-1

I am creating a Discord Bot in Discord.Net. So first, of course this bot is not a professional project, but I still want it to look as professional as possible. And a huge part is the storage and process of user data. Sure, I won't get data like Credit Card info, private adress or workplace. I just want a user account, where you can personalize the bot for your server. So all the data I may have are a username, a hashed password and an e-mail (I'm still drawing a concept. Not sure if I need a mail, or use Discord for Authentication). But nevertheless, I want to secure that data, like it's really valuable.

So my first idea was to safe the data into an SQLite-Database, which I already use for the Bot itself (Things like Money, or Userlists are stored there). But you cannot properly secure such a database, it's not SQL. Another idea was something like a single encrypted file, where all the data is stored. but that can get messy and eat storage really easily.

Also, even if I would store it into the SQLite-Database, I still could see everything. The password may be encrypted, but username and e-mail won't be. As I said, it may not be a big thing, but I also write this bot to learn things for future projects, and safe data storage is really important.

How can I save data like username+password or e-mail adress, while making sure that the data is unlikely to be exposed to anyone, including me? And also important, how can I process this data (I'm using C# for the bot), cause that's what data is for.

  • Can the downvoter please explain that downvote? – DudeWhoWantsToLearn Dec 19 '19 at 14:36
  • If your application can decrypt the data, and you have access to the same information as your app has (which is likely if you are an administrator of the app instance), then you can always also decrypt the data. – Bart van Ingen Schenau Dec 19 '19 at 15:39
  • 2
    The downvote was likely because the question is rather broad in scope. This will make an effective answer rather difficult. Maybe think of a way to edit the question so as to have a more specific problem you are trying to solve instead of asking for a general best practice. – maple_shaft Dec 19 '19 at 16:12
2

Protection of sensitive data can be a very complicated problem to solve and is generally not something that can be handled in a "black or white" way. There is no such thing as perfect security so the best approach on identifying how security needs impact your design would be to explicitly call out your data protection requirements here. If you are wanting to do this exercise in a professional real-world way then I would start there.

Identify the data elements that you would consider to be sensitive and write down information about them that are relevant to security.

  • Where is the data being stored?
  • What channels and interfaces are transmitting and receiving this data?
  • Who should have access to read this data (Human and Non-Human)?
  • Who should have access to write this data (Human and Non-Human)?
  • How should access be delegated?
  • Are there any regulatory or legal requirements to consider?

From your security requirements you can rationalize the need for certain technologies and design elements. These design choices tie back to your specific security requirements.

Before identifying How to solve this problem you need to identify What you are trying to solve.

|improve this answer|||||

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.