Hot answers tagged

5

The problem with this approach is that the same identity is used by every destination, so sites can swap notes to see where you've been and draw correlations that you may not want to expose. There are several ways to solve this issue, such as the one used in the FIDO U2F security key. In this case, the device contains a symmetric key (not an asymmetric key ...


4

No. People with vested interests and deep wallets have put countless man-hours into solving this problem, even when using specialized hardware, and it gets broken over and over. Some game systems used security chips (10NES, anyone?) which validated cartridges and refused to run the system if the signatures did not match. It did not work out too well. If you ...


3

If you are supplying the application that stores and retrieves the encrypted files for the user, here are a few ideas you may want to consider... 1) Rather than encrypting data at the cloud storage, consider encrypting the data files prior to storing in the cloud service. You can find numerous options for encryption libraries on GitHub. 2) Store the Keys ...


2

Using the same private key across separate domains is basically secure. If you authenticate to a system, you don't give away you private key, and that system cannot impersonate you. So you can use your key across work and personal systems, and a work system cannot then access your personal systems. However, there are often reasons to use different keys. For ...


1

Fundamentally, to trust a computer, you need to verify that it knows something that only the computer you're expecting knows. This is how all certificates work: you assume that because they signed something with a key that only they could possibly know then it's actually the person you wanted to talk to. The same applies for computers: the computer has to ...


1

It seems OK. Key Encrypting Key (KEK) is quite a confusing name. It puts emphasis on the fact that a particular key is used to encrypt another key (which in turn encrypts data), as if this bare fact somehow increased the security. It doesn't. The additional security comes from something else, and (by me) the name of this scheme should really be Separately ...


1

However in the case of a simple web app I don't see the benefit of using environment variables which can be configured in the portal. I have not used Azure Key Vault, but it appears that the client application never actually sees the master key: When a SaaS application needs to perform cryptographic operations by using their customers’ keys, Key ...


1

The file you're trying to import does not contain the actual private key, as indicated by this line in the output of gpg --list-packets: gnu-dummy S2K, algo: 3, SHA1 protection, hash: 2 The special "dummy" S2K algorithm is applied when GnuPG actually exported a secret key stub to still enable using secret subkeys, but having an offline primary key (on ...



Only top voted, non community-wiki answers of a minimum length are eligible