Tag Info

New answers tagged

0

No, GSM calls (and data traffic) are not always encrypted. 2G connections can be unencrypted as part of the 2G protocol and even if you have a 3G or 4G phone you still can make those unencrypted 2G calls. In a perfect world all calls would be encrypted as you would expect providers to turn on 2G encryption. However, the encryption can be deciphered (see ...


0

One thing to consider is how the information might leak. If search indexing sees the file, your passwords might get stored in the search index. Or maybe the text editor you use will store temporary versions of any file it opens. Or maybe your virus scanner will scan any file you open and maybe store some information about it. Or maybe your OS likes to store ...


0

As you mentioned, password hashing is a great way to secure a client's password in a database (if done right). However, if you/your app needs to know the data that is being hashed then hashing alone cannot work as you need to encrypt the data. I assume you are concerned with data breaches themselves (attackers gaining access to the database and thus ...


5

In the simplest models for symmetric (reversible) encryption, you just need a decryption key - which can be as simple as a common password. For the system to be zero-knowledge, the encryption must be done on the client's system and ONLY encrypted information passed to storage provider. This way the storage provider technically has the data stored, yet it ...


1

The «reference browsers» are marked with an R in the table below. What results were you given there? The problem may be on some of them (IE?) not supporting those ECDHE_RSA_* ciphers.


2

Mylar requires using Meteor. Because of the separation of data and format in the Meteor framework, it can actually sign the application template. In a normal web app the browser receives the concatenation of the data and the presentation as one element; in a dynamic web app you can not sign the page because you don't know what the output will be at run time. ...


1

First, do not bake the key into the binary. As Xander noted, a HSM is designed for this purpose such that a key is only accessible to the application and is not on the system. You may be able to setup a bastion host you locked down on a separate management network to serve this purpose instead, which is a little less secure. The next level would be to at ...


1

I found the answer. Turns out what I asked for is called a Message Authentication Code or MAC. There are various implementations for it, based on hash functions as well as block ciphers. HMAC is using hash(key || hash(key || message)) pattern with some additional padding.


0

I suspect this is what you're looking for. It uses luks encrypted volume which is widely supported and store the password/key within the TPM (NVRAM). The key can be sealed (Trusted Computing terminology) against the proper boot sequence (BIOS, PCI ROMs, MBR, Boot Loader, etc). In other words, the key is derived from the running environment. If something ...


0

The best possible scheme would be having that one encryption key for every user, similar to an authorization code given out for Microsoft products. The only difference would be that every single program you give out would have to have a different encryption key embedded into it. That would be the only way to somewhat secure the encrypted data. Either way ...


1

The location of the database is /var/lib/mlocate/mlocate.db or at /var/cache/locate/locatedb. This is outside your home folder. Probably you decrypted your homefolder prior to running the command and the results got saved in a non-encrypted folder.


0

This is a broad topic. First, for local storage of sensitive data, iOS offers Keychain Services. In a nutshell, Keychain is an encrypted database and iOS ensures that no app can access other apps' Keychain items (that is, if device is not jailbroken). For protecting data in transit iOS offers SecureTransport Framework, although you are unlikely to use it ...


-2

Databases are specially bad for this. If the data is so critic, you shouldn't be storing the info in a DB. Save a crypted blob and decrypt client-side (gpg maybe?)


1

If you want to protect against a key or other secret being exposed as the result of a system compromise, you would look to a HSM to perform cryptographic activities. Since the HSM is essentially its own little computer, the HSM would then have to be compromised, which is much more difficult. You may also use a distributed or n-tier architecture between the ...


1

In order to make a live database that encrypts its data, the database itself would have to have access to the keys. By that token, any admin could su into the account and find them. Your concerns are valid. Your idea of having the user present a secure key (RSA for example) if you have them do it over an SSH or SSL protected connection is not a bad idea. ...


1

The key to security is understanding attack vectors. Who is trying to get access to your data? It's a fundamental theorem that you can't ungive information. If a client has received data from your server, that can't be undone. Cryptography just makes sure that the right client receives information. In particular, "the app itself" is not something which you ...


2

Install a program like PGP, and save your public and private keys to your hard drive - specifically in your own login account. Encrypt the drive. When you try to decrypt it, it will require your private key. Don't copy the keys to any other source. Many dual-key encryption methods are good for this purpose. For the PGP example, there are whole disk ...


