27

From security reasons, is it worth encrypting user emails before putting them into the database?

I know we hash and salt passwords but that's another story as we do not really need password originals. With emails it is different.

Knowing that the decryption key will anyway be somewhere close to the database, does it make sense to encrypt emails? I suppose if someone gets into the system, they will find the key as well, if not immediately then eventually.

What are the best-practices? Are there any other options available if I run my own servers and not on a shared/virtual hosting?

EDIT: I intend to use SQL Server. And no, it is no corporate software with security requirements, just some entertainment site I have in mind.

User
  • 30,403
  • 22
  • 79
  • 107

10 Answers10

30

If you're going to need the email address in the future, then you'll have to store them in plain text.

You could encrypt them, of course, however, this is effectively security through obscurity in this case. Basically, if your application's perimeter is secure, your data within it can be plain text. Encrypting here adds complexity to you working with the data, but doesn't really stop an attacker from getting your raw data.

As you say, if he gets through your perimeter defenses, he's likely to easily get your decryption key to decrypt the email data. Encryption may slow down the determined attacker slightly, but will not add any real security to your data.

The best scenario is to hash the email address (with salt!) and store that. This allows you to check the email address against an input value (for example) and verify that the email address input is the same as what you have stored, of course, the major downside for this is that you can't know what the email address is without that additional value, so if you're wanting to (for example) regularly email your users, you'll be out of luck.

I suspect you're storing the email address because it's useful data, and you will want to do something with it (like send an email :) in which case, encrypting just adds overhead to working with that data, whilst gaining very little in return.

In this case, I would focus on securing access the database itself (i.e. your "perimeter" defenses) and ensure they are as strong as can be, whilst leaving the data in the database in plain text.

CraigTP
  • 44,143
  • 8
  • 72
  • 99
13

Hopefully this answer will answer your question as well.

Is it worth encrypting email addresses in the database?

In short, no, it is not worth encrypting user email addresses. You're right in thinking that a database compromise will likely result in somebody also gaining access to the keys required to break your encryption.

Community
  • 1
  • 1
Brett Bender
  • 19,388
  • 2
  • 38
  • 46
  • I've seen this one but it seemed to be quite narrow. I'd like to hear any thoughts with regard to email security. – User Apr 20 '09 at 07:49
  • 3
    Sometimes a server break-in only allows the attacker to see the database content itself, sparing the key, and therefore protecting the data. It would be ludicrous, though, to count on that being the case. – tylerl Apr 20 '09 at 07:54
  • I would have to agree with others answering this question then. Most email addresses are spammed to high heaven regardless. Ones that aren't usually have spam-blocking in place, and no amount of encryption will save users if their password is "password" and somebody finds their email address. I would follow @MaxVT's advice though and sanitize/validate email addresses. Using database-wide encryption like @zoomzoom83 suggested is also a good idea if you're still concerned about security. – Brett Bender Apr 20 '09 at 07:54
  • I wouldn't consider spam the real problem when revealing email addresses. Often an email address is really a personal detail, identifying the user. Database-wide encryption is only useful when SQL Injection is taken care of, like it should be, of course. – Arjan Apr 20 '09 at 09:58
10

In general I agree with others saying it's not worth the effort. However, I disagree that anyone who can access your database can probably also get your keys. That's certainly not true for SQL Injection, and may not be true for backup copies that are somehow lost or forgotten about. And I feel an email address is a personal detail, so I wouldn't care about spam but about the personal consequences when the addresses are revealed.

Of course, when you're afraid of SQL Injection then you should make sure such injection is prohibited. And backup copies should be encrypted themselves.

Still, for some online communities the members might definitely not want others to know that they are a member (like related to mental healthcare, financial help, medical and sexual advice, adult entertainment, politics, ...). In those cases, storing as few personal details as possible and encrypting those that are required (note that database-level encryption does not prevent the details from showing using SQL Injection), might not be such a bad idea. Again: treat an email address as such personal detail.

For your entertainment site this is probably not the case, and you should focus on prohibiting SELECT * FROM through SQL Injection, and making sure visitors cannot somehow get to someone else's personal profile or order information by changing the URL.

Arjan
  • 22,808
  • 11
  • 61
  • 71
9

One of the most often-cited truisms in computer security is that the only truly secure computer is one buried in concrete, with the power turned off and the network cable cut.

With that in mind the best way to securely store email addresses? Dont store them at all!

tl;dr Do you need their email address, or a way of sending them emails? Either trust someone who will do a better job than you or don't use the email address at all.

