Skip to main content
165 votes
Accepted

Wiping an SSD with Parted Magic seemed too quick

Modern SSDs use a technology called SED which allows instant erasure. It works by transparently encrypting the entire drive and keeping the key on the drive. ATA Secure Erase is then implemented by ...
forest's user avatar
  • 67k
122 votes
Accepted

Is it safe/wise to store a salt in the same field as the hashed password?

You should store it in a single field. Do not try to divide it into parts. I know this might seem a bit unintuitive for people coming from a database background, where the modus operandi is to ...
Anders's user avatar
  • 65.7k
53 votes
Accepted

Is there a Yubikey equivalent to "stealing the hard drive"?

Short answer Where would this data live on the device if not on something like flash storage? It probably is flash, but it's put in a chip that's hard to take apart and examine without destroying ...
forest's user avatar
  • 67k
51 votes
Accepted

Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?

Data destruction is a technique of last resort. If you are planning to use a new storage device, you should use full disk encryption. This allows you to either destroy the encrypted master key or ...
forest's user avatar
  • 67k
48 votes

Is it safe/wise to store a salt in the same field as the hashed password?

What you're missing is that hashes work on the original data, minus the original string. When you want to validate a string against a hash, you take the supplied string, plus the original hash data (...
Machavity's user avatar
  • 3,798
48 votes

Why did they stop adding physical "write protect" mechanism?

Floppy disks used to have a physical means of preventing writing to them. No software could bypass that, no matter what. It had to be flicked physically and manually by a human being. They didn't. It ...
vidarlo's user avatar
  • 16.6k
21 votes

Is it okay for API secret to be stored in plain text or decrypt-able?

There seems to be a bit of confusion here and other places, so I'm adding this answer in hopes that it will clarify the situation for other users. There are two types of API secrets that might be ...
Nick Sloan's user avatar
18 votes

Why did they stop adding physical "write protect" mechanism?

The old floppy disk write protect isn't really at the disk level, and doesn't physically prevent writing. It instructs the drive to prevent writing, as it's detected by the drive electronics (on ...
Chris H's user avatar
  • 4,435
15 votes
Accepted

Is storing sensitive data in files instead of a database safe?

The best measure to do this is to store such file on a directory outside the web root. Basically, all of the solutions 'solve' the problem, in making the password file not available. Their ...
Ángel's user avatar
  • 19k
15 votes

Why did they stop adding physical "write protect" mechanism?

Ultimately because on USBs, it was a very niche feature that the vast, vast majority of people didn't care about. It adds complexity (and thus cost) to the drives, it's another component that can fail ...
Gh0stFish's user avatar
  • 13k
13 votes

Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?

Tl;dr: Because you can never trust all storage drives to securely wipe themselves, you must plan as if none of your drives can be securely wiped. Placing a dependency on the type of media is not the ...
John Deters's user avatar
  • 34.3k
13 votes

Why did they stop adding physical "write protect" mechanism?

It is many things... Even if the cost were $0.001 per SD card, at current market, we're talking about a hundreds of thousands (and possibly millions) of dollars extra. The cost is way more - ...
Matija Nalis's user avatar
  • 2,305
10 votes

Why did they stop adding physical "write protect" mechanism?

In ancient days when people were WOW'd by how many kilobytes your computer had, the write capability could be disabled via a single wire. Modern interfaces and techniques don't lend themselves to that ...
user10216038's user avatar
  • 8,143
9 votes

Is it safe/wise to store a salt in the same field as the hashed password?

Yes, you can store it in a single field, and many databases/applications store the salt+hash in a single field/file etc. The most famous is Linux (which isn't a DB), that stores the hash in the /etc/...
keithRozario's user avatar
  • 3,711
7 votes

Is it okay for API secret to be stored in plain text or decrypt-able?

Putting in my own two cents because of one issue that has not yet been mentioned. In particular, I agree with what @NickSloan has said, but with one more caveat. There is one more important ...
Conor Mancone's user avatar
7 votes

How to access Replay Protected Memory Block (RPMB) in eMMC?

