184 votes
Accepted

Is HostGator storing my password in plaintext?

Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one). Technically, the password might be stored under reversible encryption rather than plain text, but ...
user avatar
  • 38.7k
127 votes
Accepted

Can I conceal which account in my database is the admin account, so an attacker won't know which hash to crack first?

I would say this is a bit too much trouble considering what you get out of it. I think when the attacker has access to the database you have way bigger problems. Obfuscating the admin status of a user ...
user avatar
  • 1,212
122 votes
Accepted

Is it safe/wise to store a salt in the same field as the hashed password?

You should store it in a single field. Do not try to divide it into parts. I know this might seem a bit unintuitive for people coming from a database background, where the modus operandi is to ...
user avatar
  • 64.2k
119 votes

Would removing spaces in a string protect against SQL injection?

No. Removing spaces would not prevent SQL injection, as there are many other ways to make the parser process your input. Lets look at an example. Imagine that you had a url which used user supplied ...
user avatar
  • 5,740
107 votes
Accepted

Why is credit card information not stolen more often?

PCI DSS The major reason for this is a decade long effort by the payment cards industry to limit the extent of such breaches by requiring everyone who handles payment card data to either (a) conform ...
user avatar
  • 8,390
103 votes
Accepted

Storing weakness level of passwords

Password hashing (with salting and slowness) is designed to make it indistinguishable from just having the hash if a password is weak or strong. Adding an additional indicator about the quality of the ...
user avatar
82 votes

Is HostGator storing my password in plaintext?

Yes, they store passwords in plaintext or equivalent, and definitely transmit them in plain text. This was discovered in 2011. This is confirmed HostGator being listed on Plaintext Offenders, as well ...
user avatar
  • 64k
78 votes

Sequential identifying string that can't be reverse engineered (the "invoice number" problem)

The standard approach to this kind of issue is to create a UUID (Universally Unique Identifier) for each picture. This is generally a random 128-bit identifier which you can assign to each picture ...
user avatar
  • 60.6k
69 votes
Accepted

Is using a DB prefix for tables more secure?

This is security through obscurity. While it might not hurt you in all cases, on it's own it does not provide viable security. Do not rely on this as your protection. A short parable Let's say you ...
user avatar
  • 64.2k
67 votes

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

The problem of SQL injection is essentially the mixing of logic and data, where what should be data is treated as logic. Prepared statements and parameterized queries actually solve this issue at the ...
user avatar
53 votes
Accepted

Does password-protecting a database living next to the application add any security?

It makes sense to password protect the database if you secure access to the application's config file that holds the plaintext credentials. When you restrict read access to the application's account ...
user avatar
  • 1,726
49 votes

Is it safe/wise to store a salt in the same field as the hashed password?

What you're missing is that hashes work on the original data, minus the original string. When you want to validate a string against a hash, you take the supplied string, plus the original hash data (...
user avatar
  • 3,766
48 votes

Would removing spaces in a string protect against SQL injection?

We're in 2016! SQL injections are a thing of the past unless you use insecure code. Whatever language you use, if you want to prevent any and all SQL injections, use prepared statements or any other ...
user avatar
47 votes
Accepted

Is this safe to display MySQL query error in webpage if something went wrong?

End users should never get to see the gory details of your environment. Instead it is more professional to show a generic 'Sorry something went wrong' page. At least visitors can see that you have a ...
user avatar
  • 6,462
47 votes
Accepted

Secure Implementation of Password Database

The current general best practices for authentication are in the NIST SP 800-63-3 Digital Identity Guidelines standards, especially in SP-63B Authentication and Lifecycle Management. These NIST ...
user avatar
  • 5,756
38 votes

How do you explain to experts that a database server should not reside in the DMZ?

It's like, "Put the jewelry box outside the house so that robbers won't bother getting in for the TV?" Yes, it is exactly like that. If you don't care about the value of the database, relatively ...
user avatar
  • 71.8k
35 votes
Accepted

Client-side BCrypt, store salt and hash separately in MySQL database

The client is the attacker. Walk around your office while chanting that sentence 144 times; be sure to punctuate your diction with a small drum. That way, you will remember it. In your server, you ...
user avatar
  • 168k
35 votes
Accepted

Is this passwordless system secure?

No, this doesn't seem secure. Collisions Mersenne Twister is a deterministic RNG, so it's not suitable for most cryptographic tasks (although it's usage makes sense, because if it weren't ...
user avatar
  • 29k
33 votes

Sql database password encryption opinion needed

No, this is not a good idea! As Lukas pointed out in an comment, you want to hash a password, never encrypt it! With your schema, it would be possible to get the plaintext passwords from an database ...
user avatar
  • 5,913
33 votes

Direct access to databases

Some of the non DBA workers (DEV, Fraud, analysts ... ) in my organization need direct access to databases to write their own queries. ... PCI DSS requirement 8.7 stats "Only database ...
user avatar
  • 71.3k
31 votes
Accepted

Is this verbose error message on the DOT website a security issue?

DOT's backend Oracle database is down due to ORA-27101. ORA-27101 has a nice explanation here with a useful reader comment stating that it happened to them because the Windows Event log was full. ...
user avatar
  • 426
31 votes
Accepted

How do you explain to experts that a database server should not reside in the DMZ?

SANS' "Making Your Network Safe for Databases" (http://www.sans.org/reading-room/whitepapers/application/making-network-safe-databases-24) reads a little dated in some sections, but provides a decent "...
user avatar
  • 326
30 votes

Sequential identifying string that can't be reverse engineered (the "invoice number" problem)

I would simply use the picture hash. What's the problem with someone figuring out the hash you used? If I think "this part of the url looks like a sha1", download the file and it has that sha1, I was ...
user avatar
  • 17.4k
30 votes

Data Encryption by Application vs Data Encryption in Database

Letting your database handle the encryption/decryption is probably for the best: You don't need to write any encryption/decryption code and risk breaking your own security by accident. This also ...
user avatar
  • 1,806
28 votes

KeePass security local malware

Yes - if the malware included a keylogger, for example, it could simply read the master password when you typed it in. The only real way to prevent that would be to have KeePass be the only software ...
user avatar
  • 27.2k
27 votes

Business founder wants access to database but has no DB skills

He is the Data Owner. Not you. If you get hit by a bus, he will need access. You should absolutely give him access. This request is not a surprise at all. If you built a website for me, I'd ask the ...
user avatar
  • 123k
26 votes

What's more secure? Hard coding credentials or storing them in a database?

A few points: What you mean with encrypting passwords in the DB is hashing. That´s a big big difference. The first reason why DBs are used instead of hard coding user data is not security, but ...
user avatar
  • 3,844
26 votes

Can I conceal which account in my database is the admin account, so an attacker won't know which hash to crack first?

Security through obfuscation has limited effectiveness at best - to determine if it is suitable, you need to understand what threats you want to counter. If a threat actor can read your database ...
user avatar
  • 123k
26 votes

Why are stored procedures and prepared statements the preferred modern methods for preventing SQL Injection over mysql real escape string() function

I think the main question here is why string escaping is not as good as the other methods. The answer is that some edge cases allow injections to slip through even though they are escaped. Stack ...
user avatar
  • 801
23 votes
Accepted

Exposing database fields names in HTML

It is very common to do this. As you've noticed, there is a significant benefit for keeping code simple. If you do have an SQL injection vulnerability, an attacker can figure out your database ...
user avatar
  • 32.6k

Only top scored, non community-wiki answers of a minimum length are eligible