Tag Info

New answers tagged

1

Assuming that you have the email for the user and some server side secret you can do the following: Create a token which contains the file for download and is encrypted with the server side secret, i.e only the server itself can decode the token. Look at JWT tokens for an example. To make sure that the same file does not result in the same token you might ...


1

Security needs to be balanced with usability. Encrypting the file with the email address ads only a tiny amount of additional security, and adds complexity for end users. Locking out the user for 2 weeks after a mere 10 bad attempts is also overkill. I could easily see someone in a company trying 10 times and being unsuccessful and causing you and them ...


1

Ideally you'd encrypt the file you want to share with a symmetric key, sign the encrypted file with your private key, then publish the encrypted file in a public place (a publicly accessible web server would work). Then when you want to send someone the file, you'd encrypt the encrypted file's symmetric key with the public key of the user you want to send ...


0

Yes, you are right, all it does is it moves the issue to another place. There are several ways to protect the password of the Keystore using PBKDF2. Using a password that is needed at start up of the application server(as you mention). Composing the password of PBKDF2 out of 'things' you know about your deployment environment; for example: concatenating ...


0

AES is a block cipher, meaning that the core operation processes only a block (of exactly 16 bytes with AES). When you want to "encrypt a file", you need to decide on how you split and shuffle your data, and what you actually send to the AES engine; this is called a mode of operation. All modes of operations are not equal. Moreover, some modes also offer ...


2

According to NIST, The AES algorithm is capable of using cryptographic keys of 128, 192, and 256 bits to encrypt and decrypt data in block sizes of 128 bits (16 bytes). it means each block that goes as an input to the AES algorithm will be 16 bytes, so if your BUF_SIZE is 16 KB, when it wants to go to the AES, again it will be split to a blocks with 16 bytes ...


1

This is a generic vulnerability, for example Insecure Temporary File - OWASP . You ask if this is "a major exploitable risk or a minor security risk". That is the wrong question -- a vulnerability is not a risk. For example, using the Internet Security Glossary a risk is "An expectation of loss expressed as the probability that a particular threat will ...


2

For USB, SDcard, and other one-off external filesystems, I typically prefer using GPG in symmetric (-c ) mode. The GnuPG code is well designed for this purpose. For Operating systems, in particular Windows, Linux/BSD, and OS X -- I am very careful to use a SED instead of (or in addition to) software-based filesystems and secure-boot protections. Mobile ...


3

There's plenty of apps out there to [...] figure out the password. Well, yeah, those are dictionary attacks. It doesn't matter if you're using AES-256 or FOOBAR-1024, if you choose a weak password it can be broken easily. The only thing that helps slightly against dictionary attacks is using an expensive key derivation function. From a comment on the ...


1

ESecureDOX provides just about exactly what you're looking for. It's a cloud storage system run by a digital certificate authority, which means that each user is assigned a free digital certificate and PKI key set when they sign up, and each document is automatically encrypted by the storage system when you upload it to the cloud. Your document can only be ...


4

It depends what you're worried about, and what you are really trying to protect. If each of these slices is individually important (say a 1 MB list of credit cards), then you're basically just encrypting each chunk by itself. The total strength of protection for each chunk is just the size of the key you used for that chunk (modulo strength/weakness of the ...


0

You would do it the same way you'd do it on a computer, but once the machine is compromised, all bets are off, and you're mostly wasting your time. You may check out this related question on which my answer suggests deriving a key from the hardware and using it to encrypt the sensitive data but even then, that only buys you more time until the attacker ...


-2

I have read a post which clearly stated that Whatsapp messages can be easily retained. Whatsapp is not a secured messaging App. Follow these steps to secure your ‪WhatsApp‬ from getting hacked: WhatsApp doesn’t have a very secure server, so avoid using WhatsApp when on Wi-Fi. Never share your IMEI number Avoid keeping your phone out at places where it can ...



Top 50 recent answers are included