Questions tagged [storage]

Details on how data is being kept in memory/on disks, most frequently being applied to databases, media banks and backup-recovery solutions.

28 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
3 votes
0 answers
400 views

Best practices for storing long-term access credentials locally in a desktop application?

I'm wondering how applications like Skype and Dropbox store access credentials securely on a user's computer. I imagine the flow for doing this would look something like this: Prompt the user for a ...
Bimba Shrestha's user avatar
2 votes
1 answer
364 views

Group Instant Messaging: How to securely store messages on the backend while supporting cross-device message history in a group chat?

I want to build a group chat app where messages are transmitted and stored as securely as they can be, but where the message history is still visible after you or others in the group have changed ...
Bhavya 's user avatar
  • 121
2 votes
0 answers
387 views

Persistent HTML form data across sessions

I'm currently testing an application which appears to have a somewhat persistent HTML form data storage, yet I don't understand how. UserA logs in Fills form with custom data Logs out before sending ...
GarlicCheese's user avatar
2 votes
0 answers
174 views

hardware secret key storage in windows

It seems to me that Windows provides some level of hardware-based secret key storage, for protecting UHD streams in PlayReady 3.0 DRM. Is it possible for third-party applications to leverage this?
davidkomer's user avatar
2 votes
0 answers
204 views

Is eSATA as big a security risk as USB on Windows 7+?

My current understanding is that USB mass storage devices represent a major potential security and virus risk on Windows due to various forms of auto-execution. Does the same apply to eSATA? I mean, ...
Andreus's user avatar
  • 121
2 votes
0 answers
130 views

What is the current consensus on storage of primary credentials or long-lived cryptographic tokens?

The problem: some environments need to use plain text credentials or long-lived tokens in order to unlock a specific functionality. Examples include third party legacy services which need a login/...
WoJ's user avatar
  • 9,038
2 votes
0 answers
113 views

Storing Tenants Cloud Keys In a Database

Imagine you are building a public service where you need to store the customer's cloud credentials(like their aws secret and access keys) in your database to regularly use by your backend services in ...
iCode's user avatar
  • 323
1 vote
1 answer
142 views

Reliably destroy all information on magnetic disk through digital medium

In a scenario where a person wants to give away their device (magnetic disk included), leaving the disk usable for the receiver, how might that person go about destroying ALL data (except firmware) on ...
Anm's user avatar
  • 113
1 vote
1 answer
79 views

Do I need to protect my Azure Blobstorage with a WAF if all the contents inside are for public consumption?

Company policy states that all internet-facing components must be protected with a WAF. However, I have an Azure Blobstorage that stores public web assets. I don't think putting it behind a WAF makes ...
tanyehzheng's user avatar
1 vote
0 answers
150 views

Presenting users their API Keys on frontend

I'm not talking about showing them a popup upon api key generation, where the user is specifically warned about the fact that This is the only time you will see it. Make sure to save this to a safe ...
hubfix's user avatar
  • 23
1 vote
0 answers
474 views

Suspicious SSD corruption exactly at LUKS encryption header

I am helping with an interesting data recovery issue. The laptop was running Debian 11 Linux with LUKS full disk encryption on a Samsung 970 Evo Plus 2TB SSD for quite many months. Suddenly the LUKS ...
stackrunner's user avatar
1 vote
0 answers
164 views

Cold boot attack on NAS

I'm familiar with the concept of cold boot attacks on laptop and desktop computers, where the goal is to find hidden encryption keys in the memory. I also think it's done on certain mobile phones. I ...
laddmeister's user avatar
1 vote
2 answers
472 views

Cloud provider or self-hosted for key-storage?

I was reading this question: Where do you store your personal private GPG key? I have my set up as noted in this comment: Where do you store your personal private GPG key? But instead of using a ...
Worp's user avatar
  • 111
1 vote
0 answers
172 views

How to check if hard disk was removed while in sleep mode?

