Reputation
22,979
Next tag badge:
136/100 score
16/20 answers
Badges
3 43 106
Newest
 Good Answer
Impact
~1.4m people reached

Aug
26
answered HTTPS POST request header versus request body
Aug
26
comment HTTPS POST request header versus request body
This question doesn't seem to be asking about including API keys in the URL, but a HTTP request header versus in the request body (like how a POST form gets sent with parameter=value after the blank line between HTTP headers. Also if you are worried about random HTTP headers getting logged; note session cookies are sent in HTTP headers.
Aug
26
answered Best way to securely send passwords from an application to a user operated server
Aug
24
comment Encryption - should I be using RSA or AES?
You can check for every message with a value of 0 to N-1, we have the identity (m^e % N)^d % N == m for both either key pair. Now let's try a short message m = 11 with your scheme. We encrypt with A's private key and get 2707. The next step is problematic as 2707 is greater than B's N. A doesn't notice this and encrypts this value with B's public key to get 1272. A sends 1272 over to B, who decrypts it with his private key to gets 780 which is decrypted with A's public key to get m' = 1607 which is not 11 (however this scheme will work with say m=12, m=13).
Aug
24
comment Encryption - should I be using RSA or AES?
The system OP describes asks to support "plaintext with potentially unlimited length". Textbook RSA doesn't do that or have a scheme for how to securely split up messages that are larger than the key's modulus; because in practice you always do hybrid RSA as its quicker and safer. Quick example why your method of double encryption won't work with very small RSA keys (6-bit primes for 12-bit RSA) to keep it simple using textbook RSA. A's public key is: (N=3127, e=3) and A's private key is (N=3127, d=2011). B's public key (N=1927, e=3) and B's private key (N=1927, d=1227).
Aug
20
comment Encryption - should I be using RSA or AES?
(2) Textbook RSA ( c = m^e mod N and m = c^d mod N) has shortfalls and vulnerabilities when directly encrypting messages. Therefore you should use hybrid encryption -- encrypt the message with symmetric encryption (e.g., AES) with a new random key and then append the encrypted AES random key using the recipient's public RSA key to encrypt with some sort secure padding scheme like OAEP. (I almost didn't like your AES trickier comment - but if Alice and Bob are only people with a shared sym. key they have same guarantees).
Aug
20
comment Encryption - should I be using RSA or AES?
I wasn't the downvoter, but am guessing it was for either: (1) Calling signing "encrypt [the message] with Alice's private key" and verifying by "decrypting [the message] with a public key" and acting like there is one encrypted message. For signing messages you first cryptographically hash the message then encrypt the hash of the message with your private key. For verifying message you decrypt the hash with the other's public key and compare against the hash of the decrypted message. You hash first as RSA can only act on messages smaller than N; RSA-2048 can only encrypt 256 bytes.
Aug
14
awarded  Good Answer
Jul
25
awarded  Constituent
Jul
22
comment Token-based authentication - what's a good token length?
Meanwhile if your application has say 10 million session tokens in existence, and some botnet attacks your application and manages to do a million requests per second, it would take ~21 days to find one of the 10 million existing session tokens. With a 128-bit session token, it would take more than 10 million times the age of the universe (10 million x 13.7 billion years) to find one of the 10 million session tokens. And with 128-bit, you don't run into collision problems until you have about 2^64 tokens out there which is about 2 billion tokens for every human on earth).
Jul
22
comment Token-based authentication - what's a good token length?
The reason 64-bit is insufficient is that you often don't need to find a specific session token and your system may have millions or billions of session tokens. The chance of session tokens natually colliding among users happens at 2^32~4 billion tokens (see birthday problem ). This could be problematic; and it is not unreasonable to expect very large web applications (or attacked web applications) to eventually generate 4+ billion session tokens.
Jul
21
awarded  Guru
Jul
20
awarded  Caucus
Jul
8
revised Is my ISP trying to impersonate google?
Make image visible instead of dropbox link.
Jun
30
revised is it easier to eavesdrop on ethernet connection rather than wifi?
Crossed out admitted mistaken idea in case someone doesn't read comments.
Jun
30
comment is it easier to eavesdrop on ethernet connection rather than wifi?
This is simply false. WPA and WPA2 (and even WEP, though WEP is broken and should not be used) encrypts the radio transmissions between your laptop/mobile device and the wifi access point.
Jun
24
awarded  Nice Answer
Jun
19
awarded  Notable Question
Jun
5
revised Can a wifi provider decrypt HTTPS usind MITM without users noticing?
added 8 characters in body
Jun
5
answered Can a wifi provider decrypt HTTPS usind MITM without users noticing?