Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

0
votes
0answers
96 views

SSL is cracked. What is the alternative? [duplicate]

According to Der Spiegel: SSL should be cracked Exactly how much the two intelligence agencies can actually read along from the encrypted traffic in the network, is not entirely clear. But ...
5
votes
1answer
521 views

Properly implemented strong crypto systems [closed]

I have read this article about the revelation that in 2010 major encryption mechanisms including big four (hotmail, facebook, google, yahoo) and other encryption mechanisms were broken by NSA and GCHQ....
9
votes
2answers
589 views

If we can no longer trust NIST, what are viable alternatives? [closed]

Regarding the Guardian article about NSA control over encryption, there was this gem deep inside: Independent security experts have long suspected that the NSA has been introducing weaknesses into ...
26
votes
2answers
46k views

Is it possible to decrypt a satellite TV signal without using a smart card?

And if it is possible, why has it been decided to keep using a smart card for this task? I will be grateful if you can provide some practical examples on how to bypass the use of a smart card (if ...
14
votes
3answers
8k views

Best practices on securely storing access tokens

What would be the best practices for storing access tokens of another api for your users? In particular I'm developing an application with some friends that let's user log into Facebook to both ...
8
votes
3answers
942 views

How do poor-quality initialization vectors affect the security of CBC mode?

(If the consensus is that this question belongs on crypto, rather than here, please feel free to [tell me to] migrate it.) From what I have read (looking specifically at AES in Cipher Block Chaining ...
-1
votes
1answer
3k views

Is Opera spying on its users when traffic conpression is enabled?

Correct me if I misunderstand the following quoted paragraphs, but basically to compress something it must be decrypted first. This seems to be the claim of the article but I don't see this as true. ...
8
votes
2answers
682 views

Ideal way to store unhashed passwords

I'm dealing with a 3rd party vendor that clearly does not understand security - to access their API from my back-end I have to supply the end user's ID/user/password for the 3rd party service with ...
3
votes
2answers
1k views

How to store an encryption key on shared hosting?

I am designing a simple online patient management system that is running on shared hosting. According to national regulation sensitive data should be encrypted when used online, so I have encrypted ...
1
vote
1answer
478 views

Reason for using Asymmetric encryption along with SHA256

I got a document with integration with another application. They mentioned I need to hash and then encrypt data with my private key before sending it over HTTPS. By doing this, they are making sure ...
0
votes
3answers
210 views

Devising encryption schemes and protocols

I am wondering how encryption schemes are developed and why certain decisions are made. For example. I have seen a company hash a string with SHA1 and then RSA encrypt it. Why? I've also seen the ...
1
vote
1answer
456 views

How can I implement DVD copy protection?

I want to make a DVD movie which will be playable on a standard DVD player, but I want to make it copy restricted. I know it is practically impossible, but I just want security to protect it from ...
3
votes
2answers
344 views

Multiple encrypted messages known to have matching (unknown) content

A recent discussion regarding ways to keep data secure through multiple iterations of a program's execution (with repeated read/write operations) raised a question regarding known-plaintext attacks ...
-1
votes
1answer
247 views

Credential (et al) storage on Android - And general application credential storage inquiry [closed]

Please read before assuming this should go in another forum (like an android forum) - this is a Security question. Here is the scenario: Developing an health care based android application that has ...
5
votes
2answers
1k views

Are there any dangers in exposing git sha1 commit hashes?

For a non-public repository, are there any potential security concerns in sharing git commit hashes? For example, when I post a git-related stackoverflow question that involves git commits from ...
2
votes
3answers
114 views

Temp file deletion / encryption

I'm working on an .net app within aws. Basically our app pulls "generic" data from another organization for the purpose of building customized reports. The data is sent to us via ssl/tls and sent back ...
5
votes
2answers
862 views

How to implement client side encryption for CalDav & CardDav content?

I'm looking for a client-side encryption implementation that would be able to secure CardDav & CalDav data so that they couldn't be compromised even by the hosting provider. Server side: PHP or ...
3
votes
1answer
266 views

How signature validation would be checked on server side?

