Graph/b6f1e40c-3b78-45e8-854b-cf6681dcd75a

Domainunvalidated

Encryption

b6f1e40c-3b78-45e8-854b-cf6681dcd75a

Encryption

Node Details

Public graph metadata

Updated4/30/2026

PageRank0.0004

Effectiveness0.000

Connections

50 linked nodes

CAUSED_BYProblem

Need to store private tokens for Lambda execution without keeping them in plain text

PERTAIN_TOProblem

My Sentry Auth Token is stored in a .env file. When I build the iOS or android app this Sentry Auth Token is exposed in the bundle. — I am building a react native app using Jenkins. Tension: I would like to prevent this from being exposed to app bundle. Outcome: I only need this in build time to upload the symbol maps.

PERTAIN_TOProblem

The token is visible in inspect > application tab in my browser. — The frontend stores the token in localStorage. Tension: My problem is this flow seems not very secure. Outcome: should I hash it and keep it in the localStorage or should I store it in the database.

PERTAIN_TOProblem

the permission policies in the template don't match what I would expect — The template.yaml for the 'producer' application looks like this. Outcome: So the repost doc is correct.

PERTAIN_TOProblem

you've got duplicate permissions defined in different places — Assuming the queue is encrypted. Tension: which isn't ideal, and you've got permissions defined that you don't need. Outcome: neither producer nor consumer need `kms:Encrypt`.

PERTAIN_TOSolution

SQS uses envelope encryption. Tension: It doesn't need `kms:Encrypt`, because it uses the data key to do the encryption. Outcome: The consumer just needs `kms:Decrypt` to decrypt the encrypted data key.

PERTAIN_TOSolution

either your queue isn't set up for SSE-KMS encryption, or your KMS key has the necessary permissions defined in it's key policy — How is the application able to function correctly with the permissions 'reversed' like this? Outcome: your KMS key has the necessary permissions defined in it's key policy.

PERTAIN_TOProblem

encrypted objects arn't replicated to the destination bucket after running terraform apply — setup S3 CRR between VA and OH. Tension: My code runs without any errors. Outcome: I had to add the destination key arn manually in the console.

PERTAIN_TOSolution

you need to add the kms key id — aws_s3_bucket_replication_configuration. Tension: encrypted objects aren't being replicated. Outcome: replica_kms_key_id is not specified in the replication configuration.

PERTAIN_TOProblem

Is there a way to not make a S3 bucket encrypted by default or may be remove the added encryption? — Amazon S3 now applies server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption for every bucket in Amazon S3. Tension: AWS recently changed their policy. Outcome: No. It is not allowed to disable encryption.

PERTAIN_TOSolution

This type of encryption is free and transparent — Amazon S3 now applies server-side encryption with Amazon S3 managed keys (SSE-S3) as the base level of encryption for every bucket in Amazon S3. Tension: No. It is not allowed to disable encryption. Outcome: This type of encryption is free and transparent, so there's no compelling reason to turn it off anyway.

PERTAIN_TOProblem

encrypting a lot of data that you're constantly querying will impact the performance — when you have a small amount of sensitive data (passwords, credit card info, etc.). Tension: encrypting a lot of data that you're constantly querying will impact the performance. Outcome: yes, TDE is the best choice because it works in a different way.

PERTAIN_TOSolution

when you have a small amount of sensitive data (passwords, credit card info, etc.) — encrypting a lot of data that you're constantly querying. Tension: encrypting a lot of data that you're constantly querying will impact the performance. Outcome: yes, TDE is the best choice because it works in a different way.

PERTAIN_TOProblem

I don’t need to run spatial queries in PostGIS (like ST_Contains, ST_Distance, etc. — Django project with GeoDjango models that store user location data. Outcome: I can handle geometry operations in Python (Shapely/GEOS) after decryption.

PERTAIN_TOSolution

you can use two `FloatField` instead and keep those encrypted — To preserve a mostly GIS-like API contract. Tension: Aside from not being able to do GIS transformations/comparisons at the queryset level. Outcome: our old OOP friends to the rescue - getters and setters.

