4

Is there a way to encrypt the following user fields in the database so that they cannot be retrieved from a compromised database?

  • Username
  • Email address

A solution to encrypt the whole database would also be great.

0

3 Answers 3

8

If you want encrypt it, it means you need to decrypt it. So it means that the algorithm that encrypt and decrypt are available somewhere in your application or drupal files.

I guess if the user that has access to your database he has also access to your files, or at least I guess he can have access easily.

And in that case, encrypted datas are useless.

The most important its to hash the password with algorithms like SHA1 and use a salt or private key, thing that Drupal 7 is doing.

This is just my point of view, but if you want do it what you can use this module http://drupal.org/project/aes and with some user hooks, such as hook_user_presave() and hook_user_load().

The trick in this case it's that your module should be the last one before saving save the data and be the first one that decrypt data.

6
  • I think that's what I thought suspected. Thanks for your response. Mar 9, 2012 at 12:28
  • «And in that case, encrypted datas are useless.» While true for Drupal, this is a false statement, in general. One-way-encrypting an emailadress or username is a good precaution in many apps. Obviously you cannot email the user anymore, but login with that handle is still possible. Drupal, however, requires an email for various reasons. With Drupal you cannot encrypt the mailaddress, but with many applications it is perfectly reasonable thing to do.
    – berkes
    Sep 26, 2012 at 9:28
  • It is unfortunate that AES encryption is not covered by Drupal’s security advisory policy.
    – Sivaji
    May 30, 2017 at 12:55
  • Encrypting data is decidedly not "useless", because in many hosting environments database servers are hosted separately and can potentially be hacked by different methods. Backups will typically be held somewhere else again. Apr 17, 2018 at 8:32
  • "The trick in this case it's that your module should be the last one before saving save the data and be the first one that decrypt data." - in Drupal 8/9 is that controlled by the order in which modules are listed in core.extention.yml config file ? Mar 23, 2021 at 14:56
1

Database encryption will help you to encrypt the email: drupal.org/project/dbee.

Looking into this same module you could try to encrypt also the user name.

3
  • +1 upvote this is available for Drupal 9, too. Mar 23, 2021 at 14:54
  • and as per above: "The trick in this case it's that your module should be the last one before saving save the data and be the first one that decrypt data." - in Drupal 8/9 is that controlled by the order in which modules are listed in core.extention.yml config file ? Mar 23, 2021 at 14:57
  • correction: core.extension.yml Mar 23, 2021 at 15:15
0

The easiest (but not cheapest) way to encrypt the whole DB would be to use an Oracle DB (with this module) with Transparent Database Encryption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.