Questions tagged [storage]

Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

Filter by
Sorted by
Tagged with
0 votes
0 answers
59 views

Secure logs on an embedded IoT device

I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development. Since logs will be primarily event & data logs, the size of the log ...
user avatar
0 votes
2 answers
85 views

Best practices for storing many certificates and private keys

I am responsible (among many other things) for managing TLS/SSL certificates for a couple dozen or so websites for a large multinational. Some sites are hosted on Apache, some are on IIS. I use ...
user avatar
  • 221
0 votes
0 answers
61 views

Storing encrypted data inside a JSON array in MySQL?

I have the following the situation: I have some data structures which look like this: { id: int name: BLOB password: VARCHAR(80) ... } There it is easy to store the encrypted fields ...
user avatar
0 votes
0 answers
53 views

Storing an encryption key securely

I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options. Option 1) Storing the key on the same server (not recommended, ...
user avatar
1 vote
0 answers
45 views

Cold boot attack on NAS

I'm familiar with the concept of cold boot attacks on laptop and desktop computers, where the goal is to find hidden encryption keys in the memory. I also think it's done on certain mobile phones. I ...
user avatar
0 votes
1 answer
69 views

How to manage a users private key in a secure document storage solution?

I’m in the process of building a secure document storage on behalf of users of a web and mobile application. The goal is to have end-to-end encryption, as in documents will be encrypted and decrypted ...
user avatar
1 vote
1 answer
113 views

Is it possible to recover data from a bricked smartphone?

I have a smartphone that got bricked last year without warning, and it was deemed unrepairable by multiple repair centers. I did have personal stuff on it. If I recycle this phone, can someone down ...
user avatar
0 votes
1 answer
196 views

Guidance on Storing Email Addresses as Hashes

I am building an application where one user (User A) can store a "query" of another user (User B) that may or may not exist in the system. This query can be done by email address. The ...
user avatar
  • 155
0 votes
1 answer
84 views

Have external hardware SATA data protection systems been used in production to deter ransomware attacks?

Data destruction via drive formatting, file modification, and file deletion is a critical element of an organization's ability to rapidly recover from a breach. Perhaps the attacker's signature can be ...
user avatar
  • 1,290
0 votes
0 answers
68 views

Static Content Security

I have some static content HTML in a cloud storage space/ CDN. How can I serve this only to authenticated users? I am planning to use these static content on edx platforms. How can I securely ...
user avatar
  • 1
0 votes
0 answers
76 views

Storing a host URL to fetch a resource on an iOS device

Let's say I had an API that told me "for X resource, use this host". My iOS app would then store that host and use it whenever it needs to fetch resource X. I'm wondering what security ...
user avatar
-1 votes
1 answer
140 views

Can data be stored anywhere else on a MacBook besides the SSD?

Imagine the following scenario: There exist all kinds of information on my SSD. Now I take away the SSD of my MacBook Pro, replace it, and reboot. I should have a MacBook that is on factory settings, ...
user avatar
0 votes
1 answer
129 views

How to best prevent data recovery on a disk drive without physically destroying it? [duplicate]

The recommended way of ensuring that data on a hard disk cannot be recovered is to destroy it physically, for example using a hammer, drill or even thermite. Question When physical disk destruction is ...
user avatar
  • 1,224
2 votes
1 answer
143 views

How to update large encrypted files on a server

I'm curious how large cloud computing services that might secure encrypted data would update an encrypted file. For example, let's consider a user is using RSA to encrypt a large file, maybe gigabytes ...
user avatar
1 vote
0 answers
77 views

How to ensure that information deleted from external hard drive cannot be recovered after being sold? [duplicate]

I've finished migrating data from several drives on to one newer disk. The older drives were a mix of old mechanical drives, thumb (flash) drives, and SSDs. Now I will dispose of the worthless drives ...
user avatar
  • 1,224
20 votes
1 answer
6k views

Is there a Yubikey equivalent to "stealing the hard drive"?