RPMB can be used using mmc-utils. It can withstand replay attacks by requiring a key to write to this region. The rpmb has a key that can be programmed once. Later, the host reads a counter value ...
Ryan Schaefer's user avatar
7 votes

How to access Replay Protected Memory Block (RPMB) in eMMC?

Typically, before any access (e.g. read or write) to RPMB partition, a RPMB authentication key must be programmed into RPMB controller in eMMC/UFS or NVMe device. Note that this key must only be ...
Bing's user avatar
  • 71
6 votes

How to securely store sensitive information?

As soon as I hear store sensitive information, I think of password managers. That is what they are made for, and some of them do it very nicely. For example the excellent Keepass allows to store ...
Serge Ballesta's user avatar
5 votes

Passwords in one file or separate?

Do whatever results in less / simpler code. From a threat model perspective, if an attacker can access one file, they can access the other. You're much more likely to run into issues with logical ...
Polynomial's user avatar
  • 135k
5 votes

Two Factor Authentication Secret Storage

No clever storage method exists for HOTP and TOTP. You should do your best to limit which programs can look up shared secrets using ordinary access control methods. (Plus physically securing the ...
Future Security's user avatar
4 votes

Are there any quick-erase devices with a small memory available for storing key information?

Try to make your own key from ATMega/STM32 ARM chip: you make it as an USB slave (peripherial) device it has an EEPROM with the key, so you have a jumper you're removing after storing the key it has ...
Alexey Vesnin's user avatar
4 votes

Are deleted files more or less likely to be overwritten than blank space?

Yes, I take them into account. On HDDs it's more like o be overwritten compared to being stored into free space, because the tendency is to put the data into the faster portion of the drive which is ...
Overmind's user avatar
  • 8,899
4 votes

Is it safe/wise to store a salt in the same field as the hashed password?

From a security standpoint, it doesn't matter if the salt and hashed password are stored in a single field or separate fields, though I would lean towards a single field for simplicity. The only ...
TTT's user avatar
  • 9,222
4 votes

Is it safe/wise to store a salt in the same field as the hashed password?

Is it acceptable to store this in one field in a SQL database (varchar(99) in this case) No. The size of the data might change at some time. A varchar(MAX) field should be used unless the ...
Andrew Morton's user avatar
4 votes
Accepted

Secure high-portability way to store passwords?

On today's systems, you can use TPM. It can be used to store (or wrap) the root key and protects additional keys created by an applications. The application keys cannot be used without the TPM, making ...
Overmind's user avatar
  • 8,899
4 votes
Accepted

What are the security concerns for base64 encoded JSON files?

First of all, there's all the standard web service security risks (connection security, authentication, authorization, session management, denial of service, logging, patching, etc.). I'm not going to ...
CBHacking's user avatar
  • 49.5k
4 votes

Is it sufficient to use a hard disk magnet to corrupt/erase floppy data?

Yes, a HDD magnet is fine or any neodymium one and will destroy the data by sweeping such a powerful magnet across the surface of a disk. However, the reliability of such a procedure may vary. You ...
Overmind's user avatar
  • 8,899
4 votes

Why did they stop adding physical "write protect" mechanism?

Because it is an extra point of failure, and there are much easier-to-use versions at the file system level. The read/write switch needs a detector on the drive, and due to its mechanical nature, can ...
Nelson's user avatar
  • 1,029
4 votes
Accepted

Should user credentials and user info be stored in seperate tables?

There are usually other more important factors for data security, but main reason to consider storing credentials in a separate table (to other profile info) is to reduce the chances that you ...
Chris Schaller's user avatar
3 votes

Why is it a problem to store strong passwords as unsalted hashes?

Sufficiently long passwords generated by a secure random number generator hashed by an algorithm with long output (at least 128 bit) and no known weakness (at least SHA256) will become infeasible to ...
billc.cn's user avatar
  • 3,946

Only top scored, non community-wiki answers of a minimum length are eligible