Questions tagged [storage]

Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

Filter by
Sorted by
Tagged with
1
vote
1answer
55 views

Is there any security issue while two different process using different hard link of same file?

To reduce disk space I have planned to use a hard link instead of full copy, Is there any security issue while two different processes using different hard links of the same executable file as base?
0
votes
1answer
50 views

Cloud provider or self-hosted for key-storage?

I was reading this question: Where do you store your personal private GPG key? I have my set up as noted in this comment: Where do you store your personal private GPG key? But instead of using a ...
1
vote
1answer
56 views

Why is my LUKS header listed twice?

Why is the metadata in my LUKS header listed twice? I started poking at the bits in a drive that's encrypted with LUKS, and I found some metadata in a JSON object. What's odd though is that the same ...
0
votes
0answers
40 views

When should refresh tokens be stored in a database?

I have a native Windows application programmed in .NET Core that needs to call a Web API. I intend to have the user enter credentials periodically, receiving a refresh token from my auth server for ...
1
vote
4answers
145 views

Storing email addresses in plain text is okay?

You know one of those news when someone says "thousands of users' passwords and personal emails have leaked...". It's the type of stuff that I assume would be prevented if the emails were encrypted in ...
1
vote
2answers
162 views

Is there something insecure about storing secrets in plain text on the host FS?

There are recommendations on this website and in the internet suggesting to never store credentials (e.g. login/password to the database that certain web application is using, or S3 access key on non-...
3
votes
1answer
137 views

Read-only vs. Write-protected

From an information security aspect, is there a difference between saying "read-only" or "write-protected" storage/memory? Is there a chance that a read-only memory would not be write-protected at ...
2
votes
1answer
83 views

Strategies to protect SANs in branch offices in risky places

A company has several remote branch offices located in relatively dangerous places, such as Iraq, and I'm looking into strategies to secure the SAN in the event of theft or looting. The data is ...
0
votes
0answers
20 views

How to migrate existing password storage scheme that uses a weak hash into a safer one? [duplicate]

I am maintaining a php application and the current password storage scheme uses a home-brewed approach instead of using a decent php-delivered approach for user passwords. As a result the method used ...
1
vote
0answers
95 views

How to check if hard disk was removed while in sleep mode?

Let's say that some malicious person extracts my hard disk (HDD or SSD) from my laptop, while it is in sleep mode. Is there a way to check for that event? I am mostly interested for Ubuntu OS, but if ...
2
votes
1answer
563 views

How does Whatsapp store encryption keys on the phone?

It looks like Whatsapp stores encryption keys on the phone side, but I wonder if there are any details on how they do it? Do they use Android Keystore / Secure Enclave? Or something else? The main ...
1
vote
2answers
122 views

Storage of SSL private key in load balancer VS HSM

I have a setup whereby the SSL certificates are terminated at the load balancer (i.e. Load balancer to web server is in plaintext). In order to do the SSL termination, the private key is stored on the ...
2
votes
3answers
196 views

Is it sufficient to use a hard disk magnet to corrupt/erase floppy data?

I would like to make data, in many (more than 250) old floppies, unreadable/unrecoverable. I have some HDDs that I can take apart. Their magnet is sufficient to do the job to make it unreadable to ...
1
vote
1answer
83 views

What's the safest way to store data on a server abroad? [closed]

A very good friend of mine is a journalist in a country where the state is becoming more and more despotic. She would like to store critical data on a server abroad. Is there any service that would ...
3
votes
2answers
320 views

Is storing a JWT secret as docker env variable acceptable?

I understand how JWTs work and that with my secret anyone can issue new tokens. I control the server that my node website runs on and am considering different options for hosting the key. In code - ...
7
votes
5answers
4k views

Is storing sensitive data in files instead of a database safe?

Say I have a hypothetical PHP application which will store hashed passwords in a file in the same directory. At first, this seems like it would be very insecure, since one could guess at the name of ...
1
vote
3answers
426 views

Storing database password in plain text?

In the context of a web application, I will be providing the user the ability to provide a username and password for their MySQL database. Right now, the username and password is generated randomly. ...
0
votes
2answers
114 views

Is it expensive for ISPs to store browsing, text and call logs?

I couldn't really find this answer anywhere. If an ISP was to record every browsing, call and text we make/send, would it be expensive for them log and store this? Assume an ISP has 4 million devices ...
0
votes
0answers
77 views

How to defeat confirmation-of-a-file attack? [duplicate]

Suppose you want to upload some files to an online storage without the storage provider figuring out what you have uploaded. The obvious thing to do is of course to encrypt the files. However, we ...
2
votes
0answers
79 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
0
votes
1answer
203 views

Two Factor Authentication Secret Storage

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...
1
vote
1answer
80 views

Encrypting data as a middleman

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money. As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
1
vote
1answer
29 views

Wifi Cloud Storage

If you move files from an infected machine to a Wi-Fi Cloud storage, then move the same files from the Wi-Fi storage to a non infected machine, could you infect your new non infected machine?
27
votes
4answers
5k views

Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?

Working with a non-profit organization,it's common to reuse hard drives that have previously stored highly sensitive information such as medical and financial records. This is primarily driven by cost-...
0
votes
2answers
313 views

Is it reasonable to store HMAC secret key in memory only?