Let's say that some malicious person extracts my hard disk (HDD or SSD) from my laptop, while it is in sleep mode. Is there a way to check for that event? I am mostly interested for Ubuntu OS, but if ...
pgmank's user avatar
  • 435
1 vote
0 answers
133 views

Where can I find legal acts (USA) for storing or processing social security number, tax id, driver license?

There is a PCI DSS for credit card processing. Does somewhere exist similar requirements for personal data processing, especially in US?
Eldar's user avatar
  • 127
1 vote
0 answers
124 views

Windows disk write - does short write fill whole cluster?

Suppose I have a Windows program that writes to a hard disk. The hard disk has physical sectors of 512 byte length. These sectors are accessed as clusters of 4 kilobytes each. Therefore, each cluster ...
Peter M.'s user avatar
  • 111
1 vote
0 answers
554 views

How can I safely store a password during a user session

I am writing an Java application that is using OAuth to authentificate against a server API. The server is offering the OAuth secrets for users to copy from its website. Because each request needs ...
Simoon's user avatar
  • 11
1 vote
0 answers
191 views

Securing server from attacks and linking while allowing users to upload and store personal files?

I have read some questions and answers about uploading images specifically: Have I done enough not be compromised through image uploading Risks of a PHP image upload form Uploading images safe of ...
AturSams's user avatar
  • 205
0 votes
0 answers
20 views

Clean wipe of USB stick of any hidden codes

If I purchase a supposedly brand new USB stick (or micros SD, or similar portable storage devices) online, and I don't quite know the origin where they are produced, and I am a bit paranoid, is there ...
Tristan Tran's user avatar
0 votes
0 answers
320 views

What's the most secure mounting method for external storage in Nextcloud when not using encryption on rest for performance reasons?

My threats are: MitM basically, eavesdroppers I have a Nextcloud instance and I was thinking of mounting sshfs locally and selecting local as the external storage type and then putting the data there, ...
Sir Muffington's user avatar
0 votes
0 answers
612 views

Is storing a username in session storage a security risk?

Goal I have a page which verifies the user's email address, that has access to their user id. From this page they're redirected to the login page. I want their username to be filled in already. In ...
Mike V.'s user avatar
  • 11
0 votes
0 answers
106 views

Secure logs on an embedded IoT device

I need to secure logs on a IoT device (Infineon TC233). It has 2 MB flash and a HSM. We are at the design stage of development. Since logs will be primarily event & data logs, the size of the log ...
Akhilesh Gupta's user avatar
0 votes
0 answers
515 views

Storing encrypted data inside a JSON array in MySQL?

I have the following the situation: I have some data structures which look like this: { id: int name: BLOB password: VARCHAR(80) ... } There it is easy to store the encrypted fields ...
JavaForAndroid's user avatar
0 votes
0 answers
173 views

Storing an encryption key securely

I am struggling with the question how to store a security key in a secure way. I have done some research and there are multiple options. Option 1) Storing the key on the same server (not recommended, ...
JavaForAndroid's user avatar
0 votes
0 answers
96 views

Static Content Security

I have some static content HTML in a cloud storage space/ CDN. How can I serve this only to authenticated users? I am planning to use these static content on edx platforms. How can I securely ...
Dashin's user avatar
  • 1
0 votes
0 answers
129 views

Storing a host URL to fetch a resource on an iOS device

Let's say I had an API that told me "for X resource, use this host". My iOS app would then store that host and use it whenever it needs to fetch resource X. I'm wondering what security ...
Flantasy Flan's user avatar
0 votes
0 answers
214 views

What are the risks of sharing disk storage by NFS by two machines in different security zones?

In order to share files between two systems, an IT department has decided to share disk storage in a SAN device. The volumes are shared by NFS. The two machines mount the same volume in the SAN. The ...
Eloy Roldán Paredes's user avatar
0 votes
0 answers
98 views

Is the SanDisk ULLtraDIMM secure after power-down?

I found an interesting product last night called the SanDisk ULLtradDimm SSD (product page), which essentially claims drastic performance gains by plugging an SSD into a standard DDR3 memory channel. ...
Miles Grimes's user avatar