Skip to main content
165 votes
Accepted

Wiping an SSD with Parted Magic seemed too quick

Modern SSDs use a technology called SED which allows instant erasure. It works by transparently encrypting the entire drive and keeping the key on the drive. ATA Secure Erase is then implemented by ...
forest's user avatar
  • 66.8k
122 votes
Accepted

Is it safe/wise to store a salt in the same field as the hashed password?

You should store it in a single field. Do not try to divide it into parts. I know this might seem a bit unintuitive for people coming from a database background, where the modus operandi is to ...
Anders's user avatar
  • 65.6k
53 votes
Accepted

Is there a Yubikey equivalent to "stealing the hard drive"?

Short answer Where would this data live on the device if not on something like flash storage? It probably is flash, but it's put in a chip that's hard to take apart and examine without destroying ...
forest's user avatar
  • 66.8k
51 votes
Accepted

Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?

Data destruction is a technique of last resort. If you are planning to use a new storage device, you should use full disk encryption. This allows you to either destroy the encrypted master key or ...
forest's user avatar
  • 66.8k
49 votes

Is it safe/wise to store a salt in the same field as the hashed password?

What you're missing is that hashes work on the original data, minus the original string. When you want to validate a string against a hash, you take the supplied string, plus the original hash data (...
Machavity's user avatar
  • 3,818
48 votes
Accepted

To what extent does formatting a disk (securely) remove its data?

Quick-formatting a hard disk simply erases the filesystem's structures and tables and writes new ones in place, giving the illusion of a brand new disk. Old data is simply overwritten as and when ...
Polynomial's user avatar
  • 135k
48 votes

Why did they stop adding physical "write protect" mechanism?

Floppy disks used to have a physical means of preventing writing to them. No software could bypass that, no matter what. It had to be flicked physically and manually by a human being. They didn't. It ...
vidarlo's user avatar
  • 16.1k
21 votes

Is it okay for API secret to be stored in plain text or decrypt-able?

There seems to be a bit of confusion here and other places, so I'm adding this answer in hopes that it will clarify the situation for other users. There are two types of API secrets that might be ...
Nick Sloan's user avatar
20 votes

Is a single pass enough when disposing of a HDD?

According to the articles linked below 1-2 wipes will be enough. For any modern PRML/EPRML drive, a few passes of random scrubbing is the best you can do. As the paper says, “A good scrubbing with ...
Muhammet's user avatar
  • 376
18 votes

Why did they stop adding physical "write protect" mechanism?

The old floppy disk write protect isn't really at the disk level, and doesn't physically prevent writing. It instructs the drive to prevent writing, as it's detected by the drive electronics (on ...
Chris H's user avatar
  • 4,425
15 votes
Accepted

Is storing sensitive data in files instead of a database safe?

The best measure to do this is to store such file on a directory outside the web root. Basically, all of the solutions 'solve' the problem, in making the password file not available. Their ...
Ángel's user avatar
  • 18.8k
15 votes

Why did they stop adding physical "write protect" mechanism?

Ultimately because on USBs, it was a very niche feature that the vast, vast majority of people didn't care about. It adds complexity (and thus cost) to the drives, it's another component that can fail ...
Gh0stFish's user avatar
  • 11k
13 votes

Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?

Tl;dr: Because you can never trust all storage drives to securely wipe themselves, you must plan as if none of your drives can be securely wiped. Placing a dependency on the type of media is not the ...
John Deters's user avatar
  • 34.2k
13 votes

Why did they stop adding physical "write protect" mechanism?

It is many things... Even if the cost were $0.001 per SD card, at current market, we're talking about a hundreds of thousands (and possibly millions) of dollars extra. The cost is way more - ...
Matija Nalis's user avatar
  • 2,305
10 votes

Why did they stop adding physical "write protect" mechanism?

In ancient days when people were WOW'd by how many kilobytes your computer had, the write capability could be disabled via a single wire. Modern interfaces and techniques don't lend themselves to that ...
user10216038's user avatar
  • 8,113
9 votes

Is it safe/wise to store a salt in the same field as the hashed password?

