Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [storage]

Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

0
votes
0answers
71 views

How to defeat confirmation-of-a-file attack? [duplicate]

Suppose you want to upload some files to an online storage without the storage provider figuring out what you have uploaded. The obvious thing to do is of course to encrypt the files. However, we ...
1
vote
0answers
48 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
0
votes
0answers
39 views

Why should we use antivirus scanning on our NAS?

When using non-persistent VDI windows instances that running AV but the storage is on NAS, should we also install AV on the NAS to do real-time scanning or it's good enough that we have AV running on ...
0
votes
1answer
64 views

Two Factor Authentication Secret Storage

I found this NPM package that looks like can be used to verify two factor authentication for websites, and also generating tokens for signing into other websites. In the README there is a section ...
1
vote
1answer
44 views

Encrypting data as a middleman

I'm working on a financial app that uses Plaid to provide financial data and updates as users spend money. As of right now, I'm using Hashicopr's Vault to encrypt the transaction/bank account data, ...
1
vote
1answer
25 views

Wifi Cloud Storage

If you move files from an infected machine to a Wi-Fi Cloud storage, then move the same files from the Wi-Fi storage to a non infected machine, could you infect your new non infected machine?
27
votes
4answers
5k views

Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?

Working with a non-profit organization,it's common to reuse hard drives that have previously stored highly sensitive information such as medical and financial records. This is primarily driven by cost-...
1
vote
1answer
310 views

Battery Backed SRAM (and Digital Forensics)

Is it feasible to create a portable battery powered drive out of RAM that could sustain its data via the charge of a battery? From my understanding it doesn't require much power. Combining this with ...
0
votes
2answers
95 views

Is it reasonable to store HMAC secret key in memory only?

I'm building a web application using Spring Boot for the backend and Angular for the frontend and planning on using JWTs signed with HMAC-SHA256 for authentication/authorization. I've been thinking ...
1
vote
0answers
53 views

Where can I find legal acts (USA) for storing or processing social security number, tax id, driver license?

There is a PCI DSS for credit card processing. Does somewhere exist similar requirements for personal data processing, especially in US?
3
votes
1answer
646 views

How to store a file securely on the windows file system?

Problem: I have a windows service running under the local system account. I have a blob of data that I want to store securely and persistently between reboots. I have decided to store it as a file( as ...
4
votes
2answers
5k views

How to access Replay Protected Memory Block (RPMB) in eMMC?

RPMB is a special partition in eMMC 4.5. Internet research suggests that it is used for saving keys and is the only special partition that responds to commands like READ, WRITE. etc. Can anyone ...
3
votes
1answer
221 views

How well does FDE protect against disk firmware malware? [duplicate]

In early 2015 news broke that the NSA was installing firmware backdoors in many hard drives. I was wondering, if there was a BIOS and Hard Drive backdoor how well would full disk encryption protect ...
88
votes
1answer
16k views

Wiping an SSD with Parted Magic seemed too quick

I'm selling a computer with an SSD (it's a Lenovo ThinkPad Carbon X1). I wiped the drive using Parted Magic. I used the ATA method. I'm not sure what that is but it was the only setting available. It ...
6
votes
7answers
3k views

Implications of securing data in RAM

Someone told me that his company is storing all application data (at least the sensitive data I guess) in RAM for security. Their application runs for long periods of time, so data stays in memory for ...
-2
votes
1answer
59 views

Which brand of USB key storage and external USB storage can prevent wave or wireless read? [closed]

Which brand of USB key storage and external USB storage can prevent wave or wireless read? I find some has military encryption USB key storage , but do I need to encrypt files before saved in these? ...
0
votes
2answers
501 views

What are the security concerns for base64 encoded JSON files? [closed]

In a REST API, I'd like to receive images as base64 encoded strings in a JSON objects fron user's post and save them to disk using node.js fs module. The request body are objects like: { file: '...
1
vote
1answer
711 views

Is it safe to keep my KeePassX database on my server or cloud with encryption? [duplicate]

My KeePassX file has a long and strong password. I've read several articles and discussions about how safe it'll be stored such a file on VPS or cloud service such as Dropbox. There was no consensus ...
2
votes
1answer
560 views

Store password ciphers using Powershell ? DPAPI/AES

I am making a script that requires to have a lot of server's IP and their passwords stored in a file. I wanted to use Windows DPAPI, but as we can easily retrieve the plain text version it is not ...
3
votes
1answer
76 views

What is the industry standard practice for saving a potentially (likely) malicious PDF for analysis?

I've received an email with an attached PDF which has many signs of being a malicious attachment. Lacking the time and resources to analyze it at the moment, I'd like to store it for later use, and ...
0
votes
1answer
39 views

Storing all past (user generated) passwords (bcrypted)

I am working on application where I want to add support for Event Sourcing and I am thinking how to solve problem of the passwords (unfortunately I cannot delegate authorisation to external service). ...
1
vote
2answers
89 views

principle of splitting sensitive data across multiple machines running different operating systems

Suppose you're trying to store data as securely as possible, including splitting it across multiple machines (encrypted in a manner so that it's unreadable unless all pieces of the data are recovered)....
8
votes
5answers
9k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
1
vote
3answers
175 views

Should Hashes of Sensitive Data be Encrypted

I'm planning on storing chunks of encrypted data inside a file, along with each chunk would be the hash(sha256) of the unencrypted chunk stored in the file as well. Is storing the hash secure?
1
vote
1answer
98 views

Is an HMAC hash of plaintext data secure enough to use as a lookup index for encrypted data

I'm working on an app that will download files from external servers over https and store them on disk in a relatively secure way. Specifically, using a cryptographically unique IV, an AES256 cipher ...
0
votes
1answer
78 views

Can malware affect storage devices lower than mbr

I found the worm rammit on one of my windows computers so I'm a bit paranoid now about all my dated usb, hdds, etc. Does malware commonly affect devices lower than the mbr. For instance is shred /...
0
votes
1answer
47 views

Can hackers access Firefoxs login storage through the internet?

