Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
130
votes
9answers
8k views
How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
72
votes
3answers
44k views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
70
votes
21answers
16k views
Lessons learned and misconceptions regarding encryption and cryptology
Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
61
votes
11answers
8k views
Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
Why can't a password hash be reverse engineered?
I've looked into this ages ago and have read lots on it, but I can't find the explanation of why it can't be done. An example will make it easier to ...
41
votes
5answers
5k views
Is sending password to user email secure?
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should i use encryption?
41
votes
16answers
2k views
Can we still provide confidentiality when cryptography is outlawed?
In certain jurisdictions, use of cryptography by the private sector is limited: e.g. there are reports that in the UAE and other countries not all of the encryption capabilities of the BlackBerry are ...
41
votes
1answer
5k views
What is the difference between https://google.com and https://encrypted.google.com?
Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)?
In terms of security what were the ...
37
votes
7answers
3k views
Online backup : how could encryption and de-duplication be compatible?
A "soon to enter beta" online backup service, Bitcasa, claims to have both de-duplication (you don't backup something already in the cloud) and client side encryption.
...
27
votes
5answers
4k views
How hard is it to intercept SMS (two-factor authentication)?
A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
26
votes
7answers
5k views
Are powerline ethernet adapters inherently secure?
I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
26
votes
1answer
5k views
iOS Encryption Details
Following on from this question Does anyone have any details/resources on the technical specifics of how apple implement encryption on their iOS 4.x series devices?
The Apple marketing material here, ...
25
votes
8answers
46k views
How to determine what type of encoding/encryption has been used?
I've looked on this site and on SE. but i couldn't get a handle on this.
Is there a way to find what type of encryption/encoding is being used?
For example, I am testing a web application which ...
23
votes
9answers
1k views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
23
votes
2answers
969 views
What is the attack tree to intercept traffic on Wimax?
My current understanding is that sniffing traffic on 4G (lets use Wimax and LTE for the purposes of this question) and 3G is not a simple matter and either requires you setting up a fake base station ...
22
votes
4answers
3k views
Why AES is not used for secure hashing, instead of SHA-x?
As far as I understand, AES is believed to be extremely secure. (I have read somewhere that it would certainly not be broken in the next 20 years, but I am still not sure if the author was serious.)
...
21
votes
5answers
1k views
Do spaces in a passphrase really add any more security/entropy?
I often see passphrase suggestions written as a sentence, with spaces. In that format are they more susceptible to a dictionary attack because each word is on it's own as opposed to a large unbroken ...
20
votes
8answers
2k views
Software that encrypts the data before deleting it
I am searching for a software that would encrypt data and then delete it (as opposed to just deleting or wiping).
With that, even if the file is recovered, you still have to break the encryption to ...
20
votes
2answers
1k views
Does versioning an encrypted file make it less secure?
Suppose I use KeePassX as a password manager, and I store the kdb file in Sparkleshare folder as a way for backing up and syncing with multiple devices.
The kdb file in itself would be encrypted, but ...
19
votes
5answers
980 views
Is it alright to tell everyone your encryption information?
I have an account in an online banking system and they have the FAQ with something like this:
How secure is the <Online Banking System Name>?
Each page you view and any information ...
19
votes
6answers
788 views
Backing up sensitive data - pitfalls and best practices
Obviously, securely backing up sensitive data is a challenge. A remote backup is important for surviving a variety of disasters. What are some of the "gotcha's" lurking out there, and what best ...
19
votes
3answers
811 views
Am I wrong to believe that passwords should never be recoverable (one way hash)?
I recently forgot my password for our cable provider online account, only to discover that they sent it to us via plain text in an email. I quickly sent an email to customer support asking them if ...
19
votes
2answers
3k views
Web Application encryption key management
In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions:
...
18
votes
3answers
8k views
What steps do Gmail, Yahoo! Mail, and Hotmail take to prevent eavesdropping on email?
I would like to ask what happens when an email is sent from gmail, yahoo or hotmail public web email services?
I don't understand email protocols in details, but as far as I know email traffic is ...
18
votes
6answers
893 views
What are the good use cases for disk encryption?
I've been researching disk/file system encryption, and on the surface it seems like a good idea for a lot of things. But as I dig further, the security it offers seems more mirage like than real.
...
18
votes
3answers
1k views
What are best practices to adhering to HIPAA encryption requirements?
As HIPAA's language is somewhat vague when it comes to actual technical requirements, what are best practices for PHI encryption for HIPAA compliance?
I've seen varying levels at different ...
18
votes
6answers
797 views
How to secure a WiFi network?
What do I have to do to secure a WiFi network? Is there any best practices?
I have been recommended to use WPA2 encryption on the router, is that enough? What can I do to improve the security even ...
18
votes
3answers
3k views
Why should one not use the same asymmetric key for encryption as they do for signing?
In an answer to a question about RSA and PGP, PulpSpy noted this:
It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for ...
