Tag Info

Hot answers tagged

55

Two generic things you apparently have missed: In case of disk failure, having the data encrypted at rest solves the issue of having potentially sensitive data on a media you can't access any more. It makes disposing of faulty drives easier and cheaper (and it's one less problem) Full disk encryption also makes it harder for an attacker to retrieve data ...


12

If the decryption key is stored in plain on the very same media as the encrypted data, then the encryption is pointless. If you have a set of rules, which require data to be encrypted, but permit storing the key in plain on the very same media, then the rules are flawed. If you ever face such a flawed set of rules, you should point out the flaw. If the key ...


6

Consider what you mean by 'secure' data center. Generally, I don't consider anything secure against a determined and well-resourced attacker. True, having 18" of reinforced concrete, double man-traps, and armed security provides a fair amount of protection, but it's rare that this protection is all just for you. In most co-location facilities, the only ...


6

There are attacks on the firmware of hard disks. Googling for hard drive firmware attack will return some results about what the NSA does or can do, which probably isn't very relevant to you; but even hobbyists are able to modify the firmware of drives. This guy even installed a linux kernel on his hard disk - no, it wasn't the PC that ran linux, the hard ...


2

> I saw different key sizes for RSA algorithm (512, 1024,... [bits] for example) but, is this the length of public key or the length of private key or both are equal in length? It's the length of the modulus used to compute the RSA key pair. The public key is made of the modulus and the public exponent, while the private key is made of the modulus and the ...


2

Your scheme would not work as it is, because the Amazon server has not authenticated you when you arrive on the login page yet. So it must let your client browser decide how to create a unique guid. If the server tried to calculate a unique guid based on known attributes such as your IP address or browser fingerprint, you would be unable to connect from ...


1

Not surely. It depends on, against what you want to defend yourself. Some examples: If you live in a country, where the government can confiscate your server to analyze its content and then use it against you, or your employer. If you are the owner of the server, but won't give the possibility of your employee/collegues having physical access to it, that ...


1

Torrent clients offer encryption of traffic using RC4, and people consider this, like, very safe to hide traffic information from ISP. People are wrong to do so, but not because RC4 is even remotely the weak point. Simply knowing which IPs you're connecting to allows precise determination of the torrent you are downloading by an opponent who simply ...


1

Quote: " . . .they have done little to nothing to actually reduce risk associated with unencrypted data. . ." Ok, yeah, I think you are right. The simple answer is "it is pointless", but "it is also NOT pointless." Which is why, and forgive me for saying this, I think you may be barking up the wrong tree. Let me explain. The full disk encryption (FDE) does ...


1

If you are executing the code in an extension, it is run in a separate context (for security reasong) and it can be made to run without the code/key being concealed to the called webpage (which is a bit different than the web page not being able to detect that you used some script within the page). For example, GreaseMonkey is designed for doing this kind ...


1

As long as the data travels inside a properly configured SSL/TLS connections, there is no security issue regarding the increase amount of data sent through the internet, the only downside would be an increased load on your server. If you cannot trust local storage, then fetching the data from the server when it is required seems the best option from a ...



Only top voted, non community-wiki answers of a minimum length are eligible