Maybe I'm essentially asking an electronics / storage question... This question is similar, though I think it was maybe asked more about physical security while the answer was more about malware. This ...
user avatar
  • 311
0 votes
2 answers
112 views

Key derived from source files; deduplicated file storage

I'm wondering if the following system would be a secure way to store frequently duplicated files. Hash the source file, deterministically derive a key from it. The source file(s) are likely to be ...
user avatar
0 votes
1 answer
130 views

Should encryption key be stored remotely?

Consider the following scenarios of storing sensitive data locally on a network connected always-on device: without any data encryption whatsoever with encryption, the key stored locally in the ...
user avatar
2 votes
1 answer
549 views

Is native OpenZFS (on FreeBSD) block-level encryption secure?

I am considering using OpenZFS on FreeBSD. I am not quite sure how secure native OpenZFS encryption is? If somebody steals my server and the disks, is he able to decrypt the files? In a Discord room I ...
user avatar
  • 1,413
0 votes
1 answer
209 views

key escrow vs secure storage(software/TPM/HSM)

From the definition of key escrow (a method to store important cryptographic keys providing data-at-rest protection), it sounds very similar to that of secure storage which could be basically software-...
user avatar
0 votes
1 answer
108 views

Backup on a distant dedicated server, such that even if someone gets root / hacks my distant server, they cannot read the data

Let's say we have: a local computer (Windows or Linux) a distant dedicated server with 2TB storage, running Linux I'd like to do a backup my local computer's data folder (1 TB) to the distant server ...
user avatar
  • 931
0 votes
1 answer
107 views

Proper Format for Long-Term Storage on M-Discs

The conventional wisdom is that when you store data for long-term storage, you convert the data into a format that will last for decades. It should be in NTFS or FAT and the file format should be one ...
user avatar
0 votes
1 answer
290 views

Best ways to store private keys on a client?

I am currently writing a program that sends an encrypted file to the client, and I don't want the user to be able to access the file directly (though the client program will operate on it). Since the ...
user avatar
0 votes
1 answer
174 views

Can't Amazon see my files if I use s3cmd/gpg with a complex password?

Since the early days of s3cmd I use it in combination with random generated filenames (uuidgen loop) and a complex passphrase (pwgen -n1 -c 32 -y). On security.stackexchange.com search there is only 1 ...
user avatar
  • 1,413
2 votes
1 answer
229 views

Group Instant Messaging: How to securely store messages on the backend while supporting cross-device message history in a group chat?

I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed ...
user avatar
  • 121
1 vote
1 answer
209 views

Is it allowed to store billing address for merchants SAQ A merchants? (PCI DSS)

I know there are many limitations for data storing and processing by PCI DSS. Some of them are explained here. https://www.pcisecuritystandards.org/pdfs/pci_fs_data_storage.pdf But I can't find any ...
user avatar
  • 13
3 votes
0 answers
144 views

Best practices for storing long-term access credentials locally in a desktop application?

I'm wondering how applications like Skype and Dropbox store access credentials securely on a user's computer. I imagine the flow for doing this would look something like this: Prompt the user for a ...
user avatar
1 vote
1 answer
100 views

Is there any security issue while two different process using different hard link of same file?

To reduce disk space I have planned to use a hard link instead of full copy, Is there any security issue while two different processes using different hard links of the same executable file as base?
user avatar
1 vote
2 answers
247 views

Cloud provider or self-hosted for key-storage?

I was reading this question: Where do you store your personal private GPG key? I have my set up as noted in this comment: Where do you store your personal private GPG key? But instead of using a ...
user avatar
  • 111
1 vote
1 answer
214 views

Why is my LUKS header listed twice?

Why is the metadata in my LUKS header listed twice? I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
user avatar
1 vote
4 answers
1k views

Storing email addresses in plain text is okay?

You know one of those news when someone says "thousands of users' passwords and personal emails have leaked...". It's the type of stuff that I assume would be prevented if the emails were encrypted in ...
user avatar
4 votes
2 answers
2k views

Is there something insecure about storing secrets in plain text on the host FS?

