The tag has no usage guidance.

learn more… | top users | synonyms

2
votes
0answers
95 views

Secure backup encryption with OpenSSL

I know, the general advice is "keep your hands off crypto stuff". And the standard way to encrypt backup data securely would be using GnuPG. However, for a rather academic exercise, I would like to ...
0
votes
1answer
100 views

Is it secure to not expire keys in symmetric encryption?

Note that this question describe hypothetical case, that is never meant to be used in real world. Server communicates with clients with message structure: client_id, initialization_vector, encrypted ...
1
vote
1answer
104 views

Difference between Architecture review and a Design review

As the question says, I would like to know the difference(s) between an Architecture review and a Design review. If someone could explain the two using an example, such as an Architecture review of a ...
0
votes
0answers
73 views

How much risk is introduced by git's signing the commit hash rather than the blobs? [duplicate]

Since first switching from centralized VCS systems to a decentralized one—specifically git—I have properly understood that that git's commit ID's were hashes of the included objects and some meta data ...
60
votes
3answers
6k views

Heartbleed: Why does the client supply the length of the message at all?

"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request." Why do we even have the client report the length at all? If we can know ...
-1
votes
1answer
402 views

How is the widespread design of ATM rooms more secure? [closed]

Widespread ATM room designs are such that the machine faces the door which is less secure as compared to a situation wherein I face the door when using the ATM.
1
vote
0answers
103 views

Untrusted central server and self-hosted/local client

I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
2
votes
4answers
6k views

Is using Google Voice number for two-factor authentication a big mistake?

Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...
11
votes
3answers
955 views

How much information about the reason for an unsuccessful login should a web application give?

After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
5
votes
3answers
260 views

Does a 'reset password' website facility give away too much information?

If a website has a reset password facility (which will e-mail the account holder a reset link), does this facility reveal too much information by allowing someone to probe who holds an account by ...
3
votes
1answer
508 views

Does anyone know how to use TRIKE?

TRIKE is an open source threat modeling methodology and tool, as presented by the authors. After i tried several threat modeling tools and methodologies, I have the feeling that it is the only real ...
2
votes
2answers
159 views

Bad planning causing weak passwords

The athletic department at my university has a facebook page and on it they said "the first 500 people to register for this event will get free t-shirts". When registering one has to create an account ...