Tag Info

Hot answers tagged

4

Such compromises already happened and DigiNotar is just on example. In effect the attacker could impersonate almost all certificates this way, because for most certificates it does not matter who signed it but only that it was signed by a CA trusted by the browser. There are few exceptions which are thus safer: Chrome and Firefox (and IE with EMET?) have ...


3

When you visit https://security.stackexchange.com/, in some instances you'll be served content (ads specifically, it appears) that is over http rather than https. Most modern browsers will warn when this happens as you are seeing. The risks are that the content that is served over non-TLS connections can be viewed and manipulated before reaching your ...


2

The compromise of a Root CA does not mean that all certificates signed by that trusted root are indeed compromised. Rather, it means that fraudulent certificates can be made for man-in-the-middle attacks and signed so they appear trusted in a browser. When you submit your Certificate Signing Request (CSR) to a Certification Authority (CA), they are ...


2

What you are talking about is not so much encryption as obfuscation. Obfuscation techniques are generally not considered part of cryptography. XML is a data format and as such doesn't perform any processing by itself. Obviously it can contain elements that require processing but that processing is probably not Turing complete. That means that an encrypted ...


1

It depends on from which threats are you going to protect. Encrypting data on database level is great protection, when you have so many IT employees, that you're able to divite them into teams responsible for each layer. For example, banks and credit cards acquirers use PCI DSS security standard, which require such protection along with dividing IT staff ...


1

Steganography does exactly that! You can hide text inside a file(image/audio/video). One way is to work with images. You can manipulate the pixels of the image to store the text message. The difference is not visible to the naked eye, and one cannot tell apart the original image from the image having encrypted text. The size of the image remains constant, ...


1

I would guess what you want is actually steganography. The drawbacks of this approach includes: Some kind of shared secrete is needed between the sender and the receiver; The "encrypted data" will be much bigger than the secret message itself.


1

The privacy of browsing information depends on vulnerability of SSL that your service provider use. If a website using a vulnerable protocol (like as SSLV3 that vulnerable to POODLE attack) or weak signature algorithm (like as Diffie-Hellman (DH) key exchange), absolutely your information is in danger. but for example if a website using TLSV1.2 with ...


1

I recommend that you strongly consider paying a third party for the security, because it will probably be the most fiscally responsible solution. If you handle the payment card data yourself, you will be responsible for PCI audits, which can be very expensive. And after the upcoming October 2015 liability shift (assuming you are in the U.S.A.), the weakest ...


1

The password is hashed with bcrypt, and the public and private keys are stored alongside the password hash in the user table. Storing the private key means a compromise of the database would allow attacker to decrypt the bank information. You might as well store the bank information in plain text. Why exactly would the bank information need to be ...


1

Consider a single primary key to be equivalent to one identity. You cannot connect subkeys to user IDs. Both subkeys and user IDs are attached to the primary key, the only connection from user IDs to subkeys is through the primary key. If you want to select different subkeys for different machines (for example at home and at work), this is easily possible ...



Only top voted, non community-wiki answers of a minimum length are eligible