Tag Info

New answers tagged

0

I've got bad news for you - the files are lost, unless you've got a backup. Cryptolocker uses proper crypto combination (RSA-2048 and AES), and it's done right, so you've got very little chance of recovering anything.


1

The first one seems pretty weird. If we remove the two ending '=' of the first one, It seems to me it would be a base64 encoding of an encryption of the password using a block cipher that has 64bit-long blocks. Since I don't see anything looking like an IV, my guess is it is using an ECB mode. Furthermore (I am still guessing), the adobe leak that occurred ...


1

Passwords in databases are rarely encrypted, they're hashed instead. Encryption is a reversible process - you can decrypt content, given that you know the encryption method and password. Hashing on the other hand, isn't a reversible process. What you're looking at is not an encrypted password, but a hashed one. On the question of replacing the password in ...


8

The properties people are looking for when storing passwords is to make it incredible tedious and slow to try and guess the original text, but it needs to be relatively fast when doing it once in software. You also don't want two users using the same password to generate the same ciphertext. To cope with this you will need either a salt in case of hashing ...


12

Very interesting thought. But we have one problem here, regular hashes have always the same size, your hash will have different sizes depending on the input. So it can be considered less secure that a regular hash. Hash function definition: A hash function is any function that can be used to map digital data of arbitrary size to digital data of ...


0

When you are encrypting, you would need to generate a KEY from a passphrase, which would be your password in this case. You would be running your password through a key derivation function like PBKDF2 which would effectively come close to a hash. So basically IMHO it's interesting but I don't think necessary in terms of security.


7

To expand on Thebluefish's answer, the form submission process appears to use HTTPS (an encrypted protocol) for the credit card element to https://connect.firstdataglobalgateway.com/IPGConnect/gateway/processing when I am looking at the page. But this does not mean this setup is safe to use. The overall setup is very vulnerable and needs to be fixed. I ...


0

Look into GoldKey or Yubikey. I know for fact that GoldKey has something similar to what you want, they call it a goldkey vault. Yubikey probably has something similar, but I'm just not as familiar with their products. Hope that helps.


1

TrueCrypt seems to offer the ability to use a key file with its encryption. ***As a major disclaimer TrueCrypt technically is no longer supported and may be insecure. Here is a guide that you can use to add a keyfile to that encryption. You could store a key file on a USB and use that in addition to a password. There might be a more automated way to do ...


-1

Encryption could have been done with javascript before the form is posted. To do so, the encryption algorithm and public key has to be sent to the client if using asymmetric encryption. For symmetric encryption, both algorithm and key must be sent. However, I have not found any javascript encryption library or function used in the page. An example of such a ...


3

If you look at the source code regarding the credit card form, you can see the following: <form name="form" method="post" action="https://connect.firstdataglobalgateway.com/IPGConnect/gateway/processing" id="payForm"> Therefore the form submission is over HTTPS. This should be fine in ensuring your credit card details are not stolen, though your ...


-2

The thing is don't use your own encryption, or the one some genius thought up last week, use the same encryption that has been around and still hasn't been cracked, your better off because that genius last week might have overlooked something and you know that the encryption that's been around has had time to prove itself.


3

Yes, you do need to save the IV. In CBC mode, the IV is XORed with the first block of data before encryption in order to prevent leakage of information about the plaintext, specifically whether the first block of two ciphertexts using the same key also start with the same plaintext. You are correct in your belief that you will not be able to decrypt your ...


0

You don't say what your application is, but you could consider having a dedicated back-end server used to verify pins. You can then restrict access to that server more than you can for the front-end web server. You can implement restrictions such as rate-limiting on the pin-checking server so that even if the front-end server gets taken over by an attacker ...


5

The number one problem with the scheme you've proposed is that you've completely ignored secure key exchange. The next problem is that the output isn't going to be anything like random as Iserni pointed out and is therefore susceptible to a number of attacks. The next problem after that is that it isn't authenticated, which can lead to ciphertext ...


1

Bob Brown has covered most of the salient points in his answer but I did want to point out that there is one significant disadvantage: Complexity. You are increasing the complexity of your application to some degree, lesser (in the case of adding a pepper to the hash where you need to think about key management as well as storage of password hashes and ...


4

First of all, every stored password should be hashed with a different pseudo-random salt. Second, SHA-256 is not appropriate for storing passwords; instead, you want to use a key stretching algorithm, as has already been mentioned. There is a lot more detail at Crackstation. An encrypted hash is also called a keyed hash, and the key is sometimes called a ...


