0

We are working on a school project that handles sensitive information (a password manager) that transit between a client which encrypt the data and a server which knows nothing about the data. In order to get the data, the client needs to authenticate through a username/password then gets a randomly generated token.

It will be a self hosted app, and our goal is to have something secure even if the user do not bother use HTTPS. So we want to make sure that if someone snooped the token, he would not be able to use it.

We thought that we could use a signed message through OpenPGP but this means that every message needs to be different, and older data need to be stored server-side so that replay attack can't be used.

This idea is clearly not the best. Does anyone have a better one?

Improve this question
3
  • 1
    You could maybe just do everything to make snooping the token as hard as possible. If you would use SSL with Certificate Pinning on the client side, you could assume that snooping is not possible if the attacker does not own the client.
    – Eknoes
    Commented Feb 19, 2018 at 13:27
  • Is there a reason that you don't trust SSL? Or are you assuming that the token is stolen in some other manner? If so, how?
    – Neil Smithline
    Commented Feb 19, 2018 at 21:03
  • We are working on a self hosted app, our goal is to have something secure even if the user do not bother use https. Another idea we had is to store in each message sent a counter of the amount of request so that the server only stores a number and the message signing would ensure the integrity. Would that be a reliable solution ?
    – Nathan J
    Commented Feb 21, 2018 at 12:48

2 Answers 2

Reset to default
1

TLS is designed to protect data in transport. I would recommend you to use it, since you are unlikely to come up with a better alternative on your own. Force all users (end users as well as self hosters) to use TLS, and never allow e.g. plain HTTP.

As a general rule, you should never try to implement "secure communication without TLS". Many have tried, few have succeeded.

Improve this answer
0
0

To do that, you can use an algorithm that uses also the MAC address of your computer to create the token, so if someone discovers the method to break your token, they will also need your MAC address.

Improve this answer
1
  • 1
    if the token can be snooped, then the MAC can be snooped, at least on one part of the transmission
    – schroeder ♦
    Commented Mar 5, 2018 at 15:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .