this post was submitted on 08 Jun 2024
17 points (100.0% liked)

Learn Programming

1631 readers
1 users here now

Posting Etiquette

  1. Ask the main part of your question in the title. This should be concise but informative.

  2. Provide everything up front. Don't make people fish for more details in the comments. Provide background information and examples.

  3. Be present for follow up questions. Don't ask for help and run away. Stick around to answer questions and provide more details.

  4. Ask about the problem you're trying to solve. Don't focus too much on debugging your exact solution, as you may be going down the wrong path. Include as much information as you can about what you ultimately are trying to achieve. See more on this here: https://xyproblem.info/

Icon base by Delapouite under CC BY 3.0 with modifications to add a gradient

founded 1 year ago
MODERATORS
[email protected]
[email protected]
[email protected]
17
Value of "encrypted at rest" data (lemmy.world)
submitted 5 months ago by [email protected] to c/[email protected]
4 comments fedilink hide all child comments
 

I'm writing a specification for a web app that will store sensitive user data, and the stakeholder asked that I consider a number of fairly standard security practices, but also including that the data be "encrypted at rest", i.e. so that if someone gains physical access to the hard disk at some later date the user data can't be retrieved.

The app is to be Node/Express on a VPS (probably against sqlite3), so since I would be doing that using an environmental variable stored in a file on that same computing instance, is that really providing any extra security?

I guess cloud big boys would be using key management systems to move the key off the local instance, and I could replicate that by using (Hashicorp Vault?) or building a service to keep the key elsewhere, but then I'd need secure access to that service, which once again would involve a key being stored locally.

What's your thoughts, experience, or usual practice around this?

you are viewing a single comment's thread
view the rest of the comments
[–] [email protected] 2 points 5 months ago* (last edited 5 months ago)

I might be misinterpreting what you said, when I say that:

  • I unfortunately don't know how to provide Encryption at Rest on cloud based systems/services

My experience in providing data-at-rest_encryption aka Full Disk Encryption (FDE) is with LUKS2 on Arch Linux and NixOS

  • you might want to verify with your stakeholder if ^this is what they're looking for

hope the links help to provide a bit of clarification!