I'm building a web application using Spring Boot for the backend and Angular for the frontend and planning on using JWTs signed with HMAC-SHA256 for authentication/authorization. I've been thinking ...
-2
votes
1answer
62 views

Which brand of USB key storage and external USB storage can prevent wave or wireless read? [closed]

Which brand of USB key storage and external USB storage can prevent wave or wireless read? I find some has military encryption USB key storage , but do I need to encrypt files before saved in these? ...
0
votes
2answers
2k views

What are the security concerns for base64 encoded JSON files? [closed]

In a REST API, I'd like to receive images as base64 encoded strings in a JSON objects fron user's post and save them to disk using node.js fs module. The request body are objects like: { file: '...
1
vote
1answer
2k views

Is it safe to keep my KeePassX database on my server or cloud with encryption? [duplicate]

My KeePassX file has a long and strong password. I've read several articles and discussions about how safe it'll be stored such a file on VPS or cloud service such as Dropbox. There was no consensus ...
3
votes
1answer
89 views

What is the industry standard practice for saving a potentially (likely) malicious PDF for analysis?

I've received an email with an attached PDF which has many signs of being a malicious attachment. Lacking the time and resources to analyze it at the moment, I'd like to store it for later use, and ...
0
votes
1answer
40 views

Storing all past (user generated) passwords (bcrypted)

I am working on application where I want to add support for Event Sourcing and I am thinking how to solve problem of the passwords (unfortunately I cannot delegate authorisation to external service). ...
1
vote
2answers
116 views

principle of splitting sensitive data across multiple machines running different operating systems

Suppose you're trying to store data as securely as possible, including splitting it across multiple machines (encrypted in a manner so that it's unreadable unless all pieces of the data are recovered)....
1
vote
1answer
180 views

Is an HMAC hash of plaintext data secure enough to use as a lookup index for encrypted data

I'm working on an app that will download files from external servers over https and store them on disk in a relatively secure way. Specifically, using a cryptographically unique IV, an AES256 cipher ...
0
votes
1answer
84 views

Can malware affect storage devices lower than mbr

I found the worm rammit on one of my windows computers so I'm a bit paranoid now about all my dated usb, hdds, etc. Does malware commonly affect devices lower than the mbr. For instance is shred /...
0
votes
1answer
48 views

Can hackers access Firefoxs login storage through the internet?

Is it possible for hackers to access my Firefox browsers login storage through the internet? For instance if I visit a malicious website?
3
votes
1answer
145 views

Secure high-portability way to store passwords?

I'm developing a cross-platform Java desktop application which uses a password to derive a cryptographic key. I'd like to add a "Remember me" feature that stores this cryptographic key on the hard ...
1
vote
3answers
236 views

Should Hashes of Sensitive Data be Encrypted

I'm planning on storing chunks of encrypted data inside a file, along with each chunk would be the hash(sha256) of the unencrypted chunk stored in the file as well. Is storing the hash secure?
4
votes
2answers
241 views

Securely storing account credentials/information for critical company services - the bus factor

Question: I'm trying to figure out best practices for storing authentication credentials for critical company services - hosting services, domain registration services, recruiting portals, etc... To ...
88
votes
1answer
17k views

Wiping an SSD with Parted Magic seemed too quick

I'm selling a computer with an SSD (it's a Lenovo ThinkPad Carbon X1). I wiped the drive using Parted Magic. I used the ATA method. I'm not sure what that is but it was the only setting available. It ...
63
votes
7answers
14k views

Is it safe/wise to store a salt in the same field as the hashed password?

In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"): $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
0
votes
2answers
89 views

Privacy concern about file modification on SSDs

We all know that files which are deleted from a modern system usually don't get erased immediately from memory, which is a security risk in itself. However, this question focuses on a different topic:...
5
votes
2answers
149 views

Properly use files that have keys

Both KeePass and Veracrypt allow you to secure your password database and containers with a password and keyfiles. My question concerns storage and usage on a local user level(home) computer. I keep ...
-1
votes
1answer
88 views

What is the best way for scanning possibly infected external drive in Debian?

First of all I am really sorry for my English. It is not so perfect at all. Please feel free to refer to that in your future comments if you like too or, if you could be so kind as to, just ignore ...
3
votes
1answer
364 views

Is USB type c vulnerable to BadUSB?

Consider the new SanDisk ultra dual type c flash drive. Would that be safer once computers start to come with type c ports?
3
votes
1answer
372 views

In the age of BadUSB, are micro SD cards a secure alternative media immune to those style of attacks? [duplicate]

Why or why not? As a corollary, I saw a presentation description in a recent CCC demonstrating the (non-hostile) use of micro SD cards as a cheap source of processing power. Does this render micro SD ...
1
vote
0answers
64 views

Where can I find legal acts (USA) for storing or processing social security number, tax id, driver license?

There is a PCI DSS for credit card processing. Does somewhere exist similar requirements for personal data processing, especially in US?
0
votes
1answer
278 views

Encryption Key Storage for the Average User

I use KeePass and Veracrypt on my home computer. In addition to a strong password, I also use key files, for example, Veracrypt lets you choose any file on your computer(mp3, jpeg, etc..) as the key. ...
-1
votes
1answer
102 views

How can MyKi transfer data from iOS to macOS without a server?

MyKi.co claims to be able to transfer your passwords securely from your iOS device to the macOS without having to relay through their own servers. But how is this possible? "Your sensitive data is ...
0
votes
3answers
1k views

Storing Username and Password in Application memory (ram)

I've created a user application running on Windows 7 desktops. This application allows users to enter their username and password for another system. My application does this with a simple textbox. ...
6
votes
2answers
10k views

How to access Replay Protected Memory Block (RPMB) in eMMC?

RPMB is a special partition in eMMC 4.5. Internet research suggests that it is used for saving keys and is the only special partition that responds to commands like READ, WRITE. etc. Can anyone ...
0
votes
1answer
61 views

How to set up a server for files? [closed]

I have a specialized software that I have created that can generate gigabytes worth of random data in seconds. I want to put all of these randomized, large files into a location to where it can be ...

1
2 3 4 5