Tagged Questions

3
votes
1answer
74 views

Online only encryption

I understand that one can use for example PGP (or GnuPG) to encrypt emails and files. (And I understand that there are other programs out there that will do "similar things") This, though, requires ...
-3
votes
2answers
44 views

Idea: Safety data exchange with OTPs [closed]

I need a safety data exchange system. My idea was: Every person is getting an usb stick with a list of One-Time-Pads (random data by random.org). Each list/block of random data has an identifier ...
2
votes
1answer
105 views

User Authentication API

I'm developing a web API for a user database that will be used to verify a given username / password combination is valid. I'm just looking for comments / criticism on the following method that I'm ...
3
votes
3answers
101 views

Avoiding direct object references

Say I wanted to avoid exposing a database primary key in a URL; somehow I must encrypt the key, so that the url only exposes elements of an unenumerable cipherspace. What kind of encryption should I ...
3
votes
2answers
141 views

Sharing encrypted data

I have a web app that is storing information related to a organization that I would like to encrypt but share amongst organization members. I would only like the members of the organization to be able ...
1
vote
2answers
368 views

will google detects tor browser?

Usually while we browse Google through our i.p we will be redirected to respective countries,i normally use tor browser for anonymity,today while i browse google i got redirected to ...
41
votes
1answer
7k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
6
votes
1answer
333 views

Encrypting sensitive data in software and storing/decrypting it on a server

I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing. I'm developing software which has 2 parts - a C# program run ...
3
votes
4answers
407 views

How to “demonstrate” man-in-the-middle attack?

I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project). Over the years a bunch ...
0
votes
2answers
57 views

How can I set up signed downloads?

Scenario I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
3
votes
3answers
131 views

Is it safe to mix authentication methods?

Is it a good idea to "combine" authentication methods? Example we can use username/password method to authenticate a user from a server. What if we used this as a first authentication step to get ...
1
vote
1answer
192 views

Picking an encryption algorithm for auth tokens passed via AJAX

I'm looking for a low CPU intensive encryption algorithm, to pass around session authentication tokens. As an example: The user will login in to the website (via OAuth, whether by the site as ...
5
votes
3answers
411 views

Encrypting user data using password and forgot my password

I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database. ...
1
vote
1answer
47 views

Safely transfer UserID among different Subdomains

Scenario : Application a.mydomain.com redirects its users to application b.mydomain.com for Account Creation. b.mydomain.com creates the account, and redirects the user back to a.mydomain.com with ...
8
votes
3answers
323 views

AES using derived keys / IVs. Does it introduce a weakness?

I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application. Obviously in order to re-use this key, a unique ...
3
votes
2answers
152 views

Secure login across two web apps

I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1. APP2 needs to know an ID of the user who is ...
3
votes
4answers
120 views

Strong authentication over insecure links

Let's begin by assuming that we're operating in either a corporate or Governmental environment where SSL man-in-the-middle interceptions are a given and that *all* traffic on the network between the ...
0
votes
2answers
90 views

Trusted device web application

I would like to build a web application which has a trusted device feature. What is required to store for recognizing the machine securely? Can I safely store an encryption key (private) on the ...
2
votes
1answer
100 views

How to ensure web application remains secured after intrusion of server

My application employs asymmetric encryption / decryption, the process of how this work is detailed below: Encryption - Server A Data is encrypted using the public key of server B Data is signed ...
2
votes
3answers
383 views

Password Vault - Enterprise

I want to be clear from the get-go that I am NOT looking for a user password management solution. My organization already uses AD for that. What I am looking for is a password vault. Up until now, ...
4
votes
3answers
179 views

How to store chat conversations on my website?

I am making a site where members are able to have one-to-one chats, and I'm not sure how should I process conversation texts. Should I store the text in a .txt file or directly in a database? I also ...
1
vote
1answer
396 views

Vulnerabilities in Host Proof Hosting

I've recently been doing some research on Host-Proof Hosting, specifically in a web app environment. It seems like a pretty rock solid method of security, but I'm certainly not a security expert and ...
3
votes
2answers
2k views

Better techniques than url parameter encryption

I'm a programmer working on an application where the only choice/vs/deadline was to implement symmetric encryption on url parameter values. The data is insensitive in nature, but we needed to prevent ...
3
votes
1answer
106 views

Is it a bad idea to let the user responsible for his own symmetric key?