Yes, you can store it in a single field, and many databases/applications store the salt+hash in a single field/file etc. The most famous is Linux (which isn't a DB), that stores the hash in the /etc/...
keithRozario's user avatar
  • 3,721
7 votes

Is it okay for API secret to be stored in plain text or decrypt-able?

Putting in my own two cents because of one issue that has not yet been mentioned. In particular, I agree with what @NickSloan has said, but with one more caveat. There is one more important ...
Conor Mancone's user avatar
7 votes

How to access Replay Protected Memory Block (RPMB) in eMMC?

RPMB can be used using mmc-utils. It can withstand replay attacks by requiring a key to write to this region. The rpmb has a key that can be programmed once. Later, the host reads a counter value ...
Ryan Schaefer's user avatar
7 votes

How to access Replay Protected Memory Block (RPMB) in eMMC?

Typically, before any access (e.g. read or write) to RPMB partition, a RPMB authentication key must be programmed into RPMB controller in eMMC/UFS or NVMe device. Note that this key must only be ...
Bing's user avatar
  • 71
6 votes

How to securely store sensitive information?

As soon as I hear store sensitive information, I think of password managers. That is what they are made for, and some of them do it very nicely. For example the excellent Keepass allows to store ...
Serge Ballesta's user avatar
5 votes

Passwords in one file or separate?

Do whatever results in less / simpler code. From a threat model perspective, if an attacker can access one file, they can access the other. You're much more likely to run into issues with logical ...
Polynomial's user avatar
  • 135k
5 votes

Two Factor Authentication Secret Storage

No clever storage method exists for HOTP and TOTP. You should do your best to limit which programs can look up shared secrets using ordinary access control methods. (Plus physically securing the ...
Future Security's user avatar
4 votes
Accepted

Recommendation Key Management and Storage in Cloud Storage

If you are supplying the application that stores and retrieves the encrypted files for the user, here are a few ideas you may want to consider... 1) Rather than encrypting data at the cloud storage, ...
Secure Joe's user avatar
4 votes

Are there any quick-erase devices with a small memory available for storing key information?

Try to make your own key from ATMega/STM32 ARM chip: you make it as an USB slave (peripherial) device it has an EEPROM with the key, so you have a jumper you're removing after storing the key it has ...
Alexey Vesnin's user avatar
4 votes

To what extent does formatting a disk (securely) remove its data?

One part of your question seems not to have a good answer, so I want to add to this: By formatting a drive, you typically choose to do a "quick format". This does not overwrite the data, but only ...
Lukas's user avatar
  • 3,178
4 votes

Are deleted files more or less likely to be overwritten than blank space?

Yes, I take them into account. On HDDs it's more like o be overwritten compared to being stored into free space, because the tendency is to put the data into the faster portion of the drive which is ...
Overmind's user avatar
  • 8,899
4 votes

Is it safe/wise to store a salt in the same field as the hashed password?

From a security standpoint, it doesn't matter if the salt and hashed password are stored in a single field or separate fields, though I would lean towards a single field for simplicity. The only ...
TTT's user avatar
  • 9,212
4 votes

Is it safe/wise to store a salt in the same field as the hashed password?

Is it acceptable to store this in one field in a SQL database (varchar(99) in this case) No. The size of the data might change at some time. A varchar(MAX) field should be used unless the ...
Andrew Morton's user avatar
4 votes
Accepted

Secure high-portability way to store passwords?

On today's systems, you can use TPM. It can be used to store (or wrap) the root key and protects additional keys created by an applications. The application keys cannot be used without the TPM, making ...
Overmind's user avatar
  • 8,899
4 votes
Accepted

What are the security concerns for base64 encoded JSON files?

First of all, there's all the standard web service security risks (connection security, authentication, authorization, session management, denial of service, logging, patching, etc.). I'm not going to ...
CBHacking's user avatar
  • 48.5k

Only top scored, non community-wiki answers of a minimum length are eligible