Hot answers tagged

3

I'd say that the reason is to obfuscate the stored passwords, and that the "remember websites passwords" feature in Firefox is supposed to be always used with a master key.


3

how does Android ensure that the throttling of failed authentication attempts is not by-passed during an offline attack? Android KeyStores can be hardware or software based previous to android N, which has made hardware KeyStore a MUST in the CTS. EDIT: In the below I am using the term online attack as something with the property Online entities ...


3

I need to application 1 make a POST on application 2, but on application 2 I need to make sure that POST comes from the application 1. For the purpose of this post, I'm going to call application 1 the Client, and application 2 is the Server. Let's start with: My biggest worry is Man In The Middle attack. Ensure that when the Client makes a ...


2

It's probably to simplify the implementation. Rather than having two cases where the key store could be encrypted or not depending on whether Master Password is set, the code always encrypts. This reduces the likelihood that a code path that forgets to encrypt when Master Password is enabled goes unnoticed.


2

Serval other softwares using AES 256 encryption support any key length such as a 10char insted of the 16. how is that possible (such as winzip's aes encryption)? the same way the other way. how can the encryption depend on the key strength when the key has to be 16 chars what i was thinking was if the passharse was less than 16 then fill the remaining ...


2

A point not previously mentioned: Double encryption. I.e, you first encrypt your message with your favorite secure non-backdoor method, then send the message encrypted again using the government-sanctioned escrow system. This will look no different than using the escrow system to encrypt plaintext, so as far as the government is concerned, you are an ...


1

That depends entirely on your configuration and your wishes. Your setup certainly could re-encrypt after analyzing with mod_security and before forwarding to your application server. You would do so by using the ProxyPassReverse and SSLProxyEngine configuration options - see this question for an example. So that begs the question: should you use TLS ...


1

The process of judging the security of information stored in a password database is done with the assumption that an adversary (hacker) not only knows what cypher/encryption you are using, but also that he has stolen a copy of your password database. Knowing those things, the hacker wishes to determine password so he can pretend to be a valid user. In the ...


1

An attacker now has the advantage to be able to choose which crypto system he wants to break. It's enough to find a weakness or implementation error in either one. As for you this adds the responsibility for keeping two systems equally safe. If we assume that you do that correctly, I can't see any significant advantage for an attacker...


1

The phrase "bitwise cipher" is most likely XOR'ing the base64 of the plaintext with a key of the same length. This is the most basic kind of symmetric cipher. Try XOR'ing the base64 of the plaintext with the ciphertext they give you to get the "key". Then XOR this key with the challenge text to decrypt it. And yes, I am aware this is an old question and ...


1

Before the details : Telegram's server side code is not available as open source and hence can't be reviewed. Telegram uses Diffe-Hellman for key exchange and AES-IGE encryption. The basic principle of understanding in DH key exchange is that No entity can effectively intercept the key generation while simultaneously making sure that the parties ...


1

WhatsApp derives the QR code (and the numerical representation) from the user identifier and the 32-byte public Identity Key of both parties. I guess that some deterministic algorithm decides, witch of the two identifiers comes first (e.g. they could be sorted lexically). This allows both clients to display the same image and numerical representation, ...



Only top voted, non community-wiki answers of a minimum length are eligible