Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
2
votes
2answers
205 views
How to secure a truecrypt container allowing access with multiple SSH public keys?
I would like to create a TrueCrypt container which can be accessed by multiple people. The container itself can be stored anywhere, e.g. in a shared folder in Dropbox or Google Drive, ...
I would ...
1
vote
1answer
193 views
Picking an encryption algorithm for auth tokens passed via AJAX
I'm looking for a low CPU intensive encryption algorithm, to pass around session authentication tokens.
As an example:
The user will login in to the website (via OAuth, whether by the site as ...
7
votes
1answer
378 views
How to study the packets sent by a keylogger
One of my friends runescape account got hacked through key-logger. He downloaded a runescape gold generator from a file sharing site and tried to use it.
I have a strong doubt that it is a key-logger. ...
5
votes
3answers
415 views
Encrypting user data using password and forgot my password
I am planning to do a web application which stores a lot of personal stuff (info, photos...). And to give users a sense of protection, I want to encrypt the data before storing it to the database.
...
-1
votes
1answer
44 views
Automated post request [closed]
I'd like to write a script to test my site by means of automated post request to login password inputs. Can I use Brutus software ? Where can I find some script's source code from which to inspire ?
2
votes
1answer
232 views
How to make a secure key distribution scheme/protocol?
We are building a data processing platform on Amazon AWS. We are going to store sensitive data in the S3 (encrypted) and then the Amazon EC2 node is going to be utilized to process this data. We are ...
2
votes
1answer
156 views
How to secure or (Ensuring Integrity) of Web Data in transit and in store?
Consider (usual scenario) You own a Shopping Cart Website and hosted on Internet, now, your hosting company provides you database to store your data.
If talking about security, we need it for:
...
4
votes
3answers
900 views
AES CBC padding when the message length is a multiple of the block size
Assuming that a 32-byte plaintext is encrypted by AES 128 CBC - is it mandatory to add 16-byte padding, according to the different padding schemes?
3
votes
4answers
286 views
Can an attacker reuse stolen SSL private key to recreate that domain on his server
Say my domain (https://example.com) SSL private key has been stolen and was not protected by a passphrase then.
Can the attacker uses that key and certificate to host the same
domain on different ...
0
votes
2answers
149 views
“Premium SSL” vs “Stanard SSL” certificates - Any reason why I would want a “Premium SSL”? [duplicate]
Possible Duplicate:
What are the advantages of EV Certificate?
besides the green URL bar and free security scan and whatnot.
Our website does NOT accept any personal info other than email ...
3
votes
2answers
173 views
What are the differences between ssh generated keys(ssh-keygen) and OpenSSL keys (PEM)and what is more secure for ssh remote login?
I have learned there are 2 methods to make SSH remote login easier and secure , those are;
ssh generated keys (using ssh-keygen)OpenSSH Keys
PEM (.pem) keys usually generated with OpenSSL (Amazon ...
1
vote
2answers
82 views
Which hard disk encryptions schemes are tied to the original hardware?
When using a laptop, an encrypted HD/SSD can be an important security measure. However, laptops are prone to accidents (fluid spills, dropping on the floor, etc) that may mandate some or all of the ...
4
votes
2answers
212 views
How to correctly implement AES in a backup application
I am writing a back-up application which should have the feature of encrypting the back-up. It must encrypt file data, paths and filenames. The application is being written in C# (.NET). Target is ...
4
votes
3answers
212 views
Completely mimimise the possibility of my web hosting account being hacked
I've just moved web hosting providers and I want a fresh, secure start. To a certain extent, I don't mind what I have to do I'm just fed up my account being hacked or infected. I just wondered how to ...
3
votes
3answers
100 views
jasypt message integrity
I've been looking into ways to encrypt an authentication token that I need to pass from one site to another. Things i have learned so far are
use a high level library.
don't use ECB
use a HMAC to ...
1
vote
3answers
115 views
RSS Feeds: restrict access
"We are a bunch of journalists and we share much of the information via e-mails. This has become tedious now. Hence we found out a way to share, by just having to share our private blog posts via ...