Why do you need to keep a record of a customer's email address? The only reasons I have run into are:

  • Account confirmation & authentication
  • Transaction & Marketing emails

Confirmation & Authentication

The core of what we want is two step authentication: Something they know and something they have. Something they know is a password, and is easy to prove since they will be the only one who knows it. Something they have is harder to prove and traditionally we use an email address since it is easy to verify. These days though there are other things we can use:

  • Mobile phone
  • An account with a trusted website (Facebook, Google, Twitter)

Mobile phone verification is simple. Send them a sms using a service like twilio.com and ask them to text back a confirmation code. We now know that the mobile belongs to the customer who wanted to register. With OpenID you can verify existing accounts with other trusted sites, and the confirmation process is handled by them.

For the customer to authenticate then all they provide is either their mobile number and password, or an OpenID authentication token. Neither require a email address (well the OpenID provider might but thats not your responsibility).

If these are not an option then you can still confirm an email address and then use it for authentication. Confirmation only requires a unique token to be stored and a link to be sent to the email address. Store a salted hash of the email address, and use that to match the account in the same way we do passwords.

Transaction & Marketing Emails

The real reason why we want to store the email address! So we can send them offers of stuff we think they need so they can delete it without reading it. Seriously though is email the best medium for this? If we have an OpenID account then why not use that for notifications? Send a Facebook message or write on their wall, @mention them on Twitter, send a text message to their mobile, build an app and push notifications at them. There are so many channels much more effective than email.

If you want to use email then use a email platform like Mandrill and MailChimp. When they register create a subscriber in a mailing list on MailChimp. Store the subscriber id with the account. For transaction emails ( reset password, account updates ) fetch the subscriber and pass the stored email to Mandrill to send the email. For mass marketing just send to the mailing list in MailChimp.

The only thing stored in the database is the subscriber id. It also gives all the benefits of using a email platform, unsubscribes, open and click through rates, e-commerce tracking etc. Email platforms will do a better job of delivering emails that you. They will also do a better job at protecting the privacy of their data than you. Let them do the hard work of database security so you can focus on getting more customers.

roo
  • 7,106
  • 8
  • 39
  • 45
2

I think that when people can come in your database you are anyway screwed :)

It doesn't make a lot of sense to just encrypt your email addresses. Beside that there will be a lot of other information in your database that you would not like to be gathered, the decryption key will be indeed within reach at the same time your database is open.

I would like to suggest to find your layer of security and data integrity on a higher level. So the prevention of people entering your database.

And why would email addresses be so important? Most people will anyway get spam or their email addresses will otherwise be available somewhere on the web.

Peter Smit
  • 27,696
  • 33
  • 111
  • 170
1

Depends on how often you access the addresses. If you read them once in a while, it might make sense, but this would be one of the last security issues I would spend time on.

soulmerge
  • 73,842
  • 19
  • 118
  • 155
1

I do not encrypt user e-mails. The point is to protect the database; the keys are accessible anyway if you actually want to use the e-mails once they are stored.

Do check the address for validity and possible SQL injection, though.

MaxVT
  • 12,989
  • 6
  • 36
  • 50
1

If the application server and database are on separate servers, it would generally increase security to have all or parts of the database encrypted.

Even if they are on the same machine, a hacker may not figure out where your password is stored (although I wouldn't rely on that).

I generally wouldn't encrypt the emails at the application level, instead relying on database-wide encryption offered by most enterprise databases.

Of course if you're using something like MySQL, then you have no choice but to do it at the application level.

I normally tell my clients it isn't worth the trouble encrypting a database, however if you have stricter privacy requirements it may make sense to do so.

James Davies
  • 9,602
  • 5
  • 38
  • 42
1

Encrypting database content is always a tricky consideration. Clearly the content is useless unless it can be unencrypted, and if that has to happen without human intervention, then you're storing both the cyphertext AND the key somewhere. If that somewhere is on the same machine, then one might wonder why you even bothered.

Well, there's a few reasons why you might want to do this. One is because you're required to do so because of some company policy. Another is that perhaps your database is housed in a more hostile environment than that machine that accesses it.

In general, encrypting database content isn't going to win you any awards, but if you can justify it, then you clearly have at least some motivation to do so.

tylerl
  • 30,197
  • 13
  • 80
  • 113
0

yeah could be helpful for the user if you hash it with salt. I had a code before which i used that I use salt and hash then I can decrypt it. Flow is that once user will register you then hash and salt (encryption process) it. Then if you need to fetch the encrypted data there will be decryption.

Jun Dela Cruz
  • 11
  • 1