PERTAIN_TOProblem

I’m referring to the official ESP-IDF documentation — after Secure Boot V2 has already been enabled. Tension: This command erases the entire flash, including the bootloader region (< 0x8000). Outcome: There is very little interaction between Secure Boot and Flash Encryption.

PERTAIN_TOSolution

You can flash as before — After you've enabled Secure Boot. Tension: The only restriction is that both bootloader and app images must be signed with the key that you've configured. Outcome: No need to worry too much.

PERTAIN_TOSolution

Flash encryption must be enabled in the same provisioning/programming workflow as Secure Boot V2 (before secure boot is finalized), rather than attempting to toggle it afterward; follow the ESP-IDF “enable workflows” that configure both features together, otherwise re-provision/flash from a state where secure boot is not yet enabled.

PERTAIN_TOProblem

as long as the keys are shipped together with the apk, they are not secured — Is there a way to safely deliver the SDK keys with the Android app? Tension: there is still a simple way to get them. Outcome: no matter where the SDK keys are stored.

PERTAIN_TOSolution

the API keys are stored in an encrypted form — more-annoying techniques (e.g., native code via the NDK). Tension: This too makes it more difficult for an attacker to get the keys. Outcome: but it does not prevent it completely.

PERTAIN_TOSolution

requires a valid account, SSL with certificate pinning — to protect your own server API calls. Outcome: This increases the difficulty for an attacker to get the keys.

PERTAIN_TOSolution

Choose solutions where the keys reside on your server — your server gets data from the client using your own APIs and forwards it to the third-party service. Tension: To prevent an attacker from getting client-side API keys.

PERTAIN_TOSolution

You should not use that value in the app that the users run — such as your development machine, a server that you control, or a serverless environment like Cloud Run/Cloud Functions. Tension: If a value is meant to be a secret from the users of your app. Outcome: make an endpoint on that environment that your app can call, and protect access to the endpoint.

PERTAIN_TORootCause

Presumably, that is deemed to be something that you would handle at a higher level in your app. — DataStore does not offer encryption. Tension: having DataStore implement encryption would make it more difficult to offer DataStore across platforms. Outcome: right now DataStore supports at least Android and iOS.

PERTAIN_TOProblem

DataStore does not offer encryption — I'm using Jetpack DataStore in my Android application and want to ensure it's secure enough for storing sensitive data. Tension: could it potentially be decrypted by an attacker? Outcome: Using DataStore for the actual storage should be fine, and you can encrypt/decrypt your data yourself.

PERTAIN_TOSolution

Using DataStore for the actual storage should be fine — for sensitive data storage. Tension: DataStore does not offer encryption. Outcome: you can encrypt/decrypt your data yourself.

PERTAIN_TOSolution

consider SQLCipher for Android — if your data is a better match for a relational database. Tension: Using DataStore for the actual storage should be fine. Outcome: consider SQLCipher for Android.

PERTAIN_TOProblem

Never store private keys or the corresponding certificate files (.pfx/p12) on an unencrypted file system. — the private key files on an encrypted file system. Tension: private keys or the corresponding certificate files (.pfx/p12) on an unencrypted file system.

PERTAIN_TOSolution

One easy solution is to store the private key files on an encrypted file system — where only the matching user has read access to the private key file.

PERTAIN_TOSolution

the TPM can be used to provide the root certificate — to encrypt the file system / partition.

PERTAIN_TOSolution

to search for the encrypted data. Tension: not ideal for security. Outcome: then you can use an index to search for the encrypted data.

PERTAIN_TOProblem

When sensitive fields are encrypted in PostgreSQL, queries using WHERE (e.g., exact match) cannot efficiently filter rows because the encrypted values cannot be compared without decrypting them. This makes encrypted-field searches slow and impractical at scale.

PERTAIN_TOSolution

Use blind indexing: store an additional column containing a salted secure hash of the plaintext (hash computed at insert via trigger or in application) and query by hashing the input and comparing against the hash column for exact matches. For more complex pattern searches (LIKE/substring), use specialized encrypted-search approaches/third-party solutions since they require advanced indexing structures beyond basic hashing.

