Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [storage]

Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

Filter by
Sorted by
Tagged with
0 votes
2 answers
122 views

Clean wipe of USB stick of any hidden codes

If I purchase a supposedly brand new USB stick (or micros SD, or similar portable storage devices) online, and I don't quite know the origin where they are produced, and I am a bit paranoid, is there ...
Tristan Tran's user avatar
0 votes
0 answers
109 views

How do programs store plain-text secrets securely? [duplicate]

The best example, would be the ~/.ssh folder, or the linux keychain. Why is the ~/.ssh folder considered safe? When researching this, people said that the permissions of the folder would give enough ...
Silas's user avatar
  • 1
1 vote
1 answer
153 views

Reliably destroy all information on magnetic disk through digital medium

In a scenario where a person wants to give away their device (magnetic disk included), leaving the disk usable for the receiver, how might that person go about destroying ALL data (except firmware) on ...
Anm's user avatar
  • 113
1 vote
1 answer
90 views

Do I need to protect my Azure Blobstorage with a WAF if all the contents inside are for public consumption?

Company policy states that all internet-facing components must be protected with a WAF. However, I have an Azure Blobstorage that stores public web assets. I don't think putting it behind a WAF makes ...
tanyehzheng's user avatar
0 votes
1 answer
681 views

What are the best practices to safely store OAuth2 tokens in a database?

I'm building a website with Patreon integration and I have identified the need to store Patreon user's OAuth2 token in the database. I'm wondering what's the best way to do that, security-wise. Some ...
Vilx-'s user avatar
  • 1,040
0 votes
1 answer
241 views

Security considerations and differences between Bare metal and Virtualization

I'm currently working on a server. This server is meant to be converged, as in be my storage server and the place publicly accessible services run on. Services like some API's in docker or k8s and ...
Rocco's user avatar
  • 103
2 votes
2 answers
636 views

Where or how to persist a decryption key in a React app?

I'm making a web application on the MERN stack which stores sensitive user data, in the form of a big block of text. The encryption method I am using is that when a user registers, a random key is ...
lostCoder's user avatar
-1 votes
2 answers
515 views

Strategy for storing private keys used in an embedded device

I am developing an embedded device using a bootloader. This means that the device will store in its flash an encryption key for decrypting update packages and an ECC public key for verifying update ...
user2563661's user avatar
0 votes
1 answer
1k views

Size overhead of encryption approximation

Is there some rough analysis or estimation of how much overhead in bytes an encryption using a public key could add to the final object?
Jim's user avatar
  • 183
3 votes
1 answer
155 views

Storage options would give the organization the best chance of recovering data

I am studying information security, I have a question that I need help with. Which of the following storage options would give the organization the best chance of recovering data? A. Encrypted ...
Trung Nguyen's user avatar
7 votes
2 answers
5k views

Should user credentials and user info be stored in seperate tables?

Should I store credentials (like email, hashed password) in a separate table than the user's profile information (bio, gender, etc)? My main concern is that I'll be sending other user's information (...
user avatar
1 vote
1 answer
159 views

Is there a way to store a verification-hash of a secret on a 'consumer HSM' like Yubikey or another WebAuthn device?

Context: I'm trying to design an SRS solution for your personal secrets - "Anki for passwords." (This is mostly a learning-exercise, to help me develop my intuition for writing secure(-ish?) ...
ELLIOTTCABLE's user avatar
54 votes
11 answers
11k views

Why did they stop adding physical "write protect" mechanism?

Floppy disks used to have a physical means of preventing writing to them. No software could bypass that, no matter what. It had to be flicked physically and manually by a human being. Modern SD cards ...
Polnow's user avatar
  • 549
1 vote
0 answers
158 views

Presenting users their API Keys on frontend

I'm not talking about showing them a popup upon api key generation, where the user is specifically warned about the fact that This is the only time you will see it. Make sure to save this to a safe ...
hubfix's user avatar
  • 23
0 votes
0 answers
335 views

What's the most secure mounting method for external storage in Nextcloud when not using encryption on rest for performance reasons?

My threats are: MitM basically, eavesdroppers I have a Nextcloud instance and I was thinking of mounting sshfs locally and selecting local as the external storage type and then putting the data there, ...
Sir Muffington's user avatar
0 votes
1 answer
2k views

NAS newbie: how to ensure that network storage is encrypted at rest (and ideally in transit and in use) for Windows, Linux, Mac

I'm looking to buy an ~8TB NAS* for my home office (I guess it's called a "private cloud"). I want to connect to it from Windows, Linux, Mac, Android, and iOS. How can I ensure that the ...
Ryan's user avatar
  • 325
1 vote
0 answers
504 views

Suspicious SSD corruption exactly at LUKS encryption header

I am helping with an interesting data recovery issue. The laptop was running Debian 11 Linux with LUKS full disk encryption on a Samsung 970 Evo Plus 2TB SSD for quite many months. Suddenly the LUKS ...
stackrunner's user avatar
0 votes
0 answers
653 views

Is storing a username in session storage a security risk?

