Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

82
votes
15answers
17k views

Why would someone “double encrypt”?

If I have a website or mobile app, that speaks to the server through a secured SSL/TLS connection (i.e. HTTPS), and also encrypt the messages sent and received in-between user and server on top of the ...
1
vote
0answers
27 views

Finding the key of encrypted string (given known decrypted message) [duplicate]

I have a bunch of messages where I can run the encrypted message against a validation services, and get a response that the encrypted message is valid as well as the contents of the encrypted message. ...
6
votes
2answers
362 views

Am I weakening symmetric OpenPGP encryption by deploying a custom pre-derivation?

I often use GnuPG to encrypt files with a passphrase. I'm very paranoid, and afraid that the key derivation used by GnuPG isn't slow enough. For this reason, I've decided to do my own key derivation ...
3
votes
1answer
50 views

How to prevent data from Interception?

I am a web developer. A few days ago, I used Burp, to intercept facebook's official App over network, by setting up proxy. I noticed that the data was encrypted. While I have been using Json to ...
-6
votes
6answers
184 views

Relative merits and risks of encryption and OS security [closed]

There are many aspects to computer security and many threats to address: poisoned DNS, worms, trojans, viruses, rootkits, firmware malware, etc. One of the biggest software vulnerabilities is buffer ...
3
votes
2answers
43 views

Specifying my key name while encrypting file to some receiver using GnuPG

I would like to make sure of one thing. When I am encrypting file, the only needed key to specify is --recipient, because I only need to specify key to encrypt (receiver key)? I don't need to specify ...
35
votes
6answers
3k views

Is C a good choice for security-related software any longer? [closed]

C is a rock-solid and widespread programming language that is very popular especially in the FOSS community. Many security-related software (such as encryption libraries) are written in C and will ...
1
vote
1answer
44 views

Location/proximity based decryption using separate machine

I read a long thread where the whole issue was revolving around deriving decryption keys from GPS location. This has huge issues, as being present at a location is not needed to know the location. ...
-4
votes
2answers
48 views

How and what is used when information is sent to a hacker's server? [closed]

I'm working in some malware research, my main question is how the victim's data is transfered over the internet, protocol and how? Using HTTP or any other way? As fat as I know the data can be sent ...
1
vote
0answers
58 views

Encrypted Malicious Traffic Database

I was working on a little research project to correctly identify the encrypted traffic pattern generated by various tools/applications for example metasploit (or increase the success rate). I have ...
3
votes
1answer
101 views

Putty settings - Protocols and Algorithms to warn about

I specify "Putty" as otherwise I feel the question would be too broad. What are the algorithm (as of March 2016) that one needs to be warned about (ie, those that no longer are considered safe ...
5
votes
2answers
154 views

Is AES 128 encryption weak for very small payload size?

If I have a payload of e.g. 8 bits and I want to encrypt it using AES 128, I will need to add some random padding to make the plaintext 128 bits long. Does this padding affect the security of AES?
0
votes
1answer
69 views

Checking a salted hash against known password?

I've created a mysql dump of my users and passwords and awked them into a presentable form: Passwords: ...
2
votes
1answer
72 views

Cisco Registered Envelope Service (CRES), big security flaw?

While researching so called HIPAA compliant email providers, I came across Cisco Registered Envelope Service(CRES), which claims to be HIPAA compliant. According to this instruction, upon receiving ...
0
votes
0answers
80 views

How to decrypt a microSD card after a factory reset of the device used to encrypt it?

Two month ago, I encrypted my Micro SD card in my Android device (Samsung Galaxy S5) for security purposes, and yesterday I forgot to decrypt it whilst removing the card I and factory resetting the ...
0
votes
2answers
86 views

How to have client encryption without server encryption key

I want to build a service where people can message each other via their mobile device so that they encrypt all of their information on their device and not on my server. Basically I want to two people ...
26
votes
3answers
4k views

Use multiple computers for faster brute force [duplicate]

I've watched Mr. Robot lately and can't stop thinking why it was so hard to decrypt files encrypted using AES encryption with a 256-bit key. Let us say the only method to find the key is through brute ...
5
votes
2answers
530 views

Can you encrypt data using BCRYPT?

