New answers tagged

3

Are private pastes on pastebin.com vulnerable? Absolutely. Remember, if you are using a free service, then you are the product. Pastebin as a free service is definitely vulnerable. Personally, I use pastebin quite often. It's a very good service, and I am not worried about the website owners running off with my private information because I do not ...


0

If you are using Java, shouldn't you be using the Java KeyStore? https://docs.oracle.com/javase/7/docs/api/java/security/KeyStore.html This class represents a storage facility for cryptographic keys and certificates. A KeyStore manages different types of entries. Each type of entry implements the KeyStore.Entry interface. Three basic KeyStore.Entry ...


1

I'm assuming that your threat model is an attacker gaining access to read files on your webserver via some type of web exploit. If not, you should question what exactly you are mitigating with your proposed encryption strategy. If it is, an option similar to 2 is probably the most simple. I would use AES128-CBC as the algorithm for a Key Encrypting Key. ...


4

Any website owner can see what IP address is doing things on their website. This applies whether HTTPS is in use or not. Any node operator (ISP, CDN provider, gateway operator) can see traffic passing through the nodes they operate. They can see both the apparent source of traffic, and the destination - they need to in order to be able to correctly route ...


0

When you do a HTTPS request, the packets which transit on the network contains both the origin IP and the destination IP. Each owner of a node you transit by can see those packets, and read these information, even if they can't decrypt the message. They might use the destination IP to guess which site you are connecting to (or use other techniques like DNS ...


2

First I'll have to say that the slides you were getting this information from are not of particularly good quality - to formulate it nicely. What is called m+H(m+k) in the presentation can actually parsed as a poor attempt at providing symmetric message authentication. If you're not sure how to parse this, the second part is: Basically what is described ...


0

The first equation in your question represents a digital signature. There's a hash over the message, encrypted by the private key of the sender. Recipient (or anyone else) can decrypt using the sender's public key, and can determine, by re-computing the hash, that the message has not been altered. The second is a keyed message authentication code. A hash ...



Top 50 recent answers are included