1

Can I use WordPress Transients to store 'sensitive' data? For example login tokens or Captcha answers?

As far as I know all themes and plugins have access to transients. What would be another good way to store this kind of details?

Edit: The reason I ask this question is that I am creating a 2 Factor Authentication plugin that generates a login token. This token is sent via SMS or e-mail to the user. What would be a safe way to store this token.

Improve this question
2
  • "safe" from what whom and when? there is not really anything which is "just safe". Once you give any user some access he might be able to use some security issue to get the secret, the trick is to balance between functionality and security and not to worry about the NSA trying to break into a server, but about a more realistic threats.
    – Mark Kaplun
    Feb 19, 2017 at 14:23
  • You're right. I have decided to use User Meta within WordPress to store those keys.
    – xvilo
    Feb 19, 2017 at 22:18

2 Answers 2

Reset to default
0

Yes you can, transients is on your server, not accessible by front end client. You can use also update_option() https://codex.wordpress.org/Function_Reference/update_option

Improve this answer
1
  • Okay, so it is considered 'safe' if I would store a 2 Factor Auth sms code as a transient. I am not sure If would need to use my own database table or not. On the other hand. Any plugin or theme could expose the 2FA sms code via the transients API.
    – xvilo
    Feb 19, 2017 at 13:02
1

No. Nothing in wordpress environment is isolated enough to be used as a safe place for keeping secrets. Any other code can use you code to get the data (therefor encrypting things will not help).

If it is a true secret, then store it as a cookie/local storage on the user's PC if you are trying to save the effort required from the user typing his password/token/whatever.

Improve this answer
7
  • The idea is that the token is being send via SMS. It wouldn't be any secure if the user could read the token :')
    – xvilo
    Feb 19, 2017 at 13:33
  • Oh you are talking about doing DRM? it can never be done if a user can manipulate your code
    – Mark Kaplun
    Feb 19, 2017 at 14:05
  • I have edited my question about why I was asking this.
    – xvilo
    Feb 19, 2017 at 14:08
  • cookie/local storage? Really? It's the first advice on how to NOT store sensitive information.
    – Oksana Romaniv
    Sep 10, 2019 at 6:34
  • 1
    @OksanaRomaniv why? what is more secure than not storing the info on the server at all?
    – Mark Kaplun
    Sep 11, 2019 at 14:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.