Tagged Questions

-5
votes
0answers
31 views

Encrypt .war file java web application? [duplicate]

Is it possible to encrypt the file .war with all its contents, and then have served understand this application? I saw something similar with JarCryp, most do not know if it's working on servers like ...
0
votes
4answers
232 views

Is using the md5 hashing algorithm as method for authorization in an HTTP POST request unsafe?

I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
8
votes
3answers
325 views

AES using derived keys / IVs. Does it introduce a weakness?

I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application. Obviously in order to re-use this key, a unique ...
7
votes
4answers
777 views

Generate cryptographically strong pseudorandom numbers in Javascript?

Is there any good way to generate cryptographically strong pseudorandom (or true random) numbers in Javascript? The crucial requirement: if a.com's Javascript generates some random numbers, no one ...
-1
votes
2answers
109 views

Should I use salt to authenticate data?

I have a client and a server. The client makes a request containing userId, cardId, position (on the card) A hacker could just do the same http request with the next position. So I think about ...
3
votes
1answer
169 views

Is there a way to store user files without being able to decrypt them?

I'd want to build a secure file storage web application. Currently ordinary password authentication is used for login. After login this password is used for encryption and decryption of user files at ...
2
votes
2answers
112 views

Security of asymmetrical decrypting proxy

I'm thinking about the safest possible way to store secure data (eg. Credit Card numbers) with a requirement of sending them in clear text to third party API (so hashing doesn't come into play). I've ...
1
vote
3answers
3k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
2
votes
1answer
207 views

Is SSL session based only? Is there a (formal) definition of an SSL connection?

In various docs on SSL there is a mention of connection. But from the context I am not sure if this means the underlying TCP connection or the SSL connection. I am thinking that there is no SSL ...
3
votes
1answer
5k views

AES-256 OR RSA-2048 for web application security?

I'm developing a web application with a database backend using Django that will be accessed from the Internet. The database will contain sensitive information and I'd like some advice on the approach ...
3
votes
1answer
395 views

Securing sensitive data in a DB,is using H2 worth it?

I am designing a web application at the moment, and one of the requirements is to secure the user credentials as well as their roles. Now ofc besides the usual pwd hashing + salt +.... I was thinking ...
7
votes
4answers
998 views

Is using HMAC to transmit a password OK?

I'm writing a small webapp and I don't want to transmit login passwords as cleartext. As I don't have SSL available I've written a one-time challenge system which sends a random string with the login ...
3
votes
2answers
578 views

Is this algorithm for a random string cryptographically secure?

I've pieced together this algorithm (if it can be called that) from various bits of code I've seen online, and I'm wondering how cryptographically secure it is. It's used to generate passwords: ...
23
votes
5answers
1k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
32
votes
2answers
4k views

Is a rand from /dev/urandom secure for a login key?

Lets say I want to cookie for a user, would simply going to /dev/urandom, generating a 1024 bit string, checking if it already exists (and looping till I get a unique one) suffice? Or should I be ...
4
votes
3answers
385 views

It is safe to buy a domain if I get this message in Firefox?

Greetings, I want to buy a domain name from a big registar(well known on the internet) but when I go to checkout I see that my link is going from full encrypted to “Connection Partially Encrypted” ...
3
votes
2answers
157 views

Encrypting a fixed format message?

I'm planning to send across TWO pieces of information over the internet from machine A A site identifier which will be like: $SiteName = "EXAMPLE" (in plaintext) Encoded text which will be like: ...
1
vote
2answers
785 views

Thoughts on Tiny Encryption Algorithm (TEA, anyone)?

I'm planning to implement Tiny Encryption Algorithm and exchange data between two PHP sites. Specifically, using the code presented at PHP-einfach.de Does anyone have any experiences / thoughts / ...
5
votes
2answers
614 views

Generating one-time tokens from API-key?

I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site. I intend to distribute secret API-keys to ...
6
votes
3answers
3k views

What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?

I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider. Question 1 Why ...
26
votes
5answers
2k views

Are GUIDs safe for one-time tokens?

I see a lot of sites use GUIDs for password resets, unsubscribe requests and other forms of unique identification. Presumably they are appealing because they are easy to generate, unique, ...
0
votes
1answer
440 views

How can I decrypt ADFS-based SAML/p or WS-Trust claims?

I'd like to audit the claims that are sent to a client from a SAML/p or WS-Trust authentication. What private keys do I need and how would I decrypt this information? If it makes any difference, I'm ...
7
votes
4answers
541 views

If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?

In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...