Questions tagged [sensitive-data-exposure]
126 questions
30
votes
6 answers
As a contractor how do I work on multiple client networks without data leakage?
I am a contractor who does development for more than one client. Let's call them Client A, Client B, and Client X.
I use my own laptop for all 3 clients.
Throughout the day, I have to work on and respond to emails and instant messages about…
![](../../users/profiles/178435.webp)
duggulous
- 401
- 4
- 8
29
votes
5 answers
Does the destruction of sensitive information limit the choice of hard drives to non-flash based devices?
Working with a non-profit organization,it's common to reuse hard drives that have previously stored highly sensitive information such as medical and financial records. This is primarily driven by cost-saving measures to reduce purchasing new hard…
![](../../users/profiles/61038.webp)
Motivated
- 1,493
- 1
- 14
- 25
26
votes
4 answers
Do my Windows system binaries contain sensitive information?
I have a dataset from a malware detection project that others want to use. Part of that dataset is system binaries that I had retrieved from my PC by searching for *.exe files (to serve as a benign dataset). Is it safe to share these files or can…
![](../../users/profiles/200975.webp)
Niket Bhodia
- 369
- 3
- 4
25
votes
3 answers
Computer name naming convention for security
I've been doing a security audit and found out you can easily identify host roles and running services just by their computer name (using nslookup).
I would like to report this so that they use less obvious computer names and it becomes harder for…
![](../../users/profiles/110133.webp)
Xavier59
- 2,874
- 3
- 17
- 34
23
votes
12 answers
Is there a way to hide HTML source code yet keeping it effective?
I have a website with a client-side HTML contact form created manually (not as output of an HTML constructor like PHP):
20
votes
2 answers
Pwned by a website I never subscribed to - How do they have my e-mail address?
I searched my email addresses in https://haveibeenpwned.com/.
One of my e-mail addresses results as having been pwned, and is present in a data breach, in particular the Apollo data breach:
Apollo: In July 2018, the sales engagement startup Apollo…
![](../../users/profiles/246121.webp)
robertspierre
- 495
- 2
- 11
19
votes
3 answers
How to deal with a company that doesn't fix (potential) security vulnerabilities in their web app?
About 2 weeks ago, I stumbled across a web application, that can be used by gyms to manage the information about their members. This includes data like the name, billing address, birth date, and medical history. The gym I am visiting (in Europe) is…
![](../../users/profiles/223898.webp)
Moritz W.
- 193
- 5
16
votes
6 answers
How do I investigate where personal information in a fraudulent email was leaked from?
I have seen an email which is obvious from the content that it's a phishing/spurious email. However, the personal content is quite revealing and specific to that individual. How could I go about investigating how and where this personal data was…
![](../../users/profiles/148457.webp)
Djuro
- 169
- 1
- 4
12
votes
1 answer
Browser cache information disclosure
Observing the time needed by a browser to load external resources such as images potentially discloses information about whether those resources have been accessed before.
Explanation:
For example, by embedding the StackOverflow logo within a…
![](../../users/profiles/168922.webp)
le_m
- 220
- 1
- 6
10
votes
2 answers
Are there regulations that govern how social security numbers are stored and viewed?
I'm working for a client that keeps records of social security numbers in their databases, numbers pulled from screenings and automatically captured from companies and other financial data. A few million SSNs attached to names, addresses, work…
![](../../users/profiles/79540.webp)
Douglas Gaskell
- 1,209
- 3
- 10
- 15
9
votes
1 answer
Employer stores plain text personal data in a 'data warehouse'
I'm unsure if I have posted this in the correct community but the organisation I am currently working for currently uses an SQL 'data warehouse' which contains a bunch of tables from various sources, for various purposes. This data warehouse (as far…
![](../../users/profiles/213346.webp)
nopassport1
- 193
- 4
8
votes
2 answers
How to separate storing sensitive data and hash passwords?
Scenario: I have a web application with an authentication system (classic). The application is basically an interface to a DB (MongoDB) which holds sensitive data. I properly hash the stored passwords.
Assuming hashing prevents the attacker from…
![](../../users/profiles/159632.webp)
Icki
- 81
- 1
8
votes
5 answers
Hiding sensitive data in URIs
This is a potentially hypothetical question since it has not been determined whether we will be required to do this but I figure it's a question that will come up more often.
Background
When implementing RESTful services the standard approach is…
![](../../users/profiles/88460.webp)
JimmyJames
- 2,956
- 2
- 16
- 25
7
votes
1 answer
Does WhatsApp's link preview on the link messages leak information?
When we want to send a message that contains only a link - such as a question from the Stack Exchange network - WhatsApp displays information from the website as below:
Does this leak information about what was sent, and from who, and to whom?
We…
![](../../users/profiles/86735.webp)
kelalaka
- 5,409
- 4
- 24
- 47
7
votes
1 answer
What are good methods of visual security?
What are good methods of visually securing sensitive information that might appear on your screen from the outside world?
An example to illustrate my question would be the following:
You're sat in a coffee shop using WiFi to do some work. You want…
![](../../users/profiles/169476.webp)
li x
- 462
- 4
- 11