2

The first thing you should do is to ensure that all communication between your app and the server uses HTTPS rather than HTTP. This should protect you from casual packet inspection. To make this setup more secure, you may also consider using certificate pinning to prevent any man-in-the middle attacks involving a forged certificate for your site. If you are ...


0

My two cents: The write-up focuses too much on physical security and not enough on hacking. I would worry more about exploits in the browser and email application, mitigating those by using a more secure browser (cough), sandboxes, and virtual machines.


0

if they're going to the trouble of tampering with hardware, they could just as easily install a hardware keylogger under your keyboard. Lock the laptop in a case when it's out of your sight. I always do this in hotels, because it helps prevent theft too. I also suggest investing in a decent Kensington lock, which can be attached around pipes and various ...


1

No, new versions of TLS have not removed cipher suites defined in older versions.1 Which version of TLS you use and which cipher suite you use are two linked but separate matters (you can't always use a new cipher suite in an old TLS version). OpenSSL is just listing which version the cipher suites were first added in. The PRF is mostly used for key ...


2

Depends....easy way is to simply ask the I.T. department: You: hi, I'm curious if our IM chats and emails are backed up or stored for compliance reasons. If I need to recover a chat from google hangouts for legal reasons, is it possible? I worked in finance where 100% of all communication was recorded in our office as per government regulations including ...


1

I think it is fair to consider the message digest to be a random string because it's a hash of something that you don't choose (the person sending you the message chooses it). So you have a random, known plain text (the digest), and it's encrypted version with a private key (the signature). Note that assuming that the signature is authentic, having the ...


2

Does using a public-key encryption algorithm in a digital signature scheme enable any additional types of attack? Yes. Using PKE for a digital signature has additional attacks; e.g., if you are using an RSA signature there are collision attacks on the hash function where if you can construct two messages m and m' that both have the same hash (H(m) = ...


7

If your company has a product named "Google Vault" installed then yes your IT department, or anyone granted access to Vault, can read your unencrypted Hangouts messages and pictures. Google Vault is an eDiscovery platform - https://support.google.com/vault/answer/2462365?hl=en The only way they would not be able to read your Hangouts messages is if you ...


10

While it's certainly possible, the more applicable question is "how likely is it that my IT department cares?" (Unless you're doing something that could get you fired or arrested, naturally.) In addition to that, the other consideration is that it costs a lot of money to actually store everyone's web traffic, so the content of messages and web requests is ...


1

Forward Secrecy The key used to protect transmission of data must not be used to derive any additional keys, and if the key used to protect transmission of data is derived from some other keying material, then that material must not be used to derive any more keys. In this way, compromise of a single key permits access only to data protected by that ...


3

Yes - you really should assume that anyone can read anything you do online anywhere, anytime. If they own the network then doubly so. If they own the computer you're using, triply-so-with-knobs-on. From another angle, if you are doing stuff on the work computer or in the work environment that you don't want work to know about, you probably shouldn't be ...


1

Each session means each SSL session. An SSL session can be reused over multiple TCP connections (that is SSL connections) if both client and server implement session reuse and each of the SSL connections gets closed in a clean way. A SSL connection might also consist of multiple SSL sessions if you do multiple full SSL handshakes within the same connection. ...


18

Yes if your Google Hangouts data has synced onto your work computer the IT department could view it. However don't freak out yet, unless they are looking for it, it's extremely unlikely that they will see it. There are three places that the IT Department could see it: In Transit When syncing your hangout data if your IT Department monitors traffic over ...


86

You should assume that they can. There are various ways they can do it, but whether they actually do it depends on company's standards and practices. Some of the options: It's possible to install additional root certificates on company's machines and use that to MITM all the traffic (traffic goes through company's gateway/proxy anyway, and having friendly ...


2

Pre-Snowden, I would have dismissed this question as being in the "tinfoil hat" category. Unfortunately, the NSA's pervasive misconduct (not to mention that of its "Five Eyes" junior partners, e.g. GCHQ, CSIS, and whatever the Australian and N.Z spook agencies are calling themselves these days), does indeed raise a troubling question. The specific ...


1

Modern versions of WinZIP and WinRAR employ fairly slow key derivation in order to combat password guessing attacks. In particular, WinRAR uses scheme where number of effective SHA-1 iterations depends on length of the password (longer passwords yield more iterations), and WinZIP uses PBKDF2-based function, IIRC. "Fairly slow" is not a precise metric. For ...


