0

I'm implementing an Auto-Twitter feature into my website that allows users to Auto-Post content to twitter, similar to YouTube's "AutoShare" feature.

This means I'll need to store Twitter account information into a database, which is very sensitive and serious data.

I wish to provide the maximum security for my users, this means I'll need to find a way to encrypt data into my SQL tables, while still making it possible to encrypt the data from SQL back into plaintext.

Using PHP - what's the safest, more efficient way of achieving this?

Thanks.

3 Answers 3

8

You should NOT be storing Twitter usernames/passwords (you can't even use this data for the API any more). Use Twitter's OAuth API to have users authorize your application.

0

As long as both the scripts and MySQL are running on the same server, encrypting it wouldn't help much.

If PHP has mcrypt support enabled, you can theoretically use it to encrypt the data. But you need to 1) store the key somewhere insecurely, 2) get it loaded in the memory. This will help in the most simple case of stolen database but it is still insecure. It's not an option.

Twitter offers authentication with OAuth which allows you to make a login where users won't need to share their password with you at all:

http://dev.twitter.com/pages/oauth_faq

Use it to connect to twitter. And also for all other services that offer support for it.

-1

first of all, use https not http protocol.

Also, use md5 or SHA for password encryption.

I would also encrypt the usernames, emails and everything with an encryption algorithm that can be decrypted by you only.

Hide your mysql database behind a DMZ and also put it seperate then the webserver/php server.

Thats my few ideas

3
  • PS: Other then that, make sure only you or trusted people have access to the server, source code and databases. Nov 22, 2010 at 13:57
  • 2
    MD5 and SHA aren't encryption algorithms. Nov 22, 2010 at 14:16
  • it's hashing I used the bad term ;) Nov 24, 2010 at 10:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.