3

Provided that you mean Hash first (BCrypt) and then encrypt the hash, security should not be weakened, yet you are not improving security either. Encryption is, by definition, a reversible scheme. Since there really is no use-case for which you would require the decryption in this case, encryption is the wrong tool for the job. If you are looking use a ...


1

I will restrict this to only gateway to gateway VPNs - there are additional potentially higher risk considerations for client to gateway VPNs. A connection to the Internet will be via an ISP and therefore the end points of a route between two organisations will generally be known; if the ISP(s) have implemented controls that provide confidence that their ...


0

If you believe that the traffic through the ISP is safe enough to protect your data then why do you use https in facebook and gmail? simple http shall do, right? You have to understand so many attacks including sniffing and tampering of data in order to understand the concept more clear. Read this to understand why you are recommeneded to use https always. ...


1

The internet is a mesh of telecommunications lines run by different companies which are leased by ISPs which use them to sent traffic from customer to customer. Any one of the ISPs or telecommunications companies can sniff the traffic that goes over their lines or network devices in ways you cannot detect. Some governments have forced (or paid) ISPs to ...


-2

Encrypting the hash is in the first place just another hash function. With respect to potential collisions it is as good or bad as the original hash function (encryption is reversible by decryption and does not add more collisions). When you can keep the keys (both for encryption and decryption) secret, it adds security because a brute force attack on the ...


-1

It's all based on the assumption you make being false. Which in practice is the good one to make. An ISP jobs is to to move packets fast and cheaply. Ensuring their security (integrity, confidentiality) is not something they can do without using what you would call VPN technologies. And if you're not paying for it, they sure ain't doing it.


8

I'd like to implement some kind of simple (yet as strong as possible) encryption > for my client-server application network traffic. Data to be encrypted can be both textual, and binary. You're implementing a modified Vigenère cipher. That might be a problem in that any sufficiently large sequence of repetitive data (with binary zeroes being the most ...


0

You're basically talking about implementing a "one time pad" - (with some modifications). To do a one-time pad right, you would need to: ensure there is sufficient random data (which is basically the key); it needs to have cryptographically strong random properties; you need to distribute this key securely to all parties who need to decrypt it; you ...


4

The best over all solution is to use a commercial payment handling service that deals with all of that for you. For that transaction volume, the danger of having card data stored on prem out weighs your need for the data. If this is a retail business, I would suggest something like square, which would essentially put the responsible handling of data in ...


-2

The keys are generated without user input, keys should of course be random. The keys are simple strings of dictionary words, not very secure against anyone with the ability to access your unencrypted calls.


0

Usually you have a constant realm and in this case HA1=MD5(username:realm:password) could be stored instead of the password. But, if the password is only used for the SIP account, it actually does not matter if within a attack against the provider username and password get seized or HA1 instead, because the latter is all it needs to authenticate as the user. ...


1

Above is a packet capture of communication between my phone and Google's server(74.125.68.19). Apparently, TLS is used to protect data in transit. TLS is also used for your browser's connection to a HTTPS website so the security is comparable. If transmitted over cellular networks, there is a second layer of encryption between your phone and your ...


2

As long as you are working with only online needs for the password for integrating with a system while the user is logged in, then you should store the passwords encrypted with both a database key as well as a derived key based on the user's password for your service. When the user submits the password for their login, you can use that to produce a password ...


2

If you need to retrieve the plaintext password at some point, then you indeed need encryption and not hashing (beware that many people call "encryption" what really is hashing). I suppose that your "business need" comes from the need to support some protocol where the server must know the plaintext password (e.g. the APOP authentication method in the POP ...


3

No, most cryptographic methods that are considered secure are based around assuming every computer in the world is working on the problem non-stop and it still takes to the heat death of the universe. Sure it could be used to break less secure encryption, and in fact, using a super computer to crack such weak keys is effectively the same thing as using a ...


2

For "symmetric cryptographic algorithms" (symmetric encryption, MAC...), things are simple: a non-broken cryptographic algorithm is such that it uses an n-bit key, and the fastest method to find the key is trying out all possible keys until the right one is found (that is called exhaustive search or brute force). The algorithm is said "non-broken" precisely ...


3

Cookies are domain-dependent. You don't decide, from the server side, which cookie you read; the browser sends the stored cookies that match the name (with domain) of the target server. If you want to share some authentication in some SSO manner, then you need both servers A and B to delegate the authentication to a common third server C. That server will ...


