67 reputation
5
bio website
location
age
visits member for 2 years, 3 months
seen Nov 17 at 12:48

Oct
20
comment Using HMAC when sending data through an untrusted server
Let us continue this discussion in chat‌​.
Oct
20
comment Using HMAC when sending data through an untrusted server
I see, I don't think that would be suitable for the pop up then as the user isn't going to use the same machine, browser etc each time and I can't see that the user would move it from place to place. However, that sounds like it would be great for a Android/ios app. Thank you.
Oct
19
awarded  Commentator
Oct
19
comment Using HMAC when sending data through an untrusted server
@atk I am happy to use digital signatures if that is an option, but doesn't it need a certificate? Wouldn't it make it more complicated than using a PIN? I didn't 'choose' hmac, it was the only way I know.
Oct
19
revised Using HMAC when sending data through an untrusted server
It was not clear that FE didn't do the initial hashing. FE never sees the PIN unhashed.
Oct
19
comment Using HMAC when sending data through an untrusted server
Edited question to show preferable to see data and not have it encrypted.
Oct
19
accepted Is it any more secure to use a HTML form instead of a javascript popup?
Oct
19
revised Using HMAC when sending data through an untrusted server
added 88 characters in body
Oct
19
comment Using HMAC when sending data through an untrusted server
@atk Would you mind elaborating? AFAIK, digital signatures requires a certificate and that's not an option. Isn't the process pretty similar, but encrypts the data too? If so, that isn't an option as I would still like the FE to do some basic validation of the data before passing through.
Oct
19
asked Using HMAC when sending data through an untrusted server
Oct
18
comment Is it any more secure to use a HTML form instead of a javascript popup?
Thank you - it's what I thought (and was hoping). I only really mentioned HTTPS to keep mitm concerns out of the picture.
Oct
18
asked Is it any more secure to use a HTML form instead of a javascript popup?
Dec
16
comment How much security information to publicise?
The independent report is a very good idea, I may make that part of our process - an annual independent review. Thanks.
Dec
16
comment How much security information to publicise?
Yes, I'll definitely take that approach re PCI. Actually, we don't hold any credit cards, but we do hold bitcoin wallets so are voluntarily doing our PCI mainly for 'user confidence', actually looking at some of the PCI Approved Vendors gives me some bullet points ready to use. I will also bring in an independent auditor as per yours and Rorys suggestion (and to be honest, it would be a good idea anyway).
Dec
15
asked How much security information to publicise?
Oct
18
comment Additional security for WebRTC/DTLS-SRTP with PGP?
Great, thank you. In my case, PGP is known and shared prior so seems to be a good use case. Thank you for your assistance and understanding.
Oct
18
awarded  Supporter
Oct
18
accepted Additional security for WebRTC/DTLS-SRTP with PGP?
Oct
18
comment Additional security for WebRTC/DTLS-SRTP with PGP?
Thank you for your excellent answer. I have two follow ups... 1. Would a benefit of using PGP for authentication be that you can also verify the other ends identity? More trusted than self signed and arguably more trusted than CA signed now days (post lavabit). You may not know the person you are dealing with, but you know their public key is at least who you believe to be the person you are contacting. 2. Is there a downside to using PGP instead (in a closed environment where compatibility isn't required), the RFC appears to suggest no additional issues?
Oct
17
awarded  Editor