Linked Questions

1
vote
1answer
124 views

Is it secure to store a cryptographic key in a class member variable?

Consider an application that runs locally on a Windows PC. The application uses a local folder for reading/storing encrypted data (i.e. images). A user logs in (authenticated from a local encrypted DB)...
0
votes
2answers
157 views

Is it necessary to encrypt messages client side if using HTTPS?

I am creating a messaging service for an app I'm developing and right now the data flow is as follows: Send: message sent to server => message encrypted based on user's public key and signed using ...
3
votes
1answer
7k views

Need advices on API key & secret generation?

While working on a Java project using Spring-boot, Spring-security and JWT token, I need to provide access via API key and secret. After searching on Google for a while about key/secret generation, ...
1
vote
0answers
34 views

Securing data tokens [duplicate]

What is the proper way to save and access database and API credentials in my node js application? Currently I use a dotenv package and store them in a .env file. I am not uploading my code to github ...
1
vote
1answer
143 views

How to store encrypted confidential user information in the database, which will need to be decrypted at runtime? [duplicate]

This Question has been reposted from StackOverflow according to the suggestion given in comments I am creating an application where I need to store client's information(Like their API Keys and API ...
1
vote
3answers
214 views

How strong should a database password be?

Seems like a trivial question, but I couldn't find other questions that address the following. So I'm simply asking, how strong would my (super user) database credentials ideally be? I simply figured ...
1
vote
1answer
148 views

How background services perform token based Api Authentication?

I am implementing JWT token based authentication for our WebAPI in order to restrict data access through the API (e.g. client sends username / password and the api provides a jwt token valid for x ...
0
votes
1answer
2k views

Php two-way encryption to mysql database [duplicate]

I would like to learn / know how other companies deal with the problem of storing the encryption keys. I want to encrypt the user's email address (and other sensitive information) but (because I want ...
0
votes
2answers
958 views

How secure is encrypting & decrypting strings with OpenSSL? [closed]

I am wondering how secure it is to encrypt and decrypt strings using OpenSSL using Salts and an Initialisation Vector. If the salt and initialisation vector are both going to be stored in a database ...
1
vote
1answer
267 views

which places are used to store the the encryption key? [duplicate]

So i have an encryption key which i will use to encrypt data or sign data with it. But in order make it possible to ensure the data integrity, i have to keep the key secret. So i thought of spliting ...
2
votes
0answers
31 views

Which is better for storing private key in .NET - Windows application secure registry or encrypted configuration? [duplicate]

We are building an integration with a third party. We have decided to share a private key with the 3rd party app. What will be the best strategy to allow access for the key? Should the key be saved in ...
1
vote
0answers
45 views

Encrypt content on Azure without using KeyVault? [duplicate]

Need to store some content in Azure Blob Storage, and want to encrypt prior to storing it on Azure Blob (we don't want to rely on Azure storage encryption on-rest). The issue is we do not want to ...
1
vote
1answer
93 views

How to use encrypted internal strings and config? [duplicate]

I was reading the CIA leaked documents on wikileaks, I saw in their "best practices" section that it was advised to encrypt all strings and config information and to de-crypt in memory when needed. ...
1
vote
1answer
152 views

Alternative to storing passwords when dealing with integrations that only allow username/password authentication? [duplicate]

I'm working on an integration with an external service that requires per-user authentication, like Facebook for example, but unlike Facebook only allows username+password for this authentication. My ...
0
votes
2answers
2k views

How to store an AES Key? an Initialization Vector(IV)?

I'm currently developing an authentication service for our company. I somehow understand how to store a salt used in hashing a password in that it should be stored together with the hashed password. ...

15 30 50 per page