How to encrypt users' personal data?

Question

Django

Let's say I have a Django application that stores personal user data (Photos, Passwords, Videos) in SQLITE3/POSTGRESQL. How to store them on the hard disk in encrypted form, and give them to users upon identification (using a password) and decrypt them directly into the stream? Do databases encrypt information?
Thank you)

Answer 1

Let's differentiate. Encrypting a password is not the same as encrypting other data. The password should not be encrypted, but hashed. This is an encryption that cannot be decrypted back. That is, having a hash, you cannot get a password, and having a password, you can get exactly the same hash. There are special hash functions for this. But hashing passwords is not enough, they must first be salted. The salt is arbitrary text appended to the password before hashing and placed next to the hash in clear text. A salt is needed so that it is impossible to guess simple passwords by the value of their hashes.
The password check will be as follows:
1. We ask the user for a login and password.
2. We get the hash of the salted password from the database by login.
3. With this salt, we hash the password entered by the user during authorization and compare the hashes. Matched - so let's go.
The encryption of other data obviously needs to be already reversible so that it can be decrypted. And now there are two options: server-side and client-side encryption.
The server side doesn't make sense, because a compromised server means everything needed to decrypt the data is leaked. An uncompromised server means that the data seems to be safe anyway. So you don't need to encrypt (well, except for some special cases).
Client-side encryption is when the server does not have the ability to decrypt the data. They are encrypted on the client before being sent with a key that does not leave the user's computer. Then the client will again request the encrypted data from the server and decrypt it itself too. This sometimes makes sense. For example, if you store keychain with passwords on the server, but do not want them to be leaked if the server is hacked.
There is also p2p encryption, where, using a special algorithm, users exchange keys through the server so that neither the server nor anyone else can recognize these keys. Further, encrypted information goes from user to user through the server, which no one except end users can decrypt. This is the so-called end-to-end encryption.
As a result, there is no need to store encrypted data on the server, since everything that is needed for decryption is also on this server. If someone got in there, then he will whistle the encryption keys and intercept the data after decryption or before decryption. There is no point in hiding boobs. if the butt is naked.
Oh, I almost forgot. There is a danger of leakage of unencrypted data from data centers if there is physical access to hard drives. To protect yourself in this sense, you can apply transparent file system encryption. The running operating system will know the key to decrypt the data, but the disconnected disk becomes useless without the key. However, this is ineffective if the entire server is stolen along with the disks. But it is effective against data recovery by crooks if the disk burned out, and the system administrator threw it away without drilling.
Another aspect is the transmission channel. It makes no sense to be afraid of the interception of unencrypted data in the transmission channel, even in the last mile of the client provider. This is taken care of by SSL when HTTPS is properly configured and the certificates are not compromised and the user has not swiped the left certificate.
If you ask a question about the need for encryption, then you do not need to encrypt anything beyond the above. This will complicate the system, make it less reliable, more (paradoxically) vulnerable and take away CPU and memory resources, prevent or complicate caching and other optimizations.

Answer 2

Do databases encrypt information?

YES.
Read the documentation for the selected database.