Skip to main content
Information Security

Return to Question

added 116 characters in body; edited tags; edited title
Source Link
Anders
Anders
  • 65.8k
  • 25
  • 185
  • 226

Safe "token" for authentication Securely transport secret token so it can not be used even if snooped?

We are working on a school project that handles sensitive information (a password manager) that transit between a client which encrypt the data and a server which knows nothing about the data. In order to get the data, the client needs to authenticate through a username/password then gets a randomly generated token.

WeIt will be a self hosted app, and our goal is to have something secure even if the user do not bother use HTTPS. So we want to make sure that if someone snooped the token, he would not be able to use it.

We thought that we could use a signed message through OpenPGP but this means that every message needs to be different, and older data need to be stored server-side so that replay attack can't be used.

This idea is clearly not the best. Does anyone have a better one?

Safe "token" for authentication

We are working on a school project that handles sensitive information (a password manager) that transit between a client which encrypt the data and a server which knows nothing about the data. In order to get the data, the client needs to authenticate through a username/password then gets a randomly generated token.

We want to make sure that if someone snooped the token, he would not be able to use it.

We thought that we could use a signed message through OpenPGP but this means that every message needs to be different, and older data need to be stored server-side so that replay attack can't be used.

This idea is clearly not the best. Does anyone have a better one?

Securely transport secret token so it can not be used even if snooped?

We are working on a school project that handles sensitive information (a password manager) that transit between a client which encrypt the data and a server which knows nothing about the data. In order to get the data, the client needs to authenticate through a username/password then gets a randomly generated token.

It will be a self hosted app, and our goal is to have something secure even if the user do not bother use HTTPS. So we want to make sure that if someone snooped the token, he would not be able to use it.

We thought that we could use a signed message through OpenPGP but this means that every message needs to be different, and older data need to be stored server-side so that replay attack can't be used.

This idea is clearly not the best. Does anyone have a better one?

deleted 1 character in body
Source Link
schroeder ♦
schroeder ♦
  • 132.1k
  • 55
  • 307
  • 348

We are working on a school project that uses reallyhandles sensitive informationsinformation (a password manager) that transit between a client which encrypt thosesthe data and a server which knowknows nothing about themthe data. In order to get thosethe data, the client needs to authenticate through a username/password then he gets a randomly generated token.

We want to make sure that if someone snooped the token, he would not even be able to use it.

We thought that we could use a signed message through OpenPGP but this meanmeans that every message needs to be different, and oldersolder data need to be stored server-side so that replay attack can't be used.

This idea is clearly not the best, do. Does anyone hashave a better one  ?

We are working on a school project that uses really sensitive informations (a password manager) that transit between a client which encrypt thoses and a server which know nothing about them. In order to get those data, the client needs to authenticate through a username/password then he gets a randomly generated token.

We want to make sure that if someone snooped the token, he would not even be able to use it.

We thought that we could use a signed message through OpenPGP but this mean that every message needs to be different, and olders need to be stored server-side so that replay attack can't be used.

This idea is clearly not the best, do anyone has a better one  ?

We are working on a school project that handles sensitive information (a password manager) that transit between a client which encrypt the data and a server which knows nothing about the data. In order to get the data, the client needs to authenticate through a username/password then gets a randomly generated token.

We want to make sure that if someone snooped the token, he would not be able to use it.

We thought that we could use a signed message through OpenPGP but this means that every message needs to be different, and older data need to be stored server-side so that replay attack can't be used.

This idea is clearly not the best. Does anyone have a better one?

Source Link
Nathan J
Nathan J
  • 1

Safe "token" for authentication

We are working on a school project that uses really sensitive informations (a password manager) that transit between a client which encrypt thoses and a server which know nothing about them. In order to get those data, the client needs to authenticate through a username/password then he gets a randomly generated token.

We want to make sure that if someone snooped the token, he would not even be able to use it.

We thought that we could use a signed message through OpenPGP but this mean that every message needs to be different, and olders need to be stored server-side so that replay attack can't be used.

This idea is clearly not the best, do anyone has a better one ?