Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

2
votes
3answers
1k views

Is SSL Tamper Detectable?

I know how SSL provides security against people reading your messages - by encryting the message with a SYMMETRIC KEY, which was exchanged during SSL Handshake with the help of ASYMMETRIC KEYS. But I ...
1
vote
5answers
2k views

making an iPhone/Android app which sends a user password to my server, how to secure?

I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login. I don't have SSL on my website, but it's just a reviews website and ...
1
vote
2answers
2k views

Avast says I don't need to use encrypted connections for my e-mail accounts

I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't ...
0
votes
2answers
691 views

Keeping the password secret over regular http

I would like to at first be clear that this is for poor site owners who can't afford the SSL option but require logins to their site, potentially from a public kiosk, and need a secure method of ...
7
votes
3answers
1k views

Encrypt WiFi connection per connected user

One of the questions that comes on quite often is about WiFi encryption. Now imagine that you have multiple users connecting to one AP. With a simple WPA2 protection setup they can still sniff each ...
5
votes
1answer
498 views

Should password hashes be encrypted or HMACed?

Assume I am hashing user passwords with PBKDF2, bcrypt, scrypt, or some other secure key derivation function. Are there: tangible security benefits, precedents, and respected research for ...
6
votes
1answer
256 views

Could a consumer-friendly PGP-like file encryption application theoretically be secure?

In a situation where there are desktop and mobile clients, and a central public key repository to and from which the desktop and mobile clients automatically upload and download public keys as needed, ...
3
votes
1answer
147 views

How to ensure web application remains secured after intrusion of server

My application employs asymmetric encryption / decryption, the process of how this work is detailed below: Encryption - Server A Data is encrypted using the public key of server B Data is signed ...
2
votes
1answer
10k views

Why it does not matter whether you type HEX or ASCII as WEP WiFi password?

I know that I can pass password in HEX as a keyphrase to WiFi network using WEP encryption as well as ASCII. But somehow you cannot get the ASCII when you only know HEX value. Can anyone explain the ...
11
votes
5answers
3k views

Confusion: Why isn't a passhrase encrypted SSH key two factor auth?

I'm trying to figure out the best practices for accessing my devbox from a public terminal. Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
4
votes
2answers
6k views

Is it safe to store password in PHP session?

I need to do some encryptions in the private zone of my website and I want to bcrypt the user's password. Is it safe to store the password in the session when user does the login, so that I can use ...
4
votes
2answers
527 views

Shibboleth user attribute encryption

How does Shibboleth guarantee that 3rd parties do not get access to user attributes contained in SAML 2.0 assertion exchanged between IdP and SP? Is it correct that all user attributes are encrypted ...
5
votes
3answers
5k views

Secure way to transfer public/secret key to second computer

I created a public/secret key using Seahorse (GNOME managing tool for encryption keys). I haven't had issues encrypting and decrypting files from the computer the keys are located in but I'd like to ...
7
votes
4answers
2k views

Password Vault - Enterprise

I want to be clear from the get-go that I am NOT looking for a user password management solution. My organization already uses AD for that. What I am looking for is a password vault. Up until now, ...
1
vote
1answer
223 views

Is proper documentation on .xef files available anywhere?

WinACE encrypts files (using one of its 8 methods) into a file with the extension .xef. I'd want to see some documentation on this file format but I couldn't find anything... I'm particularly ...
7
votes
3answers
485 views

How secure is HTTPS with weak ciphersuites?

Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
5
votes
3answers
475 views

How to store chat conversations on my website?

I am making a site where members are able to have one-to-one chats, and I'm not sure how should I process conversation texts. Should I store the text in a .txt file or directly in a database? I also ...
4
votes
1answer
183 views

How does my antivirus determine which CTL is used?

I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
74
votes
11answers
19k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well known Certificat Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
2
votes
1answer
3k views

Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]

Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
5
votes
6answers
2k views

Tracking unique web site visits without logging IP addresses

On Monday, some IP address xxx.xxx.xxx.xxx visits my site. I log it. On Tuesday, another IP address yyy.yyy.yyy.yyy visits my site. I log it. If the two IP addresses are equal, I throw out the ...
0
votes
2answers
251 views

How could an AV detect a virus that has a chance of not decrypting itself?

If I understand this correctly there is a chance the virus may not decrypt itself at all. How could an AV catch this? In some cases, the decryptor may start with a header whose intent is not ...
3
votes
1answer
512 views

Are SSL Certificates (Private and Public key) generated by OpenSSL and makecert compatible?

Are RSA SSL Certificates (Private and Public key) generated by makecert compatible with OpenSSL decryption ie. can I decrypt them with the openssl_* methods? I am working on two-way SSL authentication ...
13
votes
7answers
1k views

Has cryptography reached the development level where social engineering is the only reliable method of attack?

