Imaginary example, simplified to better explain the question. Let's say I have a form with the following fields :
- user email
- who did you vote for in 2012
- who did you vote for in 2016
When submitted, I fill the following PostgreSQL (v.11) DB tables :
- Serial (auto-increment INT)
- Email (text)
- Unique_Random (INT)
- Vote_2012 (text)
- Vote_2016 (text)
The entries are (as far as I can tell) unlinkable across tables because there is no relation between the Serial and the Unique Random ints.
Threat model : attacker gains full control of the postgreSQL DB server (both hardware and software)
If I am correct, UserData entries are not inserted in any specific position when created, so it should not be possible to tell which was added last.
Is there anything else (logs, data position on disk, memory, ...) that can reveal which entries were created or updated at the same time (and thus are linked) ?
If so, what can be done to prevent this ?