New answers tagged

2

This is vulnerable to a MITM. All Eve has to do is sit in the middle and forward traffic from C1 to S1, and from S1 to C1. This entire handshake could occur, and Eve could still be communicating with S1.


2

Edit: Clarified based on use case First off, no system is perfect. Engineering is the art of making the best tradeoffs. For backend-to-backend APIs (e.g. your server app and 3rd party API service) - API keys are really good. Most issues with API keys comes from developers neglecting how they store them (in code => commit to github public repos etc). API ...


0

I'm not aware of any standard, but it's quite common to create QR codes with the OPENPGP4FPR scheme containing the OpenPGP fingerprint of your key (and not the whole pubkey itself which can be simply retrieved from the keyservers). More information about how to create such a QR code can be found in this Stackexchange answer.


4

It would be easy to sniff data using tools like WireShark from someone who can access the data path between your client and the server. This isn't something anyone on the Internet could do per se but if your device uses wireless and there are people nearby they could grab this data if they wanted it. As for finding your UDP service on-line that is easy to ...


1

The list of open TLS 1.3 issues may give you some ideas. For example: Should SNI be encrypted to hide the server name to passive attackers? The issue states that this will complicate the handshake. Why is this the case? Maybe you can research the best way to implement this. Can the server request a proof of work from the client to prevent DoS attacks? ...



Top 50 recent answers are included