Tag Info

New answers tagged

0

You should never display full readable credit card to anyone (includes authorized users). It is a bad security practice. If you do, then you'll need to implement even stronger access and monitoring controls in place to make sure the credentials for the authorized users are not compromised and hackers are not stealing away CC data. Better off simply ...


0

Based on Justin's answer, I'm constructing my own. If the tokens are long enough (in my case they are 200 alphanumeric ([A-Za-z0-9]) characters, there is no need to salt them. Hashing alone should then be enough, since the complexity is high enough. If tokens are not long enough to get away with hashing only (or if you want to insist on salting them as ...


1

If requests from the third party to the OAuth provider have some other data that associates the request to the user, for example the user's name or id, the server could store the bearer token like a regular password with individual salts. However, if the third party requests don't have a piece of identifiable information, the server could store a ...


0

There are several standard algorythm used for hashing passwords securely (PBKDF2, BCrypt, SCrypt. See this question for more details). As for using a library for this, you can do it but you need to take into consideration how the code has been audited. Well-known and maintained open source libraries can usually be used pretty safely.


1

You didn't provide too much details, so in general: One of the biggest risks in using cryptography is its inappropriate use, leading to several security vulnerabilities, eg. private key leak, known plaintext attack etc. Unless you're an cryptography expert (and you don't seem like one), it's generally wise to use APIs of the highest possible level, that ...


0

So it seems that BSD's GELI provides this - from the manpage: Can optionally perform data authentication (integrity verifica- tion) utilizing one of the following algorithms: HMAC/MD5, HMAC/SHA1, HMAC/RIPEMD160, HMAC/SHA256, HMAC/SHA384 or HMAC/SHA512.


1

Let me first gather your requirements and assumptions: Data storage appears in the system as a mountable disk All data on data storage is encrypted Synchronization with cloud is not needed frequently. Complete image upload/download is good enough With this assumptions any virtual disk solution with encryption of stored data can meet your requirements. ...



Top 50 recent answers are included