Sorry, It may be possible that few things are repeated in my question. I have gone through some documentation/discussion signing an API request and twitter signature documentation As per the ...
3
votes
1answer
756 views

Store hash password and encrypted data with this password in db?

I'm currently developping a django application. I need to store user data. This data must be unavailable to any other user or admin I've created a dedicated user account system (no using dj auth). (...
4
votes
1answer
1k views

What's a trustworthy S/MIME Certificate Provider that generates my private key in my browser?

I read this question on the process of generating a private S/Mime key. I looked at Comodo - which offer free e-mail certificates. I'm trying to find out whether Comodo generates the private ...
7
votes
2answers
2k views

ECC based Client Certificate import in Chrome/Mozilla in windows

I have deployed a PKI server and successfully able to generate the ECC based user or client certificates. but non of the web browser support ECC as public key. I have tried different tools and also ...
4
votes
2answers
819 views

NaCl: US Export Regulations

I'm in charge of a product security in our US based startup and I plan to use NaCl for encryption (well, Sodium, actually). I'm trying to navigate the labyrinth of US export regualtions - something I ...
7
votes
2answers
2k views

How is OTR messaging with Socialist Millionaire Protocol (SMP) protected from Man In The Middle?

So imagine the next situation: Alice wants to initiate OTR instant messaging session with Bob but Joe is Man In The Middle. Alice negotiates a shared secret 'X' with Joe (thinking he is Bob) using ...
0
votes
2answers
147 views

pgp decryption on public pc

When I want to decrypt mails on a public PC (café), encrypted with GPG, in e.g. gmail with the extension "Mailvelope" or equal - how would that be possible? I found tools to run from an USB stick ...
4
votes
2answers
2k views

What are the security implications of the POLi Internet Payments technique?

POLi Payments is an Australian based online payment provider which has begun trading in New Zealand. They are supported as a payment option on some large eCommerce websites in New Zealand, including ...
10
votes
7answers
8k views

Who tells that TrueCrypt is secure?

Assuming you're not running on a compromised machine and you're following common recommendations (long random passwords, etc.), who specifically (name and affiliation) asserts that TrueCrypt is secure?...
4
votes
2answers
8k views

How do you bruteforce decrypt data if you don't know what you are looking for?

If I wanted to brute-force decrypt data, I would try decrypting it with a key and see if the decryption returned nonsense. If the decryption returned meaningful data (ex. something that a natural ...
1
vote
1answer
770 views

How long would it take to brute force the AES encryption?

I'm trying to write a secure code that can keep my site users passwords as safe as possible. Now I'm fairly new to encryption and would like some professional opinions and suggestions. As well as a ...
0
votes
2answers
888 views

Using a Common Private Key for Digital Signatures

I have a mobile application and a server. The mobile application communicates with the server through a web services framework via SSL. The mobile application allows customers to pay for ...
0
votes
1answer
491 views

Is it safe not to encrypt ping packets?

I am running encrypted communication with ping tacked on after decryption and deserialization is complete. I.e. incoming data -> split into packets -> decrypt -> deserializer -> actual message or ...
1
vote
1answer
1k views

Is the connection between Gmail server and Apple server encrypted? [duplicate]

When I send an email from my gmail account to another mail server (apple, microsoft, yahoo...), is the connection encrypted in the path between the two servers?
5
votes
1answer
644 views

GnuPG/KGpg Sign PGP Key - Sign User ID : What is the difference?

What is the difference between signing a user ID and a whole Key ? Which behavior is the best as to signing user IDs and Keys ? How and when to use "Local signatures" (non exportable) ? (I was told ...
1
vote
1answer
805 views

Is server-side cryptography with user-only access possible for email services?

I came across the Lavabit High Scalability Writeup and got curious. Do you use any particularly cool technologies or algorithms? The way we encrypt messages before storing them is relatively ...
7
votes
3answers
642 views

Is it possible to determine if some given data is not encrypted?

Let's say I'm running a BitMessage node. One possible attack against me would be to upload illegal content to my node, and once someone knows it's there, to tip off the authorities, who would then ...
3
votes
2answers
393 views

Is splitting up an AES Key a problem?

