123 reputation
16
bio website letsgohomeapp.com
location United States
age 31
visits member for 2 years
seen Mar 28 at 2:01

I'm a software consultant in NY, specializing in iOS, WPF/.NET and Node.js.

I'm the author of Let's Go Home for iPhone (App Store link), a community for sharing home projects.

I am also the author of Forest Requirements for iPad (App Store link), an app to help you quickly produce professional requirements documents on your iPad.


Nov
11
awarded  Notable Question
Mar
25
awarded  Popular Question
Mar
23
comment Which approach to encrypting data on a per-user basis is more secure?
Effectively, yes, though the decryption would take place on the server before the content was sent back (e.g., to be rendered in a form on a webpage). What I'm trying to avoid is situations where an attacker, gaining access to the server, is able to decrypt at-rest user data.
Mar
23
revised Which approach to encrypting data on a per-user basis is more secure?
added 389 characters in body
Mar
22
revised Which approach to encrypting data on a per-user basis is more secure?
added 2 characters in body
Mar
22
asked Which approach to encrypting data on a per-user basis is more secure?
Jul
10
awarded  Scholar
Jul
10
accepted How is storing an API secret key in plaintext (in a database) secure?
Jul
8
comment How is storing an API secret key in plaintext (in a database) secure?
This makes sense; I can definitely understand what you mean here. Good point on swapping secret keys if you have access to the key store - didn't even think about that!
Jul
8
revised How is storing an API secret key in plaintext (in a database) secure?
added 84 characters in body
Jul
8
awarded  Student
Jul
7
comment How is storing an API secret key in plaintext (in a database) secure?
That's an interesting thought (encrypting with a one way derivative). I think that helps for displaying secret keys to user (via an admin page or something like that), but it seems like it wouldn't help for general usage of the API, since the user's password wouldn't be used for non-login REST requests.. though I suppose that could be done.
Jul
7
comment How is storing an API secret key in plaintext (in a database) secure?
Yes, I did. I still don't see how it's safe to store a secret key in plaintext in a database. If an attacker gets access to the database, it seems like it's game over, instantly. Am I mistaken on that?
Jul
7
awarded  Editor
Jul
7
revised How is storing an API secret key in plaintext (in a database) secure?
spelling
Jul
7
asked How is storing an API secret key in plaintext (in a database) secure?
Dec
13
awarded  Supporter
Nov
14
awarded  Autobiographer