1
vote
0answers
159 views

What is the preferred way of using AWS (specifically S3) from mobile apps?

Adding the AWS access key and secret key directly in app code is definitely not a good approach, primarily because the app resides on the users device (unlike server side code), and can be reverse ...
2
votes
1answer
116 views

Current industry standard key management solution for web app on linux host

The scenario: Data is sent to an application server and you want to selectively encrypt some data before sending it to a DB server for storage. All servers run some linux distro. This is a relatively ...
2
votes
2answers
406 views

Managing and deploying web app passwords

What are some best practices for managing and deploying web app passwords and private keys? E.g. the password to access a database or external services like the Facebook API. I'm referring generally ...
3
votes
1answer
152 views

Design of system based on HTTPS, Client Certificates and custom CA

I have the following system: 2 application servers. At the beginning is installed the first server and later is installed the second one. A client access from a browser to both servers Application ...
3
votes
1answer
1k views

What is the best practice for storing a secret on the cloud?

This post on Securing Java Application Data for Cloud Computing offers a good introduction to using a Java KeyStore for securing encrypted data in the cloud. It neglects, however, to answer the ...
7
votes
1answer
1k views

Encrypting sensitive data in software and storing/decrypting it on a server

I have searched IT Security and Google for something similar to this, but wasn't able to find anything remotely related to what I'm doing. I'm developing software which has 2 parts - a C# program run ...
9
votes
3answers
723 views

AES using derived keys / IVs. Does it introduce a weakness?

I'm looking for an efficient way to encrypt multiple fields in a database with AES using a single global key, used throughout a large web application. Obviously in order to re-use this key, a unique ...
4
votes
1answer
278 views

Storing License Keys

I'm creating an application which generates licenses key and stores this in a database (the licenses are checked online). I don't wish to store these license unhashed, in case the database is stolen. ...
3
votes
1answer
733 views

How to use DPAPI under load balance environment

DPAPI can be used to encrypt the secret data. We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on ...
26
votes
3answers
7k views

What useful things can I do with the html5 “keygen” element?

There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari. Here's what it looks like: <form action="processkey.cgi" method="post" ...
3
votes
1answer
502 views

Is this security/encryption scheme secure?

I'm rolling my own, personal threetags.com-style 'encrypted data in the cloud' webapp (I didn't like the UI, and lack of non-browser client). However, I have absolutely no experience with security ...
29
votes
2answers
6k views

Web Application encryption key management

In a nutshell, let's consider a web application which stores some information in a database as encrypted data. While I'm purposely trying to keep this some what generic, here are some assumptions: ...
3
votes
3answers
120 views

Encrypting a fixed format message with commands and transmitting over the internet

Linked to: Encrypting a fixed format message? I need to communicate from Site A, a set of information that will be presented to users of Site A, which when they choose to submit, should travel to my ...
3
votes
2answers
181 views

Encrypting a fixed format message?

I'm planning to send across TWO pieces of information over the internet from machine A A site identifier which will be like: $SiteName = "EXAMPLE" (in plaintext) Encoded text which will be like: ...
5
votes
2answers
870 views

Generating one-time tokens from API-key?

I have a web-site for which I'm building a Drupal module that allows the users of that Drupal site to navigate to my web-site directly from the Drupal site. I intend to distribute secret API-keys to ...
14
votes
4answers
560 views

Database Encryption Security

I am encrypting and decrypting my database data from my web applications API. If my web server is compromised, what is to keep someone from using that same method to retrieve the data? For example, ...