Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

learn more… | top users | synonyms

2
votes
1answer
838 views

Encryption key token

How to securely store an encryption key in USB drive? Here is my idea. I would like to write a program (let's say PC) and it will store data to a database encrypted at the record level or field level, ...
4
votes
2answers
832 views

Can you encrypt a password using that password itself? [duplicate]

Possible Duplicate: How to securely hash passwords? https security - should password be hashed server-side or client-side? I need to make a request to a web server, the only information I ...
4
votes
3answers
373 views

Secure File Encryption/Decryption Capabilities

As a preface to my question, let me state that I'm a relative newbie in the field of security. I work for a back-office financial software provider that is responsible for processing, generating, ...
11
votes
5answers
1k views

what would be a good way for a doctor to send xrays encrypted to another doctor?

As a dentist, I often want to send medical information including digital xrays to another doctor. What would be a good/easy way to do this encrypted? Our organization currently requires that all ...
2
votes
3answers
2k views

Is SSL Tamper Detectable?

I know how SSL provides security against people reading your messages - by encryting the message with a SYMMETRIC KEY, which was exchanged during SSL Handshake with the help of ASYMMETRIC KEYS. But I ...
1
vote
5answers
2k views

making an iPhone/Android app which sends a user password to my server, how to secure?

I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login. I don't have SSL on my website, but it's just a reviews website and ...
1
vote
2answers
2k views

Avast says I don't need to use encrypted connections for my e-mail accounts

I am using Outlook 2010 and Avast anti-virus 7. Whenever I add an account to Outlook if I choose to use SSL for incoming or outgoing connections Avast alerts me I shouldn't use it because Avast can't ...
0
votes
2answers
994 views

Keeping the password secret over regular http

I would like to at first be clear that this is for poor site owners who can't afford the SSL option but require logins to their site, potentially from a public kiosk, and need a secure method of ...
8
votes
3answers
2k views

Encrypt WiFi connection per connected user

One of the questions that comes on quite often is about WiFi encryption. Now imagine that you have multiple users connecting to one AP. With a simple WPA2 protection setup they can still sniff each ...
6
votes
1answer
615 views

Should password hashes be encrypted or HMACed?

Assume I am hashing user passwords with PBKDF2, bcrypt, scrypt, or some other secure key derivation function. Are there: tangible security benefits, precedents, and respected research for ...
6
votes
1answer
279 views

Could a consumer-friendly PGP-like file encryption application theoretically be secure?

In a situation where there are desktop and mobile clients, and a central public key repository to and from which the desktop and mobile clients automatically upload and download public keys as needed, ...
3
votes
1answer
167 views

How to ensure web application remains secured after intrusion of server

My application employs asymmetric encryption / decryption, the process of how this work is detailed below: Encryption - Server A Data is encrypted using the public key of server B Data is signed ...
2
votes
1answer
15k views

Why it does not matter whether you type HEX or ASCII as WEP WiFi password?

I know that I can pass password in HEX as a keyphrase to WiFi network using WEP encryption as well as ASCII. But somehow you cannot get the ASCII when you only know HEX value. Can anyone explain the ...
11
votes
5answers
4k views

Confusion: Why isn't a passhrase encrypted SSH key two factor auth?

I'm trying to figure out the best practices for accessing my devbox from a public terminal. Most sources I've found recommend protecting the box with some kind of two factor authentication, such as ...
5
votes
2answers
7k views

Is it safe to store password in PHP session?

I need to do some encryptions in the private zone of my website and I want to bcrypt the user's password. Is it safe to store the password in the session when user does the login, so that I can use ...
5
votes
2answers
709 views

Shibboleth user attribute encryption

How does Shibboleth guarantee that 3rd parties do not get access to user attributes contained in SAML 2.0 assertion exchanged between IdP and SP? Is it correct that all user attributes are encrypted ...
10
votes
4answers
8k views

Secure way to transfer public/secret key to second computer

I created a public/secret key using Seahorse (GNOME managing tool for encryption keys). I haven't had issues encrypting and decrypting files from the computer the keys are located in but I'd like to ...
7
votes
4answers
3k views

Password Vault - Enterprise

I want to be clear from the get-go that I am NOT looking for a user password management solution. My organization already uses AD for that. What I am looking for is a password vault. Up until now, ...
1
vote
1answer
266 views

Is proper documentation on .xef files available anywhere?

WinACE encrypts files (using one of its 8 methods) into a file with the extension .xef. I'd want to see some documentation on this file format but I couldn't find anything... I'm particularly ...
8
votes
3answers
608 views

How secure is HTTPS with weak ciphersuites?

Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
5
votes
3answers
843 views

How to store chat conversations on my website?

I am making a site where members are able to have one-to-one chats, and I'm not sure how should I process conversation texts. Should I store the text in a .txt file or directly in a database? I also ...
4
votes
1answer
189 views

How does my antivirus determine which CTL is used?

I have imported a trusted root certificate into the Windows local machine list. This works fine with my signed certificates, unless my AV (Bitdefender Antivirus Plus 2012) is set to "scan SSL", in ...
107
votes
14answers
30k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
2
votes
1answer
4k views

Kik | WhatsApp - Encrypted? iOS / Android Message encryption tips [closed]

Kik says that their client is using ssl etc. But it's kind of hard to tell if the messages is actually encrypted between the devices. What i can understand is that they don't got device-to-device ...
5
votes
6answers
2k views

Tracking unique web site visits without logging IP addresses

On Monday, some IP address xxx.xxx.xxx.xxx visits my site. I log it. On Tuesday, another IP address yyy.yyy.yyy.yyy visits my site. I log it. If the two IP addresses are equal, I throw out the ...
0
votes
2answers
267 views

How could an AV detect a virus that has a chance of not decrypting itself?