Goal I have a page which verifies the user's email address, that has access to their user id. From this page they're redirected to the login page. I want their username to be filled in already. In ...
Mike V.'s user avatar
  • 11
0 votes
0 answers
115 views

Secure logs on an embedded IoT device

I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development. Since logs will be primarily event & data logs, the size of the log ...
Akhilesh Gupta's user avatar
3 votes
1 answer
3k views

Best practices for storing many certificates and private keys

I am responsible (among many other things) for managing TLS/SSL certificates for a couple dozen or so websites for a large multinational. Some sites are hosted on Apache, some are on IIS. I use ...
Aleks G's user avatar
  • 271
0 votes
0 answers
542 views

Storing encrypted data inside a JSON array in MySQL?

I have the following the situation: I have some data structures which look like this: { id: int name: BLOB password: VARCHAR(80) ... } There it is easy to store the encrypted fields ...
JavaForAndroid's user avatar
0 votes
0 answers
202 views

Storing an encryption key securely

I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options. Option 1) Storing the key on the same server (not recommended, ...
JavaForAndroid's user avatar
1 vote
0 answers
176 views

Cold boot attack on NAS

I'm familiar with the concept of cold boot attacks on laptop and desktop computers, where the goal is to find hidden encryption keys in the memory. I also think it's done on certain mobile phones. I ...
laddmeister's user avatar
0 votes
1 answer
652 views

How to manage a users private key in a secure document storage solution?

I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
espenhogbakk's user avatar
1 vote
1 answer
266 views

Is it possible to recover data from a bricked smartphone?

I have a smartphone that got bricked last year without warning, and it was deemed unrepairable by multiple repair centers. I did have personal stuff on it. If I recycle this phone, can someone down ...
Shubham Deshmukh's user avatar
3 votes
1 answer
972 views

Guidance on Storing Email Addresses as Hashes

I am building an application where one user (User A) can store a "query" of another user (User B) that may or may not exist in the system. This query can be done by email address. The ...
Mike-E's user avatar
  • 185
0 votes
1 answer
123 views

Have external hardware SATA data protection systems been used in production to deter ransomware attacks?

Data destruction via drive formatting, file modification, and file deletion is a critical element of an organization's ability to rapidly recover from a breach. Perhaps the attacker's signature can be ...
J.Todd's user avatar
  • 1,310
0 votes
0 answers
102 views

Static Content Security

I have some static content HTML in a cloud storage space/ CDN. How can I serve this only to authenticated users? I am planning to use these static content on edx platforms. How can I securely ...
Dashin's user avatar
  • 1
0 votes
0 answers
135 views

Storing a host URL to fetch a resource on an iOS device

Let's say I had an API that told me "for X resource, use this host". My iOS app would then store that host and use it whenever it needs to fetch resource X. I'm wondering what security ...
Flantasy Flan's user avatar
-1 votes
1 answer
298 views

Can data be stored anywhere else on a MacBook besides the SSD?

Imagine the following scenario: There exist all kinds of information on my SSD. Now I take away the SSD of my MacBook Pro, replace it, and reboot. I should have a MacBook that is on factory settings, ...
iamaghost's user avatar
0 votes
1 answer
394 views

How to best prevent data recovery on a disk drive without physically destroying it? [duplicate]

The recommended way of ensuring that data on a hard disk cannot be recovered is to destroy it physically, for example using a hammer, drill or even thermite. Question When physical disk destruction is ...
stevec's user avatar
  • 1,280
2 votes
1 answer
259 views

How to update large encrypted files on a server

I'm curious how large cloud computing services that might secure encrypted data would update an encrypted file. For example, let's consider a user is using RSA to encrypt a large file, maybe gigabytes ...
Securitybeginer's user avatar
1 vote
0 answers
115 views

How to ensure that information deleted from external hard drive cannot be recovered after being sold? [duplicate]

I've finished migrating data from several drives on to one newer disk. The older drives were a mix of old mechanical drives, thumb (flash) drives, and SSDs. Now I will dispose of the worthless drives ...
stevec's user avatar
  • 1,280
20 votes
1 answer
7k views

Is there a Yubikey equivalent to "stealing the hard drive"?

