jordanwb Posted December 18, 2008 Share Posted December 18, 2008 In a form that I made that is using HTTPS, one of the fields is for the Applicant and Co-Applicant's SIN numbers. Now I don't know how I'd go about encrypting them securely so that they cannot be obtained in a hacking. Any ideas as to storing SIN numbers safely? I'll probably find something in two minutes. I always do. :-\ Quote Link to comment Share on other sites More sharing options...
rhodesa Posted December 18, 2008 Share Posted December 18, 2008 depends on how you need to access them? you can always encrypt them with a one-way encryption using crypt(). But, you won't be able to read the SIN back. If someone provides the SIN again, you can find the matching record though. Just google for PHP user login tutorials and how to store passwords in a database....same concept Quote Link to comment Share on other sites More sharing options...
jordanwb Posted December 18, 2008 Author Share Posted December 18, 2008 That's the thing though, one way encryption won't work. Someone posted a link of an encryption algorhythm that uses a key. But if someone hacks into the server the hacker could get the key and the algorhytym. Quote Link to comment Share on other sites More sharing options...
rhodesa Posted December 18, 2008 Share Posted December 18, 2008 exactly, anything that isn't one-way is really just obfuscating it Quote Link to comment Share on other sites More sharing options...
jordanwb Posted December 18, 2008 Author Share Posted December 18, 2008 That's true. So it doesn't really seem worth it to encrypt the SIN numbers. Quote Link to comment Share on other sites More sharing options...
rhodesa Posted December 18, 2008 Share Posted December 18, 2008 That's true. So it doesn't really seem worth it to encrypt the SIN numbers. um...that is up to you. obfuscation while not bullet-proof in any way shape or form, it is still a layer of protection. but, by obfuscating, it's adds an extra layer of complexity to your code... Quote Link to comment Share on other sites More sharing options...
jordanwb Posted December 18, 2008 Author Share Posted December 18, 2008 um...that is up to you. obfuscation while not bullet-proof in any way shape or form, it is still a layer of protection. but, by obfuscating, it's adds an extra layer of complexity to your code... Couldn't hurt. I'll add some obfuscation. Quote Link to comment Share on other sites More sharing options...
fenway Posted December 19, 2008 Share Posted December 19, 2008 Look a the PCI compliance stuff for credit card numbers and CVVs. Same idea. Quote Link to comment Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.