There are recommendations on this website and in the internet suggesting to never store credentials (e.g. login/password to the database that certain web application is using, or S3 access key on non-...
user avatar
  • 143
3 votes
1 answer
341 views

Read-only vs. Write-protected

From an information security aspect, is there a difference between saying "read-only" or "write-protected" storage/memory? Is there a chance that a read-only memory would not be write-protected at ...
user avatar
  • 269
2 votes
1 answer
128 views

Strategies to protect SANs in branch offices in risky places

A company has several remote branch offices located in relatively dangerous places, such as Iraq, and I'm looking into strategies to secure the SAN in the event of theft or looting. The data is ...
user avatar
1 vote
0 answers
147 views

How to check if hard disk was removed while in sleep mode?

Let's say that some malicious person extracts my hard disk (HDD or SSD) from my laptop, while it is in sleep mode. Is there a way to check for that event? I am mostly interested for Ubuntu OS, but if ...
user avatar
  • 415
2 votes
1 answer
4k views

How does Whatsapp store encryption keys on the phone?

It looks like Whatsapp stores encryption keys on the phone side, but I wonder if there are any details on how they do it? Do they use Android Keystore / Secure Enclave? Or something else? The main ...
user avatar
1 vote
2 answers
362 views

Storage of SSL private key in load balancer VS HSM

I have a setup whereby the SSL certificates are terminated at the load balancer (i.e. Load balancer to web server is in plaintext). In order to do the SSL termination, the private key is stored on the ...
user avatar
  • 139
3 votes
3 answers
2k views

Is it sufficient to use a hard disk magnet to corrupt/erase floppy data?

I would like to make data, in many (more than 250) old floppies, unreadable/unrecoverable. I have some HDDs that I can take apart. Their magnet is sufficient to do the job to make it unreadable to ...
user avatar
  • 33
1 vote
1 answer
126 views

What's the safest way to store data on a server abroad? [closed]

A very good friend of mine is a journalist in a country where the state is becoming more and more despotic. She would like to store critical data on a server abroad. Is there any service that would ...
user avatar
  • 113
3 votes
2 answers
1k views

Is storing a JWT secret as docker env variable acceptable?

I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key. In code - ...
user avatar
7 votes
5 answers
5k views

Is storing sensitive data in files instead of a database safe?

Say I have a hypothetical PHP application which will store hashed passwords in a file in the same directory. At first, this seems like it would be very insecure, since one could guess at the name of ...
user avatar
1 vote
3 answers
1k views

Storing database password in plain text?

In the context of a web application, I will be providing the user the ability to provide a username and password for their MySQL database. Right now, the username and password is generated randomly. ...
user avatar
  • 163
0 votes
2 answers
214 views

Is it expensive for ISPs to store browsing, text and call logs?

I couldn't really find this answer anywhere. If an ISP was to record every browsing, call and text we make/send, would it be expensive for them log and store this? Assume an ISP has 4 million devices ...
user avatar
  • 1
0 votes
0 answers
90 views

How to defeat confirmation-of-a-file attack? [duplicate]

Suppose you want to upload some files to an online storage without the storage provider figuring out what you have uploaded. The obvious thing to do is of course to encrypt the files. However, we ...
user avatar
  • 1
2 votes
0 answers
267 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
user avatar
1 vote
2 answers
2k views

Two Factor Authentication Secret Storage

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...
user avatar
1 vote
1 answer
174 views

Encrypting data as a middleman

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money. As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
user avatar
  • 45
1 vote
1 answer
68 views

Wifi Cloud Storage

If you move files from an infected machine to a Wi-Fi Cloud storage, then move the same files from the Wi-Fi storage to a non infected machine, could you infect your new non infected machine?
user avatar
29 votes
5 answers
5k views

Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?

Working with a non-profit organization,it's common to reuse hard drives that have previously stored highly sensitive information such as medical and financial records. This is primarily driven by cost-...
user avatar
  • 1,483
0 votes
2 answers
511 views

Is it reasonable to store HMAC secret key in memory only?

I'm building a web application using Spring Boot for the backend and Angular for the frontend and planning on using JWTs signed with HMAC-SHA256 for authentication/authorization. I've been thinking ...
user avatar
  • 103

1
2 3 4 5