PERTAIN_TOProblem

The clientside storage of this key should be as secure as possible and never be sent to the server — ts encrypted data and decrypts it locally. Tension: otherwise I as the owner (or an attacker in the system) could decrypt the users database entries. Outcome: Encrypting the plain text locally and storing the ciphertext remotely is the way to go.

PERTAIN_TOSolution

Encrypting the plain text locally and storing the ciphertext remotely is the way to go. — You want to have protection from the remote attackers? Tension: Encryption has never solved any problems for us. It has just shifted the problems somewhere else. Outcome: protection from remote attackers is doable.

PERTAIN_TOProblem

I get the error: "The security descriptor structure is invalid" — I'm trying to create a key in the TPM with the help of the NCrypt library and restrict the access to only my application in C++.

PERTAIN_TOProblem

return (*env)->NewStringUTF(env, "sk-XXXXXXXXXkeyXXXXXXXXX"); — storing the key in a `.c` file and returning it to my Kotlin code. Tension: Is this secure? Or what is the better approach to store API Keys.

PERTAIN_TOProblem

Anyone can rebuild your APK in debugging mode and just put a breakpoint at the right point in your program. — I'm using `openAI` directly in my Android Kotlin App. Tension: No matter how convoluted and complex you make the process of getting the API key, at some point it will sit in memory. Outcome: Do not do this.

PERTAIN_TOSolution

write a stupid simple request forwarder in AWS lambda or Azure Functions — have your application talk to that. Tension: your application talk to that. Outcome: At a bare minimum.

PERTAIN_TOSolution

storePassword System.getenv("your_password_variable") — store keystore and it's password on CI and access it during the build process. Tension: What you can do is to store keystore and it's password on CI and access it during the build process.

PERTAIN_TOProblem

I don't want to hardcode it. — How to make secure info of my sign app when I want to release my app. Tension: I would like to keep them safe from attacker and reverse engineering. Outcome: externalizing secrets.

PERTAIN_TOSolution

I would simply hold the secrets in memory — Based on the logic here. Tension: reading secrets every time disrupts availability. Outcome: I would also update the threat analysis if I get insight into new threats that appear in the future.

PERTAIN_TOSolution

Using the platform provided protection usually makes sense — Using the platform provided protection usually makes sense; it is pretty hard to securely store the encryption key within an application after all. Tension: it is pretty hard to securely store the encryption key within an application after all. Outcome: destroy the (copies of) the unencrypted key / passphrase after provisioning / use.

PERTAIN_TOProblem

all your data will look like a standard mariadb/mysql table — If you don't do anything special. Tension: Would the database be safe if someone gets access to the storage or would it be in plain text? Outcome: The appwrite database is stored in a Mariadb in the Docker network.

PERTAIN_TOSolution

it is never open to access from outside — Mariadb is located inside the appwrite network. Tension: If you don't do anything special. Outcome: The appwrite database is stored in a Mariadb in the Docker network.

PERTAIN_TOProblem

package com.igen.configlib.constant;. Outcome: This should never be stored as code in any central cvs, only is dedicated secret storages.

PERTAIN_TOSolution

This should never be stored as code in any central cvs. Outcome: only is dedicated secret storages.

PERTAIN_TOProblem

Need to store private tokens for Lambda execution without keeping them in plain text

PERTAIN_TORootCause

keep them somehow in an encrypted global variable or some other way AWS is offering for such things? Tension: avoid keeping them in the lambda function in plain text. Outcome: Your Lambda function will need the relevant IAM permissions to access the secure parameter/secret, as well as decrypt permissions for the KMS key.

PERTAIN_TOSolution

You should use AWS SSM Parameter Store `SecureString`, or AWS Secrets Manager to store these values. — When using Secrets Manager, or when using SSM Parameter Store `SecureString`, the value will be encrypted using AWS KMS. Tension: Your Lambda function will need the relevant IAM permissions to access the secure parameter/secret, as well as decrypt permissions for the KMS key. Outcome: tell SSM or Secrets Manager to use that key for encryption.

[inerrata]Tags Knowledge Graph Docs About Pricing Contact Report a Bug Privacy Terms Cookie Settings Do Not Sell or Share My Info

Encryption - inErrata Knowledge Graph | Inerrata