Is it possible for hackers to access my Firefox browsers login storage through the internet? For instance if I visit a malicious website?
3
votes
1answer
123 views

Secure high-portability way to store passwords?

I'm developing a cross-platform Java desktop application which uses a password to derive a cryptographic key. I'd like to add a "Remember me" feature that stores this cryptographic key on the hard ...
11
votes
2answers
2k views

How could a system be zero-knowledge?

I'm actually interested about zero-knowledge storage system. Those system where the storage provider claims he can't have any access to the data stored. As far I know, the data are encrypted using a ...
61
votes
7answers
12k views

Is it safe/wise to store a salt in the same field as the hashed password?

In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"): $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
4
votes
2answers
140 views

Securely storing account credentials/information for critical company services - the bus factor

Question: I'm trying to figure out best practices for storing authentication credentials for critical company services - hosting services, domain registration services, recruiting portals, etc... To ...
7
votes
4answers
1k views

Safe storage service for private keys

Is it currently technically (as opposed to financially) possible to provide a fairly secure means of providing a storage facility for private keys, not excluding physical verification etc? As in, you ...
2
votes
3answers
129 views

Passwords in one file or separate?

I have a program that hashes some passwords and saves them to .txt files, I'm not using databases for storage. My questions is, is it considered more secure to save hashed passwords in one file or to ...
28
votes
2answers
23k views

How should an application store its credentials

Context When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, ...
0
votes
2answers
84 views

Privacy concern about file modification on SSDs

We all know that files which are deleted from a modern system usually don't get erased immediately from memory, which is a security risk in itself. However, this question focuses on a different topic:...
5
votes
2answers
119 views

Properly use files that have keys

Both KeePass and Veracrypt allow you to secure your password database and containers with a password and keyfiles. My question concerns storage and usage on a local user level(home) computer. I keep ...
-1
votes
1answer
74 views

What is the best way for scanning possibly infected external drive in Debian?

First of all I am really sorry for my English. It is not so perfect at all. Please feel free to refer to that in your future comments if you like too or, if you could be so kind as to, just ignore ...
2
votes
1answer
627 views

How secure is data at rest on Android/iOS mobile devices

We have a need to store security keys on a mobile device, i.e. iOS and Android consumer apps. The app uses those keys in an offline scenario to 'self validate' the signatures of its data. (it can also ...
2
votes
1answer
291 views

Is USB type c vulnerable to BadUSB?

Consider the new SanDisk ultra dual type c flash drive. Would that be safer once computers start to come with type c ports?
3
votes
1answer
267 views

In the age of BadUSB, are micro SD cards a secure alternative media immune to those style of attacks? [duplicate]

Why or why not? As a corollary, I saw a presentation description in a recent CCC demonstrating the (non-hostile) use of micro SD cards as a cheap source of processing power. Does this render micro SD ...
-1
votes
1answer
82 views

How can MyKi transfer data from iOS to macOS without a server?

MyKi.co claims to be able to transfer your passwords securely from your iOS device to the macOS without having to relay through their own servers. But how is this possible? "Your sensitive data is ...
0
votes
1answer
205 views

Encryption Key Storage for the Average User

I use KeePass and Veracrypt on my home computer. In addition to a strong password, I also use key files, for example, Veracrypt lets you choose any file on your computer(mp3, jpeg, etc..) as the key. ...
0
votes
3answers
636 views

Storing Username and Password in Application memory (ram)

I've created a user application running on Windows 7 desktops. This application allows users to enter their username and password for another system. My application does this with a simple textbox. ...
2
votes
2answers
224 views

Secure backup on online Cloudstorage

i own a small private server (@home) with all necessary features for my backup purposes (Owncloud, SVN, GIT). My target now is to ensure the safety of my data in emergency cases like fire/flood. For ...
0
votes
1answer
60 views

How to set up a server for files? [closed]

I have a specialized software that I have created that can generate gigabytes worth of random data in seconds. I want to put all of these randomized, large files into a location to where it can be ...
34
votes
8answers
19k views

Is it okay for API secret to be stored in plain text or decrypt-able?

Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
-2
votes
1answer
91 views

Can a flash drive be set up to detect copying? [closed]

Can I prepare a flash drive in such a way that I can tell if someone copies files from it?
1
vote
0answers
93 views

how to ensure the integrity of the data in store/database? [closed]

I was wondering how can i as a system developer ensure that systems virtual wallet are not tampered with? for example lets a assume that my application allows a user to deposit and widthdraw money, ...
1
vote
1answer
83 views

Is this design for storing/sharing secrets secure?

Goals I am implementing a web-based system which has the following goals: Users are able to store secrets (could be password, or an entire file) on the server. Server has no knowledge of the keys ...
9
votes
2answers
1k views

WORM media types

Why types of media are Write Once Read Many (WORM) other than CD-R, and DVD-R, say, something in the 100GB range? Are there such devices? What would it take to read them? Are the devices like this ...