Tag Info

New answers tagged

6

No, having keys for your root user does not impact your security profile. It is wise though to disable root login in ssh and NOT have an authorized_keys in your /root/.ssh/ folder. However. I got the feeling your going about this the wrong way. Personally, I would not use the root user in this manner (but a system user like www-data) and make several ...


0

These certificates are of very little value. First of all, allowing them to generate the private key is very questionable. We have no details on how they do this or whether they retain this information - for all we know, they use the same private key for all certs or retain the key information, which may not be done in a secure manner (imagine what a rich ...


2

First, about AES-256 in particular: AES-256 is a symmetric cryptosystem. Decryption and encryption use the same key; if you encrypt stuff with a master key, you have to give that master key to whatever's decrypting stuff or else it can't decrypt stuff. You may have read about master and session keys, but that is about stuff happening before AES encryption -- ...


1

The public and private key have the same size (with regards to security, the file size differs of course). It's identical to the size of the modulus when it is regarded as an unsigned integer (and the key size is a full number of bytes, i.e. a multiple of 8 - otherwise it is the location of the highest bit set to one). You are however showing a full X509 ...


0

The reality is if other processes can access your process memory or features of your virtual machine, the game is probably over as your already compromised. If a process has access at this level, it can probably gain other information, such as the initial credentials used to authenticate prior to obtaining the token or just modifying results to make token ...


0

My tought on this is that technically, theres no reason to require the sending party to have a key/certificate to send a encrypted message, but for security reasons, this is enforced because if the recipient then reply to this message, security cannot be ensured unless a public key or certificate is embedded in the message. This might be builtin the S/MIME ...


0

I would advise against it. Your web application should have a policy that passwords are only ever input, never output. I find that with following this approach, your application will be more secure in general. There is also a further problem of how to give the password to the user. Displaying the password on screen (either in an email or when they register) ...


3

That totally depends on your application and its requirements. If your applications needs to verify users' email addresses, then you can send them a randomly generated token (one-time use and valid for a limited time period) for the first-time login, on the email address that they provided during sign-up. And ask them to set their own password after they ...


0

If your generation method has enough length and good character set, it will be more secure than asking the user for password. The problem about this way which makes websites not to use it, is because auto-generated passwords are hard-to-remember and don't offer good user experience.



Top 50 recent answers are included