If I understand this correctly there is a chance the virus may not decrypt itself at all. How could an AV catch this? In some cases, the decryptor may start with a header whose intent is not ...
3
votes
1answer
606 views

Are SSL Certificates (Private and Public key) generated by OpenSSL and makecert compatible?

Are RSA SSL Certificates (Private and Public key) generated by makecert compatible with OpenSSL decryption ie. can I decrypt them with the openssl_* methods? I am working on two-way SSL authentication ...
14
votes
7answers
1k views

Has cryptography reached the development level where social engineering is the only reliable method of attack?

Note that for the purpose of this question, "social engineering" means extracting information from humans, be your methods compliant with Geneva Conventions or not. Simply put: Do cryptographic ...
5
votes
2answers
1k views

Encrypting/decrypting information in database

So, let's say I have a secret message I want to encrypt and store in my database, from where an authenticated user can retrieve, decrypt, read, update the message. EDIT: the issue I'm encountering is ...
2
votes
4answers
2k views

CMS Uses http and so sends password in plain text

A well known CMS called Joomla allows users to register and the password appears hidden as you register with dots a normal experience online - at this point you think just you know it. But if the site ...
-1
votes
4answers
161 views

Sensitive information I don't want my work to backup

Can this be done safely? I want to print 2 pdf’s containing personal/banking information from a computer at work. It has CrashPlan Pro running and I don’t want a copy of the files to be made that I ...
4
votes
4answers
1k views

Can public keys be a security risk when performing password-less SSH logins?

Some companies use monitoring software such as nagios or icinga. In order to perform checks on the servers, they often need password-less SSH logins. The servers being checked put the public key of ...
1
vote
3answers
284 views

Is purging AES keys allowed legally?

We're developing a service, that encrypt e-mail with AES algorithm. Keys are stored in our server. We thought about having an expiration service, that is deleting the key from our server. This ...
1
vote
2answers
228 views

Protecting passphrases within an application

First off, I'm not very familiar with encryption best-practices. My use-case is simple: I'm creating an application that will be reading encrypted documents and decrypting them dynamically to do some ...
13
votes
3answers
10k views

Is multiple encryption a good idea?

I know that many encryption algorithms, while secure, have vulnerabilities. To reduce risks, would multiple encryption like this Blowfish_CbC ( Rc2_OFB ( AES128_CBC (myfilecontent))) be a good idea?...
12
votes
2answers
25k views

Do VPNs provide sufficient protection over public wireless networks?

I know that VPNs are the standard way to secure communication between a remote user and their primary network, but I've never felt entirely comfortable relying on them when using an open wireless ...
75
votes
5answers
34k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
1
vote
3answers
438 views

Logic for generating Strong Password?

I try to encrypt password using MD5 but there are decoders for MD5. So I'm worried about encryption of password for big website. Is there any logical suggestion or step function to generate strong ...
0
votes
2answers
569 views

Anonymous proxy over SSL [closed]

Can you name any anonymous proxy software that don't use VPN connections? Basically, I'm analyzing different encrypted traffic and now I need to analyse a simple anonymity proxy traffic. I'm analyzing ...
2
votes
1answer
10k views

Encrypting string in JavaScript and decryption in Java [closed]

I would like to know if there is any library to do encryption in JavaScript and decryption in Java. I have already tried many APIs, but am not getting the same values in Java. I want public-private ...
6
votes
3answers
1k views

Computer decryption algorithms and knowing the solution

This is a general question about using computers to decrypt information. It has puzzled me for a while. The question is really two parts: How does a computer check if a "guessed" key is the correct ...
3
votes
2answers
623 views

Signing data bigger than allowed RSA Block size?

I've enountered a small problem while implementing a modified version of the Station-to-Station protocol (STS). Say we have two principals A and B, where both of them knows the other's public key: ...
2
votes
2answers
13k views

Excel 2007 Encryption Strength

With a strong password of 10+ characters, mixed case, etc... is the encryption of an Excel 2007 document secure enough to create reasonably strong defense against a brute force attack? What ...
1
vote
4answers
2k views

Shall I need to use MD5 algorithm in both JavaScript and PHP for login authentication?

I have a login form with username and password. I post this form data to a PHP file. For security reasons I want to encrypt my password in the database and network. Now I have done now following steps....
9
votes
3answers
7k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
2
votes
3answers
923 views

Please recommend best-practices documents for sharing encrypted data with non-technical end-users

Is there one, or several, "best practices" documents which cover in clear simple language how to share data among a non-technical support staff and non-technical end-users at various organizations? ...
1
vote
1answer
210 views

How dependable can data encryption be without re-entry of password on startup?

I posted a comment awhile back, and thought I would turn it into a question. Example: There is a feature in the Microsoft SQL Server for full database encryption, which seems to have an option that ...
1
vote
1answer
1k views

Testing my network using aircrack-ng not working

I an using Fedora 17 With Intel 5100 card. When I execute the command: [root@fedora user]# aireplay-ng -9 mon0 10:26:46 Trying broadcast probe requests... 10:26:46 Injection is working! 10:26:48 ...
0
votes
1answer
680 views

Should I encrypt data on my server as an extra layer of protection?

I'm going to create a client-server application that stores a user's sensitive financial information on the server. I would like to encrypt this data so that even if a hacker gets access to the ...
2
votes
1answer
1k views

Vulnerabilities in Host Proof Hosting

I've recently been doing some research on Host-Proof Hosting, specifically in a web app environment. It seems like a pretty rock solid method of security, but I'm certainly not a security expert and ...