1

It's a different scheme. Generally it is accepted that when using a password hashing algorithm, which is intended to be very slow, is acceptable. What KeePass is doing is very similar to what most hashing algorithms do, namely slowing down hash calculation. Their way is not a standard way. Most password hashing algorithms, such as PBKDF2, scrypt and bcrypt ...


1

The last resort attack in this case is the way some of the early BluRay keys were obtained, that is burning away the outer layers of the chip with HF and reading off the crypto key from the chip itself.


2

There's too few information here. Not knowing the full challenge, it's very hard to suggest what they expected you to do. Maybe you were supposed to notice the encryption method and break it, perhaps the key was given somewhere else, you may even be expected to break or guess it (eg. if it was 1234). I suggest you wait for a summary of the challenge by ...


2

Unless it is an insecure cipher, you won't be able to know which algorithm was used. That's what confusion/diffusion is all about. From my experience with such challenges, I'd say you're missing something. Maybe there's a key somewhere, maybe you get your hands on some source code, etc.


0

They use AES in IGE mode not in ECB-mode. But nevertheless it shouldn't be 'ok' for normal users and better than no block chipher mode. Data is encrypted with a 256-bit key, aes_key, and a 256-bit initialization vector, aes-iv, using AES-256 encryption with infinite garble extension (IGE) by Telegram (https://core.telegram.org/api/end-to-end, visited: ...


18

No. This is known as a known-plaintext attack (or a chosen-plaintext attack if you are not only aware of but can select the plaintexts), and is a type of attack that AES is highly resistant to: there are no known attacks of either type that are faster than brute force. If you've got access to the encryption coprocessor (and a good electronics lab), you may ...


1

At the moment, the only drawback is compatibility. But if that's not an issue for you then you're golden.


2

We don't use English for "network communication," we use network protocols. The things people say in natural language are usually much less interesting than the things computers say to each other. LFA depends on the definition of a "letter." In English and ASCII (or more likely UTF-8) encoding, this corresponds to one byte. To do this kind of analysis, ...


1

I feel the question which you ask in the title is not complete. In your post you ask why we use English if we can use letter frequencies to decipher codes (encrypted text). The reason is because we, humans, can understand it more easily and because it's not a huge issue. Protocols designed for speed are binary to avoid overhead (e.g. SPDY), but when HTTP ...


1

Very often we don't use straight English. We do run compression algorithms on the data. If you look at the OpenPGP documentation it suggest compressing messages before encrypting them. Compression algorithms remove the redundancy.


0

Look up SLP server, a former Microsoft product. It handles the obfuscation, encryption, and limited use (and reporting) you're looking for.


1

Authentication is about reliably recognizing who is at the other end. Since, from the server, you "see" the client only through network packets, and since everybody can buy the same kind of hardware, you may hope to properly authenticate a specific client only if that client is able to compute things that other systems would not. This implies that the client ...


2

@thomas-pornin and @PwdRsch have explained what an HSM can do, but you've clarified that you want to know what they're used for in payment processing. The short version is - they are used to strengthen the encryption protections that processors use. Let's assume you mean credit card processors. The PCI HSM Security Requirements suggests a number of places ...


1

A HSM is like a big smart card. It will store cryptographic keys and perform cryptographic operations on behalf of some external system; however, it is designed to never allow extraction of the private keys that it contains, even if the attacker has physical access to the machine. The actual security gain of a HSM is not as big as is usually assumed. An ...


1

A hardware security module (HSM) is essentially a trusted computer that manages encryption keys (or signing keys) outside of the normal server operating system. It doesn't provide the key to the server, rather the server hands an encrypted blob to the HSM and the HSM provides back the plaintext results, and vice versa. The main reason HSMs are used in this ...


2

What about EncFS? It is file based encryption tool. Also has port for Windows. There are few simple steps: Create an encrypted directory in Dropbox folder (or select whole Dropbox folder) with encfs Mount that directory to another place (eg. next to the Dropbox folder) Add a file to mounted directory Encfs automatically encrypts the file and Dropbox ...


5

There is tool by Stefan Küng called CryptSync that does almost exactly what you are describing there. You can find it here. The developer is the same trusted developer who created the hugely popular SVN client "TortoiseSVN" and many other tools, so I would have no problem trusting it. I think the tool uses the 7z implementation of AES encryption. From what ...



Top 50 recent answers are included