Somebody else posted a question about ghostmail (https://www.ghostmail.com/crypto) and whether it looks valid. One of the things that triggered alarm bells for me was the sentence "Account Password ...
0
votes
2answers
49 views

Secure way for bulk mailbox verification to avoid IP Blacklisting

We have built an API that verifies a address existence in the respective MX using RCTP command. Their are many services available out there but we like to do it again since we have few clients who ...
0
votes
1answer
94 views

Momentarily unencrypted Payment cards

Momentarily unencrypted Payment cards I read about the cyber-attacks related to the momentarily unencrypted payment processing data at the point of sales devices. Technically, how is it possible? ...
4
votes
1answer
216 views

decrypt a string with a password, but unknown method

I want to run through multiple algorithms against an encrypted string. I have the password and the encrypted string but not the method it was encrypted under? what would be the best method to find ...
6
votes
1answer
248 views

John McAfee's Explanation of iOS Hack

I'm referring to this YouTube video, and further comment from John: I hope everyone knows that the Apple explanation was VASTLY dumbed down for the press. I know the A7 system chip well, ...
-4
votes
1answer
111 views

How is it technically possible for Apple to unlock the San Bernardino shooter's iPhone? [duplicate]

If the iPhone of the San Bernadino shooters is locked, how would it even be possible for Apple to acquiesce to the FBI's request for them to unlock the phone? Does that mean Apple has some kind of ...
5
votes
3answers
218 views

How can I prove that my software is secure for those who are interested to install it?

I've written a password locker program for Microsoft Windows that encrypts its contents to the local machine. The only way to get the data out is with the encryption key the user knows. It uses the ...
3
votes
1answer
190 views

Is this encrypted information? Why is it in a URL?

There's a vendor who sends us reports full of links to articles. Some of these links, especially ones that perform what I'm guessing is an HTTP verb of some kind, look like this: ...
1
vote
4answers
188 views

How to know if accessing to a VPN service is safe and won't steal my data

I want to know if a VPN service is safe or not. If the VPN server itself can catch or sneak peek my data? Or as long as it is a VPN service, then the security is protected by the algorithm itself? ...
28
votes
1answer
1k views

What does this say? It's in MD5 [closed]

Some one sent this to me and I have tried to figure it ouut on my own. But have not been successful. Can you help figure out this, he said it was in MD5... 1ce67f05968d51656eb71f13368f0b2d
3
votes
1answer
86 views

VPN Authentication and Network Administrators

Is it possible for a network admin (or attacker) to monitor traffic sent to a VPN server during authentication and end up being able to decrypt the data as if they were the legitimate user? I don't ...
-2
votes
1answer
150 views

Decrypt or prevent Teslacrypt [closed]

Has anyone come up with a method to prevent receiving Teslacrypt or a method to decrypt encrypted files? Is there a way to prevent encryption on network attached storage? Is email the main avenue ...
5
votes
3answers
330 views

1Password for team how secure it is?

I would like to ask you opinion about how secure is the 1Passowrd for Teams. For someone who doesn't know how 1Password - Personal use - works here a summary: You create a master password (hard to ...
-2
votes
2answers
56 views

Is there a reason to salt instead of enxrypting data? [duplicate]

Is it more secure to: a) Take a password, salt it, then hash it. b) Take a password, hash it, then encrypt it(Using a symmetric algorithm with a large key)
1
vote
1answer
69 views

How easily could this method of cryptography be cracked? [closed]

Background A couple of years back, in my naivety I dreamt up a method of encrypting information, the result can be seen on my website, I evidentially thought it was pretty neat and I decided to mix ...
1
vote
3answers
125 views

Authenticating user in same sub-domain using cookies

We have few in production websites say site1.dom1.com , site2.dom1.com , site3.dom1.com which are just replicas working on different server. Now we want to extend some application on another server ...
0
votes
1answer
72 views

FileVault 2 FDE and BoxCryptor are safe to use together or they have conficts?

Assuming that someone has a Mac and uses FileVault 2 FDE (256-bit AES key) and uses the BoxCryptor (256-bit AES key) for the clouds like Dropbox/GDrive/etc and or some other folders. FileVault 2 uses ...
3
votes
2answers
184 views

How to secure JSON data that is shown on web service page?