I'm wondering if it would be a problem to split up a 256 bit AES-Key into two 16-Byte blocks and distribute it, to implement some kind of a four-eyes-principle (you need two persons to decrypt a ...
5
votes
2answers
1k views

What risks are there with a Bluetooth based door lock, and are there any mitigations?

There are a few interesting Bluetooth door locks on the market that use version Bluetooth 4.0 however there seems to be a few issues with this E0 Encryption flaws Risks during pairing Attacks ...
6
votes
1answer
15k views

What needs to be encrypted for FIPS 140-2 compliance?

We're developing a Client/Server C# .NET application that needs to be FIPS compliant.Im reading a lot about FIPS online, but am having a bit of difficulty determining the difference between the ...
14
votes
10answers
37k views

Is Windows BitLocker secure?

Naturally I feel that I have to ask this question, since it's a built-in feature in Windows. Let's say someone has physical access to my PC, is there an easy way for them to access a BitLocker ...
0
votes
2answers
980 views

Is there a way to configure WPA2-PSK to provide Forward Secrecy?

Is there a way to secure an wireless connection against a decryption attack where the PSK is known (E.G. Airdecap-NG)? Is it possible to configure Forward Secrecy on 802.11 Wireless Connections?
0
votes
1answer
112 views

Why oauth use a secret with temporal credentials?

I am trying to understand oauth protocol. I am currently looking at temporal credentials section of the oauth 1.0 sepecification. I can't understand why the secret is needed along with the temporal ...
4
votes
8answers
3k views

Secure alternative to e-mail

After the announce that NSA conducts extensive metadata and traffic search on e-mail, it is clear that people looking for privacy and security would better abandon the system completely, since, by ...
1
vote
0answers
1k views

Decrypt “key” that is encrypted with LMK or TMK

New to HSM (Thales payshield 9000), I'm working on DUKPT algorithm. I manage to derive the IPEK(encrypted either under LMK or TMK), but I need to inject a plain text IPEK into an end point device. I ...
0
votes
2answers
260 views

A thought experiment about obfuscating the location of a smartphone when it is in use, is it possible? [closed]

I was thinking about how smartphones are very difficult to use in a way that does not transmit your location, with all the networks it has to connect to (and let's say a 'burner phone' is too ...
6
votes
3answers
22k views

Full Disk Encryption with GPT disk support

On my old computer I used Truecrypt full disk encryption. My old computer however was running Windows 7 with a standard MBR partition scheme. I recently got a new laptop with the fancy UEFI support. ...
2
votes
3answers
1k views

wpa2-psk + wireless isolation = secure connection?

from what I've read: If I am on a wireless network without encryption, any other computer connected to that same network could easily (with right tools & knowledge) intercept any traffic I send/...
0
votes
1answer
109 views

Does adding an extra, non-entropic keyfile lower security? [duplicate]

Suppose I create two TrueCrypt volumes using keyfiles. The first volume uses a keyfile generated by TrueCrypt, whereas the second one uses the same keyfile in addition to a second, non-entropic ...
5
votes
2answers
253 views

Does adding a non-entropic part to a password makes it less secure?

Suppose I'm encrypting a file via AES using a password of my choice, or creating a TrueCrypt volume using a password and no keyfiles. Which of the following two passwords would be more secure: ...
1
vote
3answers
2k views

Implementing 'Remember Me' for a mobile application

I am developing a mobile application wherein I need to implement the 'Remember Me' functionality. There are certain pages within the application which require you to login. What I need to do is, if ...
2
votes
2answers
434 views

Pre / post disk encryption wipe?

When dealing with full disk encryption a lot of utilities I've worked with will provide the option to fill the disk with random data to make distinguishing the encrypted contents harder to identify. ...
0
votes
4answers
1k views

How could I totally secure a connection between two nodes?

I'm building an authentication server in python, and was wondering about how I could secure a connection totally between two peers totally? I cannot see how in any way a malicious user wouldn't be ...