5
votes
2answers
1k views
Is it possible to use the aircrack-ng tool to crack a WPA2 Enterprise network?
is this tool (aircrack-ng) capable of cracking into a WPA/WPA2 Enterprise network? This tool has major success cracking the passwords of WEP/WPA networks.
If it can, how, but if not, is there another ...
3
votes
1answer
231 views
How to implement authenticated encryption using pycrypto or a python library?
I'm using pycrypto to encrypt files that will be stored in the cloud. I expect the user to enter a password to decrypt files, but encryption shouldn't require a password (to allow the script to be run ...
1
vote
5answers
307 views
Is SHA-1 encryption?
I have read that SHA-1 is a cryptographic hash function. On an exam, SHA-1 was given as a possible one-way encryption algorithm. Does SHA-1 require a key as input? Is a key required to qualify as ...
2
votes
1answer
532 views
Security of bcrypt/sha256 key used with AES to encrypt a file
I'm looking to encrypt files using secure hashing and encryption algorithms in Python. Having used bcrypt in the past, I decided to use it for my passphrase calculator, then pass the output through ...
1
vote
1answer
86 views
Need advice on Cryptography digital files project
I have to choose a topic for my end-of-year school project and I need some advice. I was thinking of implementing an online tutorial materials (digital files) project. I have been researching on ...
3
votes
1answer
308 views
How can I tell if a PPTP tunnel is secure?
PPTP has been demonstrated to be broken in many ways, and most installations are insecure. But it is also theoretically not broken if configured correctly.
As an end-user, is there a simple way for ...
2
votes
2answers
692 views
How secure is the new Mega-site encryption?
The new Mega site, sucessor of Megaupload, claims that all information is encrypted with a symetric key that only the user has access.
The general terms are listed here:
All files stored on MEGA ...
3
votes
2answers
115 views
Is a random keyfile more secure than a derived key?
I'm devising an encryption layer for some proprietary cloud storage API. Basically this should act as a transparent adapter that encrypts whole binary blobs (files) on upload and decrypts them on ...
0
votes
1answer
105 views
Tracking information on HTTPS connection
My organization uses cyberoam firewall. They are monitoring all activities including my search text in Google, Wikipedia etc. So recently i changed to HTTPS versions and now using HTTPS connections of ...
0
votes
1answer
128 views
Is TLS secure when full eavesdropping on the network occurs? [duplicate]
Possible Duplicate:
How is it possible that people observing an HTTPS connection being established wouldn’t know how to decrypt it?
Alice connects to Bob's site via a TLS secured connection ...
-1
votes
1answer
57 views
GnuPG implementations are not cross-compatible? [closed]
Let's say I made my private key using Enigmail. Then I imported it into a Windows program called GPG4USB. When I want to decrypt a message it asks for my encryption password but it doesn't accept the ...
5
votes
2answers
3k views
Is 7-Zip's AES encryption just as secure as TrueCrypt's version?
The main difference being TrueCrypt creates containers and 7-Zip encrypts the file itself, so file sizes can be guessed. Now let's just talk about the strength and breakability of the encryption.
...
1
vote
3answers
173 views
Is it a good idea to have a “master” password?
Though I do have a good memory of passwords, it is quite impossible to have one password per application. Yet, it should be... My current way to deal with passwords is to have five passwords and to ...
-2
votes
1answer
266 views
is there better email, file, disk encryption than PGP? [closed]
Currently, I am using Symantec's PGP desktop whole disk encryption for my Mac. After hearing that FileVault was insecure and supposedly easily crackaable.
However, PGP has been around for a long ...
2
votes
2answers
276 views
How does Chat monitor work,if we use encrypted service like gtalk
i have heard that there are software like this http://formessengers.com/mdetect.htm that monitor Chats and can see the chat logs,but how do these kind of software work if we are using services like ...
4
votes
2answers
1k views
How easily could be truecrypt and EFS cracked in this scenario
I suspect some info was subtracted in the past months from my laptop. Therefore Im looking for methods to encrypt my data. I want to try using truecrypt for the sensitive files folder plus EFS for ...