I work for a company that provides a web app where we would like to give the user some sort of "digital safe". In this safe, the user can store and download whichever files he wants. The idea is that ...
4
votes
4answers
1k views

Is client side encryption really better than server side?

Web application may encrypt all user data at client side to convince users that it can't decrypt them. When user enters password, it's used to encrypt data in browser and then it's sent to server in ...
3
votes
1answer
167 views

Is there a way to store user files without being able to decrypt them?

I'd want to build a secure file storage web application. Currently ordinary password authentication is used for login. After login this password is used for encryption and decryption of user files at ...
2
votes
2answers
112 views

Security of asymmetrical decrypting proxy

I'm thinking about the safest possible way to store secure data (eg. Credit Card numbers) with a requirement of sending them in clear text to third party API (so hashing doesn't come into play). I've ...
1
vote
3answers
3k views

What does these warnings mean on an SSL connection by firefox (only)

I am connecting to a secure site and firefox mentions about identity: Owner: This website does not supply ownership information Verified by: Not specified Technical Details: Connection ...
2
votes
1answer
207 views

Is SSL session based only? Is there a (formal) definition of an SSL connection?

In various docs on SSL there is a mention of connection. But from the context I am not sure if this means the underlying TCP connection or the SSL connection. I am thinking that there is no SSL ...
5
votes
2answers
604 views

Considering that SRP is better than SSH and Basic Auth, how can it be implemented in a website?

SRP is short for Secure Remote Password protocol, and provides a better way for passwords to be sent over the internet. I've read the information at it's Stanford University home page, the Wiki ...
2
votes
1answer
427 views

How to use DPAPI under load balance environment

DPAPI can be used to encrypt the secret data. We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on ...
6
votes
2answers
305 views

With Google's new Privacy Policies going into effect soon, how can I better protect myself using their services?

From what I can tell, the gist of the new Privacy Policy from Google is that they're making a blanket policy to allow using your data between all their services, however they see fit. So now one ...
3
votes
1answer
240 views

Security for a low latency online multiplayer game

I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
10
votes
1answer
4k views

What key exchange mechanism should be used in TLS?

There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
7
votes
4answers
996 views

Is using HMAC to transmit a password OK?

I'm writing a small webapp and I don't want to transmit login passwords as cleartext. As I don't have SSL available I've written a one-time challenge system which sends a random string with the login ...
3
votes
1answer
376 views

Is this security/encryption scheme secure?

I'm rolling my own, personal threetags.com-style 'encrypted data in the cloud' webapp (I didn't like the UI, and lack of non-browser client). However, I have absolutely no experience with security ...
19
votes
2answers
3k views

Web Application encryption key management

In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions: ...
3
votes
3answers
107 views

Encrypting a fixed format message with commands and transmitting over the internet

Linked to: Encrypting a fixed format message? I need to communicate from Site A, a set of information that will be presented to users of Site A, which when they choose to submit, should travel to my ...
4
votes
3answers
385 views

It is safe to buy a domain if I get this message in Firefox?

Greetings, I want to buy a domain name from a big registar(well known on the internet) but when I go to checkout I see that my link is going from full encrypted to “Connection Partially Encrypted” ...
3
votes
2answers
157 views

Encrypting a fixed format message?

I'm planning to send across TWO pieces of information over the internet from machine A A site identifier which will be like: $SiteName = "EXAMPLE" (in plaintext) Encoded text which will be like: ...
1
vote
2answers
785 views

Thoughts on Tiny Encryption Algorithm (TEA, anyone)?

I'm planning to implement Tiny Encryption Algorithm and exchange data between two PHP sites. Specifically, using the code presented at PHP-einfach.de Does anyone have any experiences / thoughts / ...
7
votes
3answers
178 views

Securing an E-commerce site

I'm building a custom e-commerce site, and the user will input their credit card details on the site instead of being directed to the payment gateway's site. I'm confused as to what the critical ...
2
votes
2answers
439 views

Encrypting a Database's Primary Key when sent to the browser

When dealing with either an oData-based application (ADO.NET Data Services), or something that otherwise publishes the PrimaryKey, or ForeignKey to the client... Can someone explain to me be benefits ...
8
votes
3answers
407 views

Database Encryption Security

I am encrypting and decrypting my database data from my web applications API. If my web server is compromised, what is to keep someone from using that same method to retrieve the data? For example, ...