I'm evaluating a credit card processor, and I noticed they are using MD5 as part of a salted hash algorithm to protect a secret key. Since I know MD5 is generally considered broken, this feels like ...
I am creating a page on a website that will show a user some authorized information from another website, and that website uses a combination of the user's user-number and a secret passphrase hashed ...
I have a client and a server. The client makes a request containing userId, cardId, position (on the card) A hacker could just do the same http request with the next position. So I think about ...
It's still commonly recommended way of hashing passwords, even if it's insecurity had been proven in 1996 Therefore we suggest that in the future MD5 should no longer be implemented in ...
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
I'm writing a small webapp and I don't want to transmit login passwords as cleartext. As I don't have SSL available I've written a one-time challenge system which sends a random string with the login ...
I'm rolling my own, personal threetags.com-style 'encrypted data in the cloud' webapp (I didn't like the UI, and lack of non-browser client). However, I have absolutely no experience with security ...