Reputation
Top tag
Next privilege 125 Rep.
Vote down
Badges
5
Newest
 Scholar
Impact
~62 people reached

  • 0 posts edited
  • 0 helpful flags
  • 21 votes cast
2d
comment Can I safely and securely store hash(sessionId) in application logs?
and one last note, our session ids are actually 36 chars long.
2d
comment Can I safely and securely store hash(sessionId) in application logs?
and Java's UUID predictability is discussed here, and sounds fine by my estimation for this use case.
2d
comment Can I safely and securely store hash(sessionId) in application logs?
and this article offers some great insight into entropy and data length for hashing too.
2d
awarded  Scholar
2d
accepted Can I safely and securely store hash(sessionId) in application logs?
2d
comment Can I safely and securely store hash(sessionId) in application logs?
Great point! Our session Ids are ~ 27 chars long and are a "type 4 (pseudo randomly generated) UUID. The UUID is generated using a cryptographically strong pseudo random number generator" docs.oracle.com/javase/7/docs/api/java/util/… So that's probably good, right?
2d
awarded  Editor
2d
revised Can I safely and securely store hash(sessionId) in application logs?
added note about considering adding GUID to session and tracking that instead
2d
comment Can I safely and securely store hash(sessionId) in application logs?
Yeah that's part of the reason i wonder if there's a reasonable middle ground here - secure and fast. I just know that logs can make there way off of a system is all, and then access might not have been required.
2d
awarded  Student
2d
asked Can I safely and securely store hash(sessionId) in application logs?
Sep
30
awarded  Autobiographer
Sep
30
awarded  Supporter