3,686 reputation
1419
bio website
location
age
visits member for 2 years, 1 month
seen 2 days ago

Jul
16
answered How to protect against “padding oracle attacks.”
Jul
11
revised How to secure database table of users for an application?
added 1 characters in body
Jul
11
comment Encrypted files storage. How to simplify the password management scheme?
Just don't get caught up in the new sweetness and use sCrypt for sCrypt's sake. Lots of amateur cryptographers, myself included, fall into the trap of overestimating the sophistication level of the average attacker by several orders of magnitude. Unless you're designing enterprise-level security to be used by large public corporations or government agencies with a lot of very valuable data to hide, the profile of your attacker is a twenty-something script kiddie with a GPU cracker looking for low-hanging fruit.
Jul
11
comment Encrypted files storage. How to simplify the password management scheme?
sCrypt should be fine on its own; its computation is both EXPTIME and EXPSPACE when both are plentiful, and to use constant space requires exponentially more time. Most implementations generate a 512-bit digest; XOR-fold that into a 256-bit AES key, generate a random IV, and you'll have a scheme I'd trust (if properly implemented; use an authenticated mode for AES, watch out for possible oracle or timing attacks, and keep all sensitive data as volatile as feasible).
Jul
10
answered Is a self-signed SSL certificate much better than nothing?
Jul
10
revised Is it possible to prove which public key was used to encrypt a message?
added 495 characters in body
Jul
10
revised Is it possible to prove which public key was used to encrypt a message?
added 495 characters in body
Jul
10
answered Is it possible to prove which public key was used to encrypt a message?
Jul
10
answered Encrypted files storage. How to simplify the password management scheme?
Jun
26
revised How to secure database table of users for an application?
added 75 characters in body
Jun
26
revised How to secure database table of users for an application?
added 75 characters in body
Jun
26
comment How to secure database table of users for an application?
This is one good solution and a general best practice, but it can be hard to implement in a mature application, especially when using an ORM or other "rich query" framework. There are other options as I cover in my answer.
Jun
26
revised How to secure database table of users for an application?
added 75 characters in body
Jun
26
answered How to secure database table of users for an application?
Jun
19
awarded  Popular Question
Jun
13
awarded  Nice Answer
Jun
13
revised Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?
added 450 characters in body
Jun
13
comment Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?
Companies that give a flip about IT security don't advertise a lot of the security measures they take. Why make it that much easier for an attacker to identify potential holes?
Jun
13
comment Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?
No. Either a key on the server and a key on the client can be used in the scheme I described, which is simpler than Adman's SSSS. The server never knows the password used to generate the key, nor the private key that can obtain it from the recovery key data it stores, but the user and the company have access to each. And the fact that the family has to present a death certificate is evidence in itself that the recovery mechanism has at least somewhat more process to it than storing the recovery key in a thumb drive in the top drawer.
Jun
12
revised Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?
added 56 characters in body