3 ms·
If the hacker gets access to the database due to a network config error, then they will be able to query the database, but only get records with some sensitive
by aeronautic 9y ago
If the hacker gets access to the database due to a network config error, then they will be able to query the database, but only get records with some sensitive fields encrypted.
Given the number of email addresses that have been hacked and stolen (3.75 billion in Troy Hunt's haveibeenpwned alone), I believe doing one little extra bit of encryption on email addresses is worthwhile. We push that into our ORM layer and can easily flag any field in the database to be encrypted.
On very, very high volume accessed tables, you may not want to do that. But for user logon details -- for us it was a no brainer.
- stephenr 9y agoWait, so you encrypt the user's email before it's inserted into the table? Are you using a different field for 'username' on logins, or do you have to jump through some hoops to find an encrypted email to do a login check against the pw hash?
- k__ 9y agoCan't you encrypt the entered email and search with that?
- aeronautic 9y agoPassword hashes are handled separately using bcrypt - another story. For the User.email field, we crypt/decrypt in the ORM/DB layer. So we search with the encrypted value that is stored in the db. App code provides plain-text email, ORM encrypts and searches with that value. Symmetric encryption of short strings is pretty fast and this is not a high volume API. We use rate limiting on the API to protect against DOS on this API.
- arjie 9y agoIf it's symmetric, then doesn't an app vulnerability make it possible for you to leak your key? Then the app also contains access credentials to the DB, so vulnerabilities in the app will still lead to real access to the DB, right?
- aeronautic 9y agoYes, we're not protecting against the app being attacked, the key being jacked and then the attacker getting access to the db. Rather, we're protecting the database against being accessed directly. That could happen due to an error in configuring network access to the database or another service could be compromised that has access to the same database -- as has happened to many mongo databases over this year.
- stephenr 9y agoSo your solution to fixing a basic ops problem 'software package A was exposed to the internet with(out|effectively no) auth' is: encrypt shit in an ORM layer and destroy your ability to do anything beyond absolute string comparison queries. No thanks.
- aeronautic 9y agoNo, we don't encrypt indiscriminately. We selectively pick fields to encrypt - fields that are highly sensitive. And you are right, we do this because an ops error can easily make a mistake sometime in the future and probably will one day. We all make mistakes and defense in depth is all about that.
- edraferi 9y agoThis is an interesting solution, thanks for sharing. This would be a cool feature to build into open source ORMs.
- EGreg 9y agoThis is a good idea, but only for fields which can never be used in range based index lookups.
- swsieber 9y agoIt does seem like emails are a good fit for encryption. I can't see wanting to do anything more than simple equality checks.
- ams6110 9y agoNever mind that email addresses are sent in the clear all over the internet every day in normal SMTP traffic?
- creepydata 9y agoPsst, I really hate to break it to you but you are "stealing" and "hacking" your users email addresses ever time you send them an email! https://www.troyhunt.com/im-sorry-but-your-email-address-is-not/ https://www.troyhunt.com/im-sorry-but-your-email-address-is-...
- wglb 9y agoI am wondering if you are clear on exactly what database encryption protects you against. Hint: not much at all.