Level 31
Accessors & Mutators with Crypt facade
https://laravel.com/docs/8.x/eloquent-mutators#accessors-and-mutators https://laravel.com/docs/8.x/encryption
1 like
May 3, 2021
9
Level 2
With GDPR is everyone encrypting names and emails?
Eloquent mutator/accessor or something like https://github.com/betterapp/laravel-db-encrypter ?
Level 54
@chrisan can you explain how encrypting names and email addresses has any effect on GDPR?
Level 122
(f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, using appropriate technical or organisational measures (‘integrity and confidentiality’)."
Which usually means securing the database entries. However, there are multiple possible ways of doing this depending on where the risk is deemed to be
Level 54
@snapey if you are encrypting before storing in a database, but have the encryption key available in your app to decrypt, you aren't doing any GDPR protection if someone can compromise your server and then get access to your database.
You should be obfuscating personal identifiable information if you are exporting your data for development use, which would prevent these database copies from having any intrinsic value to unauthorised 3rd parties.
That aside, I’m still interested in why @chrisan would see encryption on the way in being of use, unless you are encrypting to write to the logs.
Level 122
clearly the app needs access to the plain text. Encrypting covers a compromise of the database server, backup copies, or access to the data some other way without going through the application.
Level 54
Would you suggest encryption of all personal identifiable information before its stored in the database?
I’m playing devils advocate here btw. Having recently refreshed my OWASP knowledge, I’m curious about how you might get access to a database without getting it via the application. If that was the case, you’d have to report a data breach even if data was encrypted.
@snapey Is encryption of PII something you do in laravel by default? The package that @chrisan mentioned looks interesting but it’s not something I’d thought of doing before I this thread.
Level 2
I’m curious about how you might get access to a database without getting it via the application.
A backup copy in an unsecured place, direct database access if you don't lock things down. Or in the case where you have an employee (or yourself) with a compromised computer, they likely have access to backups or direct database access or even a development copy to debug with locally.
I am definitely no hacker to think up all the ways an attack could happen, and in our case we are just a B2B app, so "who cares" if the world knows some business has an account with us, but alas there is always that checkbox for "encrypted pii data at rest" when signing vendor agreements. So far that hasn't prevented us from signing a new company, but my boss would like to check that box lol
Level 39
With GDPR is everyone encrypting names and emails?
More than before but not a lot , less than 10% based on on own experiences (on some thousands of app)
Why?
Lack of GDPR knowladege/compliance ... to good GDPR with decision/need to encrypt these data.
First step of GDPR is Risk Analysis and why encrypt data if you are not able to well protect the key(s) or have more weakest points. As I read in your last answer, your are not an hacker but aware of different weaknesses. Following links points on all the aspects, encryption is only one point of 10. https://digitalguardian.com/blog/how-secure-personally-identifiable-information-against-loss-or-compromise
Second point, GDPR, deals with contacts/suppliers responsibilities, so (technical) solutions should be different based on what you delegate to your supplier(s), for instance you can host your app or ... have a supplier to host it and delegate him take care of your backups. Having a supplier to host your app does not mean you ask him to do this job, you can decide to work with a encrypt app , for instance with https://www.ioncube.com.
That said, complies with "encrypted pii data at rest" for business purpose is an other point but pay attention to the new responsibility.
Level 50
So in other words look like no one is encrypting PII. Another caveat is also that you can not search by encrypted column so how would you search user by his email???
Please or to participate in this conversation.