4

How can personal information that needs to be retrieved at a later date be stored securely in a database? For instance when companies store social security numbers and use them for taxation purposes. They have to be stored securely obviously, and retrieved later. It seems using hashes and salt as with password storage isn’t the correct solution. From a high level, how is this done?

2
  • Limit access to who has what's stored, no matter how it is stored, please. Oct 15 '19 at 18:26
  • If you have to ask this then you are a very long way away from securely storing this data. If the question is just for curiosity then the answer is there are a lot of things that need to be done including physical security of the building, preventing individual employees accessing data without multiple approvals, preventing access to the system from the outer internet and a team of talented security experts.
    – Qwertie
    Oct 16 '19 at 4:06
7

Encryption is what you want. Password hashing schemes just check that you've heard the same password twice. They don't even let you figure out what the password is. Encryption would.

Tread lightly here because there are many laws about storing social security numbers. Just saying "It's encrypted" isn't enough. For example, where are you storing the encryption keys? How secure are they?

2
  • 2
    "How secure are they" - Exactly - a lock is only as secure as the keys; if they're hanging on a hook nearby... then there's no real security (maybe a little protection against people just walking by), but if someone's actually looking for a way in they won't even be slowed down
    – Delioth
    Oct 15 '19 at 20:32
  • Encryption is also no use at all if the other side which is "storing and retrieving" is attacked since the data will helpfully be decrypted and handed over.
    – Qwertie
    Oct 16 '19 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.