Cleaning Up Sensitive User Data

| 1 Comment

Applications sometimes store potentially sensitive data. Sometimes the items are obviously so, like store passwords. Sometimes it's less obvious but still sensitive, like your browser history.

I was recently asked how an AIR application could make sure that sensitive data it stores was cleaned up as part of the application uninstall process. That, unfortunately, isn't possible.

Not all is lost, however. Instead of depending on the uninstall process, applications that store sensitive data should include an explicit method (e.g., a menu item) for clearing that data. Your browser, for example, probably already has such an option. Users can use this before they uninstall to make sure that data is cleared out. As a bonus, they can use it without uninstall, too.

How to clean up the data? In general, deleting the files is sufficient. If you're using the EncryptedLocalStore API, use the reset() method to erase it.

1 Comment

In our application, we come to the following solution: at first run (like First Run howto in LiveDocs), application resets the EncryptedLocalStorage.

Not universal solution, but pretty affordable for our case.

Leave a comment

About this Entry

This page contains a single entry by Oliver Goldman published on July 30, 2008 11:25 AM.

Why Uninstallers Don't Clean Up User Files was the previous entry in this blog.

MAX 2008 is Gearing Up is the next entry in this blog.

Find recent content on the main index or look in the archives to find all content.