18
votes
4answers
2k views
How secure are my passwords in the hands of Firefox using a Master Password?
I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
17
votes
2answers
1k views
Strength of WEP, WPA and WPA 2 PSK
I know there are three method for wifi security. What are the relative strengths of the password encryption in WEP, WPA and WPA2 PSK?
17
votes
9answers
3k views
Do secure phone lines exist?
I could be out of context here about security, but , I would like to know if phone lines or phone calls over VOIP could be made secure .
I know that Skype and other VOIP service providers have to ...
17
votes
5answers
17k views
Advantages and disadvantages of Stream versus Block Ciphers
Encryption algorithms such as Blowfish,AES,RC4,DES and Seal are implemented in one of two categories of ciphers. What are the advantages/disadvantages to the type of ciphers?
16
votes
3answers
978 views
Is there any advantage to splitting a password?
I've been reading about the LANMAN (LM) hash and I'm curious about a particular part of the algorithm.
The LM hash is computed as follows:
The user’s ASCII password is converted to uppercase.
...
16
votes
2answers
12k views
How to estimate the time needed to crack RSA encryption?
How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
16
votes
4answers
4k views
How does PGP differ from S/MIME?
Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
16
votes
5answers
9k views
Why most people use 256 bit encryption instead of 128 bit?
Isn't 128 bit security enough for most practical applications?
15
votes
6answers
634 views
Principle of asymmetric algorithm in plain english
I was giving a presentation to my colleagues about cryptography basics in which I explained about asymmetric algorithm and its use. One of the common question from the audience about asymmetric ...
15
votes
2answers
494 views
Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?
For example, say the following are HTTPS URLs to two websites by one IP over 5 mins:
"A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2".
Would monitoring of packets reveal:
nothing,
reveal only ...
15
votes
6answers
828 views
Why isn't open WiFi encrypted?
As far as I understand, WiFi networks that require no password send traffic through the air unencrypted. Those that require a password encrypt each connection uniquely, even if they're all using the ...
15
votes
3answers
2k views
How would you store a 4 digit pin code securely in the database?
I'm familiar with password hashing, using salts, bcrypt etc.
But it doesn't seem like this would work to store a 4 digit pin code since the attacker could try all 10,000 combinations quite quickly. ...
15
votes
2answers
340 views
Homomorphic encryption used for e-voting?
I was reading wikipedia about homomorphic encryptions, and one part got me a bit confused:
"The homomorphic property of various cryptosystems can be used to
create secure voting systems, ..."
...
15
votes
2answers
2k views
Standards for encrypting passwords in configuration files?
My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they ...
14
votes
5answers
7k views
Should RSA public exponent be only in {3, 5, 17, 257 or 65537} due to security considerations?
In my project I'm using the value of public exponent of 4451h. I thought it's safe and ok until I started to use one commercial RSA encryption library. If I use this exponent with this library, it ...
14
votes
2answers
8k views
How can I check that my cookies are only sent over encrypted https and not http?
I read a blog post GitHub moves to SSL, but remains Firesheepable that claimed that cookies can be sent unencrypted over http even if the site is only using https. They write that a cookie should be ...
14
votes
2answers
1k views
Is “real salt” the same as “initialization vectors”?
In the question about real vs. fake salt, the answers describe how real salt 'perturbs the encryption algorithm.' I know roughly how initialization vectors work; is this the same concept, or something ...
13
votes
4answers
1k views
In what ways does Full or Partial Homomorphic Encryption benefit the cloud?
Can someone explain, in plain English, the practical ways FHE and PHE can be leveraged in the cloud? Some interesting (and confusing) links include this Microsoft Research PDF and this wiki entry.
...
13
votes
5answers
1k views
The aescrypt implementation hashes a password 8192 times to generate the key. Is this necessary?
I'm considering encrypting some small files (hundreds of kb apiece) using the aescrypt reference implementation. Looking at the source, it seems that the encryption key is derived from the IV and the ...
13
votes
7answers
773 views
Why Say IP Addresses Are Harmless?
Whenever I see someone on the internet ask the question, "Can someone find out my IP Address from my tweets/my tumblr/facebook posts/whatever else", the response I always see is, "Who cares! An IP ...
13
votes
6answers
442 views
Primary Key as Salt?
Is it okay to use the primary key as the salt in a Users table?
The only disadvantage that I can see is if the PK changes (unlikely), then the passwords break.
What are your thoughts?
13
votes
4answers
694 views
IPsec (Internet Protocol Security) facts
Internet Protocol Security (IPsec) is a successor of the ISO standard Network Layer Security Protocol (NLSP). What are the advantages, disadvantages, other interesting facts regarding the protocol?
13
votes
2answers
2k views
How does a crypter for bypass antivirus detection work?
I am talking about crypters used to encrypt files like viruses and keyloggers for the sole purpose of bypassing antivirus detection. How do they work?
