Linked Questions

15
votes
2answers
2k views

How to use AWS KMS securely?

I am investigating using AWS KMS (Amazon Web Services Key Management Service) to decrypt an encrypted symmetric key (i.e: envelope encryption). However, to use the KMS, I need to pass it my amazon ...
0
votes
2answers
102 views

Is it necessary to encrypt messages client side if using HTTPS?

I am creating a messaging service for an app I'm developing and right now the data flow is as follows: Send: message sent to server => message encrypted based on user's public key and signed using ...
3
votes
1answer
5k views

Need advices on API key & secret generation?

While working on a Java project using Spring-boot, Spring-security and JWT token, I need to provide access via API key and secret. After searching on Google for a while about key/secret generation, ...
8
votes
5answers
9k views

Where do I securely store application-specific symmetric key?

I am writing an application App1. This application uses SQLite database and I plan to encrypt it using AES256. For symmetric encryption I need a key, which I need to store somewhere. From a similar ...
1
vote
1answer
144 views

How background services perform token based Api Authentication?

I am implementing JWT token based authentication for our WebAPI in order to restrict data access through the API (e.g. client sends username / password and the api provides a jwt token valid for x ...
29
votes
2answers
24k views

How should an application store its credentials

Context When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, ...
1
vote
0answers
33 views

Securing data tokens [duplicate]

What is the proper way to save and access database and API credentials in my node js application? Currently I use a dotenv package and store them in a .env file. I am not uploading my code to github ...
1
vote
3answers
188 views

How strong should a database password be?

Seems like a trivial question, but I couldn't find other questions that address the following. So I'm simply asking, how strong would my (super user) database credentials ideally be? I simply figured ...
1
vote
1answer
121 views

How to store encrypted confidential user information in the database, which will need to be decrypted at runtime? [duplicate]

This Question has been reposted from StackOverflow according to the suggestion given in comments I am creating an application where I need to store client's information(Like their API Keys and API ...
0
votes
1answer
2k views

Php two-way encryption to mysql database [duplicate]

I would like to learn / know how other companies deal with the problem of storing the encryption keys. I want to encrypt the user's email address (and other sensitive information) but (because I want ...
0
votes
2answers
882 views

How secure is encrypting & decrypting strings with OpenSSL? [closed]

I am wondering how secure it is to encrypt and decrypt strings using OpenSSL using Salts and an Initialisation Vector. If the salt and initialisation vector are both going to be stored in a database ...
1
vote
1answer
248 views

which places are used to store the the encryption key? [duplicate]

So i have an encryption key which i will use to encrypt data or sign data with it. But in order make it possible to ensure the data integrity, i have to keep the key secret. So i thought of spliting ...
0
votes
2answers
2k views

How to store an AES Key? an Initialization Vector(IV)?

I'm currently developing an authentication service for our company. I somehow understand how to store a salt used in hashing a password in that it should be stored together with the hashed password. ...
2
votes
0answers
31 views

Which is better for storing private key in .NET - Windows application secure registry or encrypted configuration? [duplicate]

We are building an integration with a third party. We have decided to share a private key with the 3rd party app. What will be the best strategy to allow access for the key? Should the key be saved in ...
1
vote
0answers
43 views

Encrypt content on Azure without using KeyVault? [duplicate]

Need to store some content in Azure Blob Storage, and want to encrypt prior to storing it on Azure Blob (we don't want to rely on Azure storage encryption on-rest). The issue is we do not want to ...
1
vote
1answer
89 views

How to use encrypted internal strings and config? [duplicate]

I was reading the CIA leaked documents on wikileaks, I saw in their "best practices" section that it was advised to encrypt all strings and config information and to de-crypt in memory when needed. ...
1
vote
1answer
137 views

Alternative to storing passwords when dealing with integrations that only allow username/password authentication? [duplicate]

I'm working on an integration with an external service that requires per-user authentication, like Facebook for example, but unlike Facebook only allows username+password for this authentication. My ...
2
votes
1answer
90 views

Keeping software signing keys secure

I am creating an application that will automatically sign code with secure keys (.key). The app will run on Windows environment developed in .NET environment (C#). Signing is simple: source code + ...
1
vote
2answers
149 views

What is the Best Method to Store SQL Host, Username and Password for Multiple Databases?

I have a large project which has multiple web servers (one for each client), one application (for all clients), and multiple SQL databases (one for each client) as pictured below. . For security ...
52
votes
5answers
48k views

Standards for encrypting passwords in configuration files?

My workplace has a standard that plaintext passwords are not allowed in application configuration files. This makes enough sense on its face, in case someone gets access to the config files they don'...
1
vote
1answer
918 views

Is it secured to store the encrypted key in the database (encrypted by other cipher)?

I want to improve the encryption flow used by my application. Today I use the AES cipher while its key and its IvBuffer are hardcoded in the code. I know it is not secured and I want to improve this. ...
0
votes
2answers
2k views

How can I safely store a password in a .class file?

I have some .java files containing some password variables, and these variables have values: String password = "xyz"; Now after run, when I open the .class file, it contains those passwords. How can ...
5
votes
2answers
986 views

How to make Automated API calls which are at least minimally secure? [duplicate]

How do I go about writing scripts (for automation) in Powershell (and possibly even Python) that help me access APIs while keeping the credentialing information either secure IN the script and/or ...
1
vote
1answer
1k views

Storing data encryption key in the DB. Safe or not?

I'm currently taking over a service and while looking through the DB, I noticed that we encrypt some of our data using a function in the DB where the encryption key is hardcoded in the DB function. ...
0
votes
1answer
144 views

Storing passwords for personal app [duplicate]

I am currently writing a script on a raspberryPi (in python) to automate some tasks in online accounts. While some of these online accounts have nice APIs I can use, others do not and I have to resort ...
3
votes
4answers
2k views

Where to store a key for system wide encryption/decryption?

I have a web application where (among other things) customers can upload files and administrators can then download those files. The uploaded files are stored on ServerA and the web application used ...
2
votes
2answers
319 views

Using a hash in place of user data

I'm storing client data and they are sensitive about privacy and security of the data. In some cases, I don't need the actual data, but could work with a hash of the data. For example, in the case of ...
1
vote
0answers
155 views

How do I securely encrypt and store database encryption keys? [duplicate]

I have a database with encrypted information, and want to encrypt each entry with a different key. Then I want to store the encrypted keys in another database. I know I have to encrypt the keys before ...
3
votes
2answers
2k views

How to store an encryption key on shared hosting?

I am designing a simple online patient management system that is running on shared hosting. According to national regulation sensitive data should be encrypted when used online, so I have encrypted ...
1
vote
1answer
212 views

what is the best way to know if the entered decryption key is correct?

I was searching for a way to store the encryption key of AES_ENCRYPT and found a good answer here: Where to store a key for encryption? However, now I am trying to use "Type in the encryption key ...

15 30 50 per page