production facility that uses data sets provided by customer(s) to produce personalized goods in bulk. Data sets can range from 100,000 to 2,000,000 names and addresses in the US. ...
1
vote
3answers
353 views

Is it safe and permissive to remember devices to skip two factor authentication when dealing with sensitive information?

We're a small UK startup building a small service that allows certain special people (e.g. journalists) to access non-public court information. This information includes a ton of private and ...
3
votes
1answer
221 views

Is it possible to use WeChat (Weixin) more safely in recent versions of Android by using permissions?

I assume that anything written or read on WeChat is read by the government of the People's Republic of China. I understand the risks of that. However, I would like to understand the implications of ...
1
vote
1answer
132 views

Would there be a secure way to store an encryption key on server side for front-end decryption?

I am currently working on a web application with sensitive data to store (personal medical data). The app is on the very first stages of conception and I am to quickly produce a beta version that ...
3
votes
1answer
143 views

A workaround for external website's HTTP registration page

There is a website which I want to register for but it is a internship/job-seeking website and thus on registration some VERY sensitive data is required. When registering Firefox alerted me that the ...
18
votes
3answers
2k views

How to deal with a company that doesn't fix (potential) security vulnerabilities in their web app?

About 2 weeks ago, I stumbled across a web application, that can be used by gyms to manage the information about their members. This includes data like the name, billing address, birth date, and ...
1
vote
1answer
72 views

Can any of your recognisable personal information be linked to your device fingerprint?

I learned that a device probably has a device fingerprint to the eyes of a company that operates online. I'm not sure how this fingerprint is managed by its collectors, but it's plausible that it ...
0
votes
1answer
97 views

What kind of local information are desktop applications capable to retrieve (and use) from my computer?

I've already seen on Windows what kind of information the Steam application is sending online: time, place and device of the connection, time passed playing the games, payments, mail, numbers, etc. ...
1
vote
1answer
65 views

Posting from HTTPS without specifying protocol - secure?

I have a form that is on a secure (HTTPS) page, which posts to another page. In the form action, the protocol is not specified but I would assume uses the same protocol as the page that it came from, ...
2
votes
2answers
127 views

User passwords printed on paperwork at a dental office?

My dental office just printed my user-defined password (not a first or one-time password) to their portal on some checkout paperwork. I asked on Law.stackexchange and it doesn't sound like this is a ...
4
votes
0answers
82 views

Zeroization of sensitive data in Functional Programming Languages

Concerning the very familiar (and sensible) security practice of Zeroizing sensitive data from memory after you're finished with it, such as Cryptographic keys, passwords, etc, I was pondering how you ...
2
votes
0answers
752 views

Employ fscrypt to securely protect, from data-at-rest exposure, all files+data installed after an initial Linux system build?

Our team's goal We want to protect our sensitive data from being potentially data-at-rest exposed after we relinquish a Linux VPS (see below) provided by a hosting service. We're exploring simple(r) ...
0
votes
1answer
222 views

Windows Encrypted temp directory for files at rest in Windows?

It would be nice if there was an area on my computer where I could work with temp files that may contain sensitive information that could be encrypted with bitlocker or something similar when the ...
23
votes
12answers
14k views

Is there a way to hide HTML source code yet keeping it effective?

I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP): <form action="mailto:someone@example.com"> Email Adress:<br> ...
0
votes
1answer
70 views

Exposing a version number through the assets urls

I just received a blackbox pentesting report where the security company recommended to hide the version number from the page (be it returned to the user as a text or used as a cache-buster in the css/...
0
votes
0answers
164 views

Securing Clipboard Memory

Sometimes sensitive data is copied from/to processes and external devices like (long)passwords, usernames and so forth , but also often people don't get this always in mind and forget to clean that ...
9
votes
1answer
1k views

Employer stores plain text personal data in a 'data warehouse' [closed]

I'm unsure if I have posted this in the correct community but the organisation I am currently working for currently uses an SQL 'data warehouse' which contains a bunch of tables from various sources, ...
25
votes
3answers
8k views

Computer name naming convention for security

I've been doing a security audit and found out you can easily identify host roles and running services just by their computer name (using nslookup). I would like to report this so that they use less ...
0
votes
1answer
94 views

How could you safeguard your data traces when using USB Drive?

I have a very serious question with regard to data security with regard to usage of USB Drive when transmitting, storing or even clearing data with it. When one is going to use USB Drive for ...
1
vote
2answers
3k views

Local File Inclusion [ Post-Exploitation ]

I am curious what kind of sensitive files should I look for on a Windows server which is vulnerable to LFI compared to Linux? I mean the first file or common files which a pentester or an ...