How best to securely present personal info in a members account page

Question

I’m currently working on a utilities site for which signed up customers can access their personal information by means of an Account Page i.e. name, home address, email address, tel no. , billing info, submit readings and track usage.

The issue is an overzealous team member has proposed we look at masking out certain personal information (or other measure) within the users account page to restrict the amount of data exposed in case a customer’s account is breached. Is there any value by masking an email address or a telephone number? Credit card details will be masked.

While a customer’s personal info is of paramount importance to the company I can’t help thinking this added level of security paranoia will annoy users and ultimately ruin their experience. Shouldn’t it be enough that they’ve successfully completed the login process to gain access to their details? The team member’s ideas to view / unmask or edit personal details are for confirmation emails to be sent or similar means.

Answer 1

I think a thing that you can do is something similar to Amazon. When you try to access your bills or profile in amazon, you are asked to login again, since it may be possible that you just forgot to log off on some public pc.

Other than that though I don't see much need for "masking" the data once you are logged in (with the exception of credit card numbers, etc). The only security issue is hacking I think, and hackers don't really care about a masked mail address. Once they have the login data they have the access.

Answer 2

Short answer: it's paranoia (but see note):

---

Some very personal information should be masked, for example, credit card number, but you already do it. Anything else will just make customers experience less smooth.

Not one single site I know (not even my bank) masks telephone number and e-mail address and I don't see any reason they should do it. Note that data breach is a concern corporate's side, not customer's side (emphasis is mine):

The primary concern from a corporate governance perspective is that personnel conducting work in these non-production environments are not always security cleared to operate with the information contained in the production data. This practice represents a security hole where data can be copied by unauthorised personnel and security measures associated with standard production level controls can be easily bypassed. This represents an access point for a data security breach.

Moreover note that most dangerous breaches are server-side, not stolen logins (do you remember when Adobe announced hackers gained access to name and encrypted credit card numbers of at least 38 millions users?)

All these said then I don't see any valuable security improvement to mask that data, you'd better invest time and resources to secure and validate server side environment. Hackers may want to get all those information much more than one e-mail address because it will repay their effort.

---

Note: of course it depends which kind of product you sell. Drugs, medical treatments and other very special products or services may need a completely different approach (and it may also be regulated by law).

Answer 3

I haven't come across sites which mask my information unless it is related to banking. Partial masking gives the perception that the information is stored in that manner for safety purposes.

If you do need to go ahead with masking the information, you can do partial masking on these lines:

Email id: **[email protected]

Telephone Number: ******906

The * symbol can partially mask the email id and the telephone number. The person can easily identify that these details belong to them. I have come across this while making bank transactions once the card details are entered.

Answer 4

Assuming you are populating your form with an AJAX request, if you're only masking client side then this is kind of worthless. If you really care about the sensitivity of the data then the response from the server should also mask it. Else an attacker could simply open the browser's debug tools to see the unmasked values returned by the server.

Answer 5

Well it is not paranoia, and on GitHub, they mask your mail account when they are not sure whether it is you. (e**********[email protected] for [email protected]) You have to make your customers feel safe, and using a * will bring them the sense of security.
In our country, the carriers provide a service called one-click login (not SSO I'll explain). In our country the law requires websites to record every user's phone number (which is registered with our ID, so it is real-name). But now people are concerned with privacy and would not like to share the phone number. So that the carrier just provided such service to smooth the process. When you go to an account and register, you have the option to manually input your phone number or just "one click", option one you input the full number, option 2 you see your number masked, fooling you to believe your full phone number is not sent. (On the screen you see something like 152 **** ***1), but the TOS said it would be sent, while nobody reads them here.