New answers tagged

1

can we use XOR enc to store data in the string itself to optimize the DB queries? Yes, but it will no longer be called a token, but rather a ticket (if using a symmetric encryption) or certificate (if using symmetric encryption). Like tokens, tickets and certificates are string used for authentication, but they actually contain encrypted and/or ...


6

Using os.urandom() is perfectly alright. It generates a cryptographically secure random stream of bytes. This would be impossible to guess for anyone. Using guid() is also pretty secure, although not totally random. Using XOR to encode parameters into your token is a bad idea. For one, it is vulnerable to bit flipping attacks. Even if the user can not ...


2

Using os.urandom() uses accepted cryptographically secure sources, so continue to use that if you can, otherwise there should be another way to access the same, or similarly secure random sources in the implementation you are using (php java). The most important thing is that it cannot be predictable, which means any sort of seeding done manually (for ...


0

The MRN (or patient id) itself in the URL is not a problem. athenahealth's REST-based APIs take patient ids directly in the URLs, and I'm guessing they have better lawyers than you do. The problem is if the URL itself, or use of your service in general would allow someone to imply something about the patient. For example, if you have URLs like ...



Top 50 recent answers are included