2
votes
1answer
151 views
Securing Isolated AWS Deployments to comply with HIPAA/HITECH
HIPAA Security Hounds...How would you view an AWS deployment that included a set of systems deployed together at AWS (within a single, secured Virtual Private Cloud), using a key to encrypt all ...
3
votes
3answers
288 views
Hash Function Xor
For a hash function what is the best secure method, XOR or Concatenate:
h(data1 XOR data2 XOR data3 XOR data4) ? or use h(data1||data2||data3||data4)?
0
votes
1answer
148 views
Is it possible to decode xor encoded string from N copys?
Let's say, I've got N strings encoded with "random" bytes using xor.
If I know that the information encoded is the same everywhere, is it possible for me to get at the information itself by doing ...
-1
votes
3answers
228 views
How to store banking information,collected on website, securely and implement encryption?
So I have this website in which I will ask users to input the following banking information.
Bank account holder name:
Bank account number:
9 digit routing number:
I need these information from ...
1
vote
1answer
113 views
Implementation review - Independent key, admin side and user side
The admin of the website needs to read user data. So, if the key is derived from the user pass, then the admin has to know the user pass, not exactly a good idea.
The following encryption scheme was ...
4
votes
1answer
401 views
What changed between TLS and DTLS
What did the DTLS (TLS over UDP) authors have to change so that it could run without TCP?
Bonus points:
Do any of the protocol difference affect the way it should be used, both in terms of interface ...
1
vote
1answer
47 views
Safely transfer UserID among different Subdomains
Scenario :
Application a.mydomain.com redirects its users to application b.mydomain.com for Account Creation.
b.mydomain.com creates the account, and redirects the user back to a.mydomain.com with ...
3
votes
4answers
201 views
Using dynamic keys
It is intuitively clear that, the less materials a cryptanalyst has available to work on, the lower would be his chance of success. This implies that the security of encryption of a message could be ...
2
votes
1answer
70 views
Is the master keypair in OpenPGP ever used for encryption, or just signing?
I've been reading this page about subkeys and I was surprised to read that "GnuPG actually uses a signing-only key as the master key". I can understand how this was the case when DSA was the default ...
2
votes
2answers
913 views
How get data from password protected rar file?
I want retrieve documents from a password protected rar file? I know brute force and dictionary method. Is there any other method to get data?
4
votes
2answers
1k views
openssl: recover key and IV by passphrase
A large amount of files were encrypted by
openssl enc -aes-256-cbc -pass pass:MYPASSWORD
Openssl should derive key+IV from passphrase. I'd like to know key+IV equivalent of that MYPASSWORD. Is ...
13
votes
7answers
819 views
Why Say IP Addresses Are Harmless?
Whenever I see someone on the internet ask the question, "Can someone find out my IP Address from my tweets/my tumblr/facebook posts/whatever else", the response I always see is, "Who cares! An IP ...
6
votes
4answers
214 views
Is it possible for a third party to sniff data off the line to an ISP and determine what the user is doing?
Can somebody hack the line between my router and service provider and monitor what I'm doing online and what sites I'm visiting?
1
vote
1answer
116 views
How do automated systems store their keys securely?
As with many systems (primarily websites) there are automatic components that run on a server and are not user based (such as crons) that don't have the opportunity for a real person to input a secret ...
1
vote
1answer
221 views
What are the benefits and drawbacks of the HTML5 Keygen element?
As of January 2013, what are the potential benefits and drawbacks of the HTML5 Keygen element?
7
votes
1answer
1k views
Android Device Encryption
I am trying to understand when using the default android device encryption in 4.0.4 ICS (AES-CBC 128Bit) how the Key Derivation Function works? That is how is the users decryption passcode transformed ...
1
vote
0answers
246 views
How can Nokia decrypt HTTPS data? [duplicate]
Possible Duplicate:
Can real end-to-end SSL encryption be made?
Regarding this piece of news, I wonder how can Nokia so easily decrypt HTTPS data?
As I understand the data is encrypted by ...
0
votes
1answer
270 views
How about preventing CSRF this way?
According to Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet , the recommended solution to protect web site from CSRF attacking is to implement Synchronizer Token Pattern. And This requires ...
