Tag Info

New answers tagged

5

Just use TLS, it's what it was meant for: securely send data between two parties across an untrusted channel. Should you want additional protection, there are two ways to solve this problem that spring to my mind: Use a password to encrypt the symmetric key Use a token such as an OTT through SMS or generated using a smartcard and external cardreader ...


0

For android phones, there is a credential storage that allows you to store keys. It runs as a system daemon and uses AES to encrypt the keys. The keys are tied to the UID of the app that created it so other rogue apps are unable to access these keys. For iOS, there is a similar keychain which serves a similar purpose. It is also encrypted and sandboxed so ...


1

Bob Brown has covered most of the salient points in his answer but I did want to point out that there is one significant disadvantage: Complexity. You are increasing the complexity of your application to some degree, lesser (in the case of adding a pepper to the hash where you need to think about key management as well as storage of password hashes and ...


4

First of all, every stored password should be hashed with a different pseudo-random salt. Second, SHA-256 is not appropriate for storing passwords; instead, you want to use a key stretching algorithm, as has already been mentioned. There is a lot more detail at Crackstation. An encrypted hash is also called a keyed hash, and the key is sometimes called a ...


3

Provided that you mean Hash first (BCrypt) and then encrypt the hash, security should not be weakened, yet you are not improving security either. Encryption is, by definition, a reversible scheme. Since there really is no use-case for which you would require the decryption in this case, encryption is the wrong tool for the job. If you are looking use a ...


-2

Encrypting the hash is in the first place just another hash function. With respect to potential collisions it is as good or bad as the original hash function (encryption is reversible by decryption and does not add more collisions). When you can keep the keys (both for encryption and decryption) secret, it adds security because a brute force attack on the ...


0

The checkbox in the screenshot refers to the Firefix Password Manager without Master Password, although it doesn't check and it works in both cases. I guess most of the time people use the password manager in Firefox without master password. They login to a site, Firefox offers to store the password, they agree, and that's it. This is the use case for most ...


1

In my opinion, Lastpass is referring to the Firefox password manager insecure when the user is not using master password for Firefox. Which won't be apples-to-apples comparison. Firefox uses 3DES for storing passwords and in case master password is not set, null ("") is used, which is insecure for sure. To read in detail about how Chrome, IE and Firefox ...


0

I wouldn't consider this a major security issue as the values are limited to only your system's access to the third party sites. It is less desirable, but the values can be easily invalidated without any bleeding in to other systems that access the same services. It certainly doesn't hurt, and is even wise, to encrypt it, but you would have to encrypt it ...


1

You should use DPAPI to encrypt the data before storing it in Isolated Storage. While DPAPI is mostly targeted at per-user security, not per-app, it does have some provisions for your scenario: A small drawback to using the logon password is that all applications running under the same user can access any protected data that they know about. Of ...


0

As AJ Henderson has mentioned, if you need to use keys in this manner than they should really be stored in an HSM. If you are simply storing the keys on a separate server then this does not provide much, if any, additional security. If one of your servers is compromised then you have to assume that your other servers could be compromised as well, and once ...


0

You should rework your entire system. It is inherently far less secure than it should be. There is no good reason that you should be storing encryption keys that could be used to impersonate your devices on your servers at all. Rather, you should be providing each device with a signed certificate (from one private CA that you can operate securely using CA ...


2

While Dropbox and Box do encrypt "data at rest", I couldn't find anywhere where it says that OneDrive does so too--this part is surprising. However, it's not surprising that most cloud providers (e.g. Dropbox, Box, OneDrive, Copy.com) don't provide client side security. OneDrive does scan your files--in order to be able to do so, your files cannot be under ...


4

It is not unusual for cloud providers to have a system in place where they can access their customer's data, because there are all sorts of useful things they can't do without looking at the data. They can't index it, they can't de-duplicate it, they can't compress it, they can't scan it for illegal content, and most important of all, they can't restore it ...


4

It is a futile thing to do as explained well by Tom Leek, but luckily it also isn't necessary. The idea of overwriting several times is very old, the intent being that there remains a residue when overwriting data on a magnetic medium. Overwriting several times would (should) make lab recovery harder or impossible. All modern drives, including magnetic ...


18

Overwriting the data is either insufficient or useless, depending on how things are done internally by the device itself. Flash memory has a limited life, expressed in terms of read/write cycles. To sum it up, you can have one block of data full of zeros; bits can be changed from zero to one individually, but the reset to zero can be done only for a complete ...


5

It's to remove any trace of the previous memory. Not an expert but here is what I understand. Memory is stored in binary format : 0 and 1. So you can see your memory as a big array of 0 and 1 that we will call bits. Bits are not exactly 0 and 1, maybe 0.01 or 0.99 for example. If a bit was 1 and you rewrite it to 0, it might be 0.02. On the other hand if a ...



Top 50 recent answers are included