Is there a way to encrypt the following user fields in the database so that they cannot be retrieved from a compromised database?
- Username
- Email address
A solution to encrypt the whole database would also be great.
asked Mar 9, 2012 at 9:58
Add a comment
|
3 Answers
If you want encrypt it, it means you need to decrypt it. So it means that the algorithm that encrypt and decrypt are available somewhere in your application or drupal files.
I guess if the user that has access to your database he has also access to your files, or at least I guess he can have access easily.
And in that case, encrypted datas are useless.
The most important its to hash the password with algorithms like SHA1 and use a salt or private key, thing that Drupal 7 is doing.
This is just my point of view, but if you want do it what you can use this module http://drupal.org/project/aes and with some user hooks, such as hook_user_presave() and hook_user_load().
The trick in this case it's that your module should be the last one before saving save the data and be the first one that decrypt data.
-
I think that's what I thought suspected. Thanks for your response. Commented Mar 9, 2012 at 12:28
-
«And in that case, encrypted datas are useless.» While true for Drupal, this is a false statement, in general. One-way-encrypting an emailadress or username is a good precaution in many apps. Obviously you cannot email the user anymore, but login with that handle is still possible. Drupal, however, requires an email for various reasons. With Drupal you cannot encrypt the mailaddress, but with many applications it is perfectly reasonable thing to do.– berkesCommented Sep 26, 2012 at 9:28
-
It is unfortunate that AES encryption is not covered by Drupal’s security advisory policy.– SivajiCommented May 30, 2017 at 12:55
-
Encrypting data is decidedly not "useless", because in many hosting environments database servers are hosted separately and can potentially be hacked by different methods. Backups will typically be held somewhere else again. Commented Apr 17, 2018 at 8:32
-
"The trick in this case it's that your module should be the last one before saving save the data and be the first one that decrypt data." - in Drupal 8/9 is that controlled by the order in which modules are listed in
core.extention.ymlconfig file ? Commented Mar 23, 2021 at 14:56
Database encryption will help you to encrypt the email: drupal.org/project/dbee.
Looking into this same module you could try to encrypt also the user name.
-
-
and as per above: "The trick in this case it's that your module should be the last one before saving save the data and be the first one that decrypt data." - in Drupal 8/9 is that controlled by the order in which modules are listed in
core.extention.ymlconfig file ? Commented Mar 23, 2021 at 14:57 -
The easiest (but not cheapest) way to encrypt the whole DB would be to use an Oracle DB (with this module) with Transparent Database Encryption.
answered Mar 31, 2014 at 10:32