Note that for the purpose of this question, "social engineering" means extracting information from humans, be your methods compliant with Geneva Conventions or not. Simply put: Do cryptographic ...
5
votes
2answers
875 views

Encrypting/decrypting information in database

So, let's say I have a secret message I want to encrypt and store in my database, from where an authenticated user can retrieve, decrypt, read, update the message. EDIT: the issue I'm encountering is ...
2
votes
4answers
2k views

CMS Uses http and so sends password in plain text

A well known CMS called Joomla allows users to register and the password appears hidden as you register with dots a normal experience online - at this point you think just you know it. But if the site ...
-1
votes
4answers
148 views

Sensitive information I don't want my work to backup

Can this be done safely? I want to print 2 pdf’s containing personal/banking information from a computer at work. It has CrashPlan Pro running and I don’t want a copy of the files to be made that I ...
4
votes
4answers
803 views

Can public keys be a security risk when performing password-less SSH logins?

Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins. The servers being checked put the public key of ...
1
vote
3answers
268 views

Is purging AES keys allowed legally?

We're developing a service, that encrypt e-mail with AES algorithm. Keys are stored in our server. We thought about having an expiration service, that is deleting the key from our server. This ...
1
vote
2answers
192 views

Protecting passphrases within an application

First off, I'm not very familiar with encryption best-practices. My use-case is simple: I'm creating an application that will be reading encrypted documents and decrypting them dynamically to do some ...
8
votes
3answers
6k views

Is multiple encryption a good idea?

I know that many encryption algorithms, while secure, have vulnerabilities. To reduce risks, would multiple encryption like this Blowfish_CbC ( Rc2_OFB ( AES128_CBC (myfilecontent))) be a good ...
10
votes
2answers
15k views

Do VPNs provide sufficient protection over public wireless networks?

I know that VPNs are the standard way to secure communication between a remote user and their primary network, but I've never felt entirely comfortable relying on them when using an open wireless ...
62
votes
5answers
21k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
1
vote
3answers
350 views

Logic for generating Strong Password?

I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website. Is there any logical suggestion or step function to generate strong ...
0
votes
2answers
528 views

Anonymous proxy over SSL [closed]

Can you name any anonymous proxy software that don't use VPN connections? Basically, I'm analyzing different encrypted traffic and now I need to analyse a simple anonymity proxy traffic. I'm analyzing ...
1
vote
1answer
8k views

Encrypting string in JavaScript and decryption in Java [closed]

I would like to know if there is any library to do encryption in JavaScript and decryption in Java. I have already tried many APIs, but am not getting the same values in Java. I want public-private ...
6
votes
3answers
1k views

Computer decryption algorithms and knowing the solution

This is a general question about using computers to decrypt information. It has puzzled me for a while. The question is really two parts: How does a computer check if a "guessed" key is the correct ...
3
votes
2answers
564 views

Signing data bigger than allowed RSA Block size?

I've enountered a small problem while implementing a modified version of the Station-to-Station protocol (STS). Say we have two principals A and B, where both of them knows the other's public key: ...
2
votes
2answers
10k views

Excel 2007 Encryption Strength

With a strong password of 10+ characters, mixed case, etc... Is the encryption of a Excel 2007 document secure enough to create reasonably strong defense against a brute force attack? What encryption ...
1
vote
4answers
2k views

Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?

I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following ...
9
votes
3answers
6k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
2
votes
3answers
727 views

Please recommend best-practices documents for sharing encrypted data with non-technical end-users

Is there one, or several, "best practices" documents which cover in clear simple language how to share data among a non-technical support staff and non-technical end-users at various organizations? ...
1
vote
1answer
184 views

How dependable can data encryption be without re-entry of password on startup?

I posted a comment awhile back, and thought I would turn it into a question. Example: There is a feature in the Microsoft SQL Server for full database encryption, which seems to have an option that ...
1
vote
1answer
887 views

Testing my network using aircrack-ng not working

I an using Fedora 17 With Intel 5100 card. When I execute the command: [root@fedora user]# aireplay-ng -9 mon0 10:26:46 Trying broadcast probe requests... 10:26:46 Injection is working! 10:26:48 ...
0
votes
1answer
487 views

Should I encrypt data on my server as an extra layer of protection?

I'm going to create a client-server application that stores a user's sensitive financial information on the server. I would like to encrypt this data so that even if a hacker gets access to the ...
2
votes
1answer
845 views

Vulnerabilities in Host Proof Hosting

I've recently been doing some research on Host-Proof Hosting, specifically in a web app environment. It seems like a pretty rock solid method of security, but I'm certainly not a security expert and ...
4
votes
2answers
2k views

How does VPN encryption work?

I've been searching and searching, but I can't seem to find a good-enough technical explanation. From what I've gathered, there are two "things" able to secure VPNs: 1) Pre-Shared Key: This handles ...
1
vote
1answer
1k views

How do I securely store and retrieve a many-time use key?

I am performing some symmetric database encryption/decryption in .net. I am using a single 256 bit private key. (1) Where do I store this key when not in use? (2) How do I securely retrieve this ...
6
votes
2answers
1k views

Does using both GPG encrypted files and encrypted filesystem make sense?

For a few years i stored my personal text files encrypted using an asymmetric key through GnuPG. Now i thought that it is a good idea to also encrypt my hard drive partition. Does it make sense to use ...
11
votes
5answers
3k views

Is it worth the effort to store FTP passwords encrypted?

I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...