New answers tagged storage
In short: you can't. As long as someone has the local copy and the local copy is capable of retrieving this key, then someone could reverse engineer and get it. If someone had attempted to hide or obfuscate their code, then I would just step through the program in real-time or through IDA Pro. If at some point you store your key in a variable, then I'll ...
if your app is web based then you can use an ajax call to prevent your API Key from being displayed in the url, otherwise if it is a desktopp app you can store your API KEY in a file or a database, then retreive it when you need to make a call to your API
This scheme is not secure. Let me explain why. Salt One important condition for a password hashing scheme to be secure is that a unique random salt is used which is combined with the password before the hash is computed. A salt is required to hash equal passwords to different hashes. This protects from attacks where a rainbow table is used. Further, an ...
Yes. Encrypt the plain-text TOTP key on the application side and save the cipher-text into the database. If you cannot trust the application either, use a HSM (hardware security module) or create and use a software version of it.
I assume you are using Windows? If so, I'm wondering if the embedded SE algorithm is oblivious to the Windows Volume Shadow-copy Service (VSS). In other words, some Windows application sends a delete/erase command to SSD and the SSD firmware thinks it has deleted all the files, when in fact there are duplicates available, due to faulty windows originated ...
use some access control for your servers: instead of having some root account with one password,also each user have their login ID and access for the admin only. laptop hard drive data recovery
You may just need one more level of indirection: the individual's key gives access to a store with a secret key, but that key really points to another key. The first key is used to encrypt the second, and changes every time staff changes. The second changes much more slowly, and encrypts what you want kept safe. This was part of a plan for scalable and ...
As per comment, I think this covers a lot of the same ground as a previous question - sorry but you really don't want to store passwords like mint.com do. As per discussion elsewhere, there appears to be a discrepancy between what they assert and what they practice. And there's basic security stuff they still have not implemented on their site. Please aim ...
You can use a user-mode sandbox such as Sandboxie. Sandboxie intercepts API calls and only allows an application access to specific resources you define. NOTE: I'm not sure how dropbox is implemented. If it runs as a service it may not work. It's still worth a try though.
Create a new user. Give that user access rights to only the folders you want to share. You can use the File and Folder Permission options on Windows, and simple chmod on Linux. Run your application (Dropbox, for example) under that user. You can use runas on Windows, and sudo -u on Linux. Please note that you might have to allow access to other folders ...
Top 50 recent answers are included