0

Some wireless access points implement client separation to prevent comms between connected devices more detail here: Wireless client isolation - how does it work, and can it be bypassed? this would help to prevent the unencrypted traffic being viewed. But even with that in place if the encryption is based on a pre-shared key (PSK) and the attacker has the ...


3

The general answer is: do some reverse-engineering on the application. This notion of "reverse-engineering" is rather large; it includes: Reading the documentation (if any) or other design notes accompanying the application. Talking with the developers who built that application (it is amazing what people will say after two or three pints). Going through ...


0

Edit: Reading this post: Are WPA2 connections with a shared key secure? I realise that I know too little about the topic. Original post remains below. Does Wifi encryption create a private tunnel between the adapter and the accesspoint? No. Not even with 802.1X Authentication. -> See https://en.wikipedia.org/wiki/IEEE_802.1X#Shared_media When non ...


-1

Tools to see it: PEiD with the Krypto Analyzer (KANAL) plugin Keygener Assistant IDA Pro with the Findcrypt OllyDbg with the SnD Crypto x3chun's Crypto Searcher Hash & Crypto Detector (HCD) Draft Crypto Analyzer (DRACA) To know how to run linux tools learn bfcrypt - Crypto scanner


1

In spite of being possible to read/write data to SSL/TLS channels as with vanilla TCP/IP sockets, in Java or C or whatever, SSL provides you the concept of SSL session, which can be kept across several TCP/IP connections. Thus, IMHO this makes SSL a session layer protocol (I wonder why someone came up with the TLS name...).


4

Unless "website A" and "website B" are both subdomains of the same domain, what you want to do is impossible; if they are subdomains of the same domain, the same person or organization presumably controls both. Consequently, legality is irrelevant.


-1

No, the privacy of clear text data does not depend on the encryption mode of the network, assuming that other (legitimate) machines are connected to the same access point. By default machines will not show (clear text data) traffic of other machines, however it is possible to do so using tools that poison the ARP table, this is called (you guessed it right) ...


2

First, a comment; sometimes (read "almost always") I get a cool new toy, app, technology and I try to fit it in in every possible place. Even in places that don't work, I enjoy figuring out why. It's a learning experience. The term "Threat Model" may sound either overly theoretical, or dismissive of your case. The purpose is for the security consultant ...


1

Having once worked at an edu, it was our goal to make things as seamless and painless for the clients (students) of the University. As a professional, there were many things that we championed for especially when it came to security. For example, we opposed P2P network, because traffic patterns at the time pointed to students downloading music (back then ...


0

The actual format of NaCL's output is not completely specified -- or, rather, it is specified as being the raw output from some cryptographic primitives (as described there). The format is thus non-extensible and does not include any feature supporting multiple recipients. Ability to send a message to multiple recipient appears to be a functionality that has ...


4

You can have SSL/TLS without certificates. This is supported in the TLS standard: the "DH_anon" cipher suites involve no certificate whatsoever. But you have to remember that such an unauthenticated TLS is inherently weak against active attackers, since they cannot prevent client or server impersonation (or both at the same time, which is called a ...


1

Seems to me the number was converted into hexadecimal, and then put through base64. This is only coding, no key was used, it is not encryption. To reverse it, you can do echo "73L0zaw06WGCxKQIKkiQnlvav8XyVUyeVT3qU6uWLXXbpG71J5Q8TzArk/DBR+Vw" | base64 -d | xxd to see the value in hexadecimal. Then use Python for instance to convert the hex number found into ...


0

Regarding alternatives to certificate based (asymmetric) encryption for communication protocols, symmetric encryption is a possibility such as a shared key known by both parties. Considering alternatives to SSL and in particular certificates, consider encrypting the data before it is placed on the wire. This would allow you to use any number of protocols ...


4

SSL/TLS (the underlying protocol for HTTPS) provides two features: Encryption, so that nobody could passively listen to the data. Encryption is done using a key which is somehow shared between the peers. Identification, so that you can be sure who you are talking to. This is usually done with certificates. While you might have encryption without ...


0

The data over https connection is encrypted using a private key, which is known to both sender and receiver. The sender encrypts the data using the private key and the receiver uses the same key to decrypt the data. The same key is not reused again to prevent the replay attacks. Therefore, a unique key must be used in every session. Now, the question is ...


0

No, you can't have HTTPS without use of SSL Certificate/public key. With SSL Certificate the server identifies itself to client. If you having Self-Signed Certificate you'll have HTTPS, but self-signed certificate is not trusted by modern browsers.



Top 50 recent answers are included