Maybe I'm essentially asking an electronics / storage question... This question is similar, though I think it was maybe asked more about physical security while the answer was more about malware. This ...
dcc310's user avatar
  • 311
0 votes
2 answers
168 views

Key derived from source files; deduplicated file storage

I'm wondering if the following system would be a secure way to store frequently duplicated files. Hash the source file, deterministically derive a key from it. The source file(s) are likely to be ...
Karmanyaahm's user avatar
0 votes
1 answer
245 views

Should encryption key be stored remotely?

Consider the following scenarios of storing sensitive data locally on a network connected always-on device: without any data encryption whatsoever with encryption, the key stored locally in the ...
peter.babic's user avatar
2 votes
1 answer
1k views

Is native OpenZFS (on FreeBSD) block-level encryption secure?

I am considering using OpenZFS on FreeBSD. I am not quite sure how secure native OpenZFS encryption is? If somebody steals my server and the disks, is he able to decrypt the files? In a Discord room I ...
Sybil's user avatar
  • 1,479
0 votes
1 answer
434 views

key escrow vs secure storage(software/TPM/HSM)

From the definition of key escrow (a method to store important cryptographic keys providing data-at-rest protection), it sounds very similar to that of secure storage which could be basically software-...
Baranikumar Venkatesan's user avatar
0 votes
1 answer
140 views

Backup on a distant dedicated server, such that even if someone gets root / hacks my distant server, they cannot read the data

Let's say we have: a local computer (Windows or Linux) a distant dedicated server with 2TB storage, running Linux I'd like to do a backup my local computer's data folder (1 TB) to the distant server ...
Basj's user avatar
  • 953
0 votes
1 answer
192 views

Proper Format for Long-Term Storage on M-Discs

The conventional wisdom is that when you store data for long-term storage, you convert the data into a format that will last for decades. It should be in NTFS or FAT and the file format should be one ...
QuietInMontana's user avatar
0 votes
1 answer
1k views

Best ways to store private keys on a client?

I am currently writing a program that sends an encrypted file to the client, and I don't want the user to be able to access the file directly (though the client program will operate on it). Since the ...
berry64's user avatar
0 votes
1 answer
312 views

Can't Amazon see my files if I use s3cmd/gpg with a complex password?

Since the early days of s3cmd I use it in combination with random generated filenames (uuidgen loop) and a complex passphrase (pwgen -n1 -c 32 -y). On security.stackexchange.com search there is only 1 ...
Sybil's user avatar
  • 1,479
2 votes
1 answer
373 views

Group Instant Messaging: How to securely store messages on the backend while supporting cross-device message history in a group chat?

I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed ...
Bhavya 's user avatar
  • 121
1 vote
1 answer
648 views

Is it allowed to store billing address for merchants SAQ A merchants? (PCI DSS)

I know there are many limitations for data storing and processing by PCI DSS. Some of them are explained here. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf But I can't find any ...
Vlad's user avatar
  • 33
3 votes
0 answers
416 views

Best practices for storing long-term access credentials locally in a desktop application?

I'm wondering how applications like Skype and Dropbox store access credentials securely on a user's computer. I imagine the flow for doing this would look something like this: Prompt the user for a ...
Bimba Shrestha's user avatar
1 vote
1 answer
132 views

Is there any security issue while two different process using different hard link of same file?

To reduce disk space I have planned to use a hard link instead of full copy, Is there any security issue while two different processes using different hard links of the same executable file as base?
Karthik Nedunchezhiyan's user avatar
1 vote
2 answers
489 views

Cloud provider or self-hosted for key-storage?

I was reading this question: Where do you store your personal private GPG key? I have my set up as noted in this comment: Where do you store your personal private GPG key? But instead of using a ...
Worp's user avatar
  • 111
1 vote
1 answer
484 views

Why is my LUKS header listed twice?

Why is the metadata in my LUKS header listed twice? I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
Michael Altfield's user avatar
1 vote
4 answers
3k views

Storing email addresses in plain text is okay?

You know one of those news when someone says "thousands of users' passwords and personal emails have leaked...". It's the type of stuff that I assume would be prevented if the emails were encrypted in ...
Digital Ninja's user avatar
6 votes
2 answers
3k views

Is there something insecure about storing secrets in plain text on the host FS?

There are recommendations on this website and in the internet suggesting to never store credentials (e.g. login/password to the database that certain web application is using, or S3 access key on non-...
Alex's user avatar
  • 163

1
2 3 4 5 6