When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client...
Can someone explain to me be benefits of encrypting the database key when it arrives at the browser?
How would you encrypt this key? What methodologies would you use for validation?
Ideally this response would be phrased in a way that will sell a PM or executive on the benefits/drawbacks of this practice.
If you are unfamilliar with web programming, what I'm talking about is the often hidden primary key that is sent to the client (web browser, fat client, or other) and decrypted at the remote end of the HTTPS tunnel. The argument is that it is more secure to encrypt and obfuscuate the primary key (or fk for that matter) when sent to the client.
Although I haven't found any formal research per-se, I did a proof-of-concept website that applies to either a multi-tenant sites, or where there isn't enough server-side validation of the target row. I'm sure this is a security issue, but it may be too programatic in nature for this IT Security forum...