31–37 of 37 posts
Earlier quoted context omitted.
Sorry to burst that bubble, but KISS doesn't produce neither secure nor reliable software. Security and reliability is something you have to design for.
Software security engineers design for simplicity; it's one of the fundamental ideas of the discipline.
Earlier quoted context omitted.
No it doesn't. It just requires a shift in your thinking. Having a database is a code smell. If you absolutely have to have a database, then having a `users` table (or equivalent) is a code smell. If you absolutely have to have a `users` table, having any columns in it other than `id`, `username`, and `password_hash` is a code smell. ...and so on. Admittedly this isn't necessarily easy in a company setting. It's in d…
I work in a SAAS company whose product is used by businesses to exchange data and run reports, which are emailed. What exactly should we cut without destroying the utility of our work?
* Build your software to stream data directly from Client A's API to Client B's API without it ever being at rest on a machine you control.
* If your users want reports based off their data, then see if you can fetch the relevant data from the client on demand, build the report email in memory, then forget the raw data.
* Tell your clients you prefer to use their oauth provider of choice to authorize instead of storing usernames and password hashes yourself.
* Key your access logs off of an (arbitrary and short lived) session id instead of a user id.
I use the term "code smell" in the same sense sense as "`if` statements are a code smell". It doesn't mean never to use them, it just means that solutions that don't use them tend to be consistently better than solutions that do. Solutions that store less (or no) data tend to be consistently more secure than solutions that do store more data. That doesn't mean those solutions always exist, just that one should prefer them when they do.
Earlier quoted context omitted.
Speaking as someone who has worked in security with many different companies: I don’t think your bar is reasonable (or intrinsically desirable).
It's not actually a reasonable goal . Almost all pieces of software will need some nontrivial amount of data to fulfill their purpose. I am convinced, however, that it is a very useful heuristic . The platonic ideal of a perfectly secure database is a completely empty one. Every step away from that requires individual justification. That doesn't mean your database will be small, but it should mean the database is as…
These types of guides always overlook the most important principle of software security: Always avoid reading, storing, or interacting with secure, personal, or otherwise "interesting" data. As much as possible, strip this information from your application, so that when it gets pwned the blast radius is absolutely miniscule. Create software not liabilities.
i always cringe when i enter all my payment details and then there's another step to "review before submit". i know you just stored all of that somewhere, CVV included.
I have had clients even in recent (One client had a single table with all CC info including name, address and postal/zip code.
One client didn't save it in their database, but had development logs enabled in production, saving all CC details to their logs for every transaction. We discovered they were enabled for more than a year.
To the best of my knowledge, they have fixed these issues. Regardless I have seen such similar patterns often enough to know it's not an uncommon practice in spite of PCI requirements to the contrary.
Earlier quoted context omitted.
It's not actually a reasonable goal . Almost all pieces of software will need some nontrivial amount of data to fulfill their purpose. I am convinced, however, that it is a very useful heuristic . The platonic ideal of a perfectly secure database is a completely empty one. Every step away from that requires individual justification. That doesn't mean your database will be small, but it should mean the database is as…
So where do you store this data then? Or do you just live with forgetting everything about a user (their name, details, history) every time they switch devices?
Next, I don't store what I cam fetch or derive. Say I'm using GitHub as an oauth provider. I don't need to store an email, an avatar, or a password hash. I can use GitHub's data. All I have to store is an opaque oauth ID.
Finally, if I do really need it and I can't get it from anywhere else then I'll happily store it. I just won't do it first, and I often won't do it until I've had a talk with the designers about what's possible with the data we already have.
> Don't assume something is secure without testing it. Just don't assume, please. Golden rule.