I have an iOS app that uses a web service to get data from my server. It grabs the data and echoes a JSON feed to the web page, and the iOS app interprets it. I have SSL so I am not worried about the ...
1
vote
3answers
167 views

Are longer passwords safer even if the encryption/database security used is compromised?

Let me preface this that I am having a lot of trouble wording my question. Hopefully my description will help clarify. I have always wondered if long passwords actually provide you any more security ...
45
votes
4answers
4k views

Is this a self rolled hashing/obfuscation method? Can you recognize the pattern?

A system we're introducing into the organization is not using any traditional hashing function that I can find. I've been assigned to "approve" it by black-box testing. I suspect passwords are simply ...
4
votes
2answers
161 views

How can Apple claim that a backup of an iPhone made to iCloud is “hackable”/accessible but not the data on the device itself?

So I’ve been reading up on the 2015 San Bernardino attack and the legal/tech issues surrounding the FBI’s request that Apple unlocks the shooter’s phone. This is how I understand the issue: The FBI ...
2
votes
1answer
51 views

Does FTPs (FTP over SSL using explicit TLS) support encryption of data channel?

I am exploring the ability of the FTPs(FTP over SSL using explicit TLS) to encrypt the data channel. I read online that the secure data channel can be entered by entering the PROT command. PROT P for ...
3
votes
4answers
143 views

TLS and e-mail security

Our client has asked us to send sensitive data via TLS and to install a certificate on our mail servers so that they can verify the authenticity of our e-mails. If I understand correctly, TLS ...
1
vote
2answers
57 views

Is an Initialization Vector (IV) required with unique data?

When used to encrypt data that is unique, is an Initialization Vector (IV) still required? For example, Credit Card numbers or Social Security numbers. The ultimate point of an IV is to ensure that ...
0
votes
1answer
184 views

Why IOS on IPhone cannot be brute-forced programatically? [duplicate]

I am interested in the recent Apple case where FBI wants to get access, but they say it's not technically possible other than creating a new OS (or I guess just modifying the existing one). More ...
3
votes
2answers
222 views

Is Apple’s latest encryption considered to be munitions grade?

According to U.S. Export and Import laws, any device that has a minimum level of encryption is considered as falling under munitions type laws. Does Apple’s latest OS contain that level? And if it ...
1
vote
2answers
142 views

Password may not be similiar to last 5 passwords [duplicate]

SAP NetWeaver has a password policy to prevent your new password beeing similiar to the last 5 passwords. Are the passwords stored in plaintext to verify this? Or is something like a soundex value ...
1
vote
1answer
98 views

access to mounted luks partition by non-root user

Recently I searched substitute for truecrypt and played a bit with cryptsetup. The steps I did: mkfs -t ext4 /dev/sdb1 sudo cryptsetup open --type luks /dev/sdb1 enc_vol sudo mount ...
0
votes
0answers
11 views

What integrity does the TLS Record Protocol actually provide?

In TLS the "base" protocol is the "TLS Resource Protocol". This protocol is responsible for: securing application data and verifying its integrity and origin. It also uses a HMAC. However this ...
0
votes
2answers
78 views

Using Two Different Brands of Security Tools To Block Backdoors

There's this idea of using 2 brands of firewalls both inline that is usually brought up: {Internet}<-->FW(A)<-->FW(B)<-->{Internal Network} Or using 2 algorithms: {Plain ...
2
votes
0answers
31 views

GPG Public Key changes after removing master key [closed]

Why does my gpg public key change after removing my master key (leaving just my subkeys) from the gpg key ring? I'm doing this so i can move my daily use keys (subkeys) to my online machine while ...
11
votes
3answers
1k views

Why can't apple simply add the backdoor now and then remove it after the FBI is done?

Summary of the current situation by @TTT Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. ...
-3
votes
1answer
524 views

What is suspected to be on the famous encrypted iPhone? [closed]

Quite a big deal is being made about Apple's refusal to decrypt an iPhone used in a terrorist attack. What is suspected to be on the device? If the crime has already been committed and the dead ...