Linked Questions

8
votes
4answers
16k views

Can we trust onetimesecret?

Alice: I need the file Bob: Sure, and I want to encrypt it first. Please put the strong PGP symmetric key with the copy&paste method to https://onetimesecret.com/ and send me the link. Alice. ...
0
votes
2answers
166 views

Replace hashing function with asymmetric cryptography when password authentication

I would like to know if the following ideas are feasible: Hash function is one-way function. Generate public key from private key is irreversible(asymmetric cryptography). User password entry -> ...
-1
votes
1answer
89 views

A proposal to prevent man in the middle attacks

Let us assume that there is a man in the middle who can read (not modify) all the data that's being transferred between a client and the server. We want the client to be able to log in without ...
0
votes
1answer
49 views

Protect password from apache user by making file executable-only

I (will) have a binary executable file. It's only permission is user-execute. It cannot be read by user, group, or world. The owner of the file is the Apache user. I don't want the apache user to be ...
0
votes
3answers
237 views

DTLS vs direct use of AES. What are the threats unique for direct use of AES instead of DTLS?

For regular traffic in mesh network (between Internet of Thing devices) customer decided to use one of two options: DTLS PSK ciphersuite - DTLS based on pre-shared symmetric key or direct use of AES -...
0
votes
2answers
58 views

Data Transport Encryption - Small Scale Solution

I have a web based application for a network that needs to be able to run without internet access. I have wanted to add TLS to protect certain data in transport. I have explored options like Lets ...
0
votes
1answer
95 views

Writing a Simple SHA256 Salted Hash Generator

I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications): using System; using System.Text; using System....
29
votes
9answers
18k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
64
votes
7answers
15k views

Is it safe/wise to store a salt in the same field as the hashed password?

In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"): $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
3
votes
1answer
247 views

Good practices for protecting a machine certificate against extraction

Consider the following scenario: You are providing VPN access for a number of machines running Windows 10. The machines are configured and hardened according to company standards. You rely on machine ...
2
votes
1answer
84 views

Is it OK practice to use the same public and private keys for TLS and to generate JWTs?

. . . Or is that discouraged, and it's better to use separate key pairs for TLS and JWT? (It would be slightly easier to manage one key pair only, but probably better security to use two separate key ...
0
votes
2answers
213 views

Can anyone give feedback on this encryption program? [closed]

I am 14 years old and I have just created an encryption program with a friend. I wanted to know if anyone here could give me back any feedback on it. Here is how the program works, Imagine you want ...
3
votes
0answers
77 views

Is this JWT/JWS authentication scheme missing anything important to security? [Educational Question Only]

I'm using the following authentication scheme for my current MERN project. I'd like to know if it's secure, particularly the renewal approach (more details after the description). User signs in over ...
2
votes
1answer
101 views

Is this key exchange algorithm secure and valid? [closed]

I'm writing reliable UDP implementation and I want it to be secure. Also, I want to make use of elliptic curve cryptography. I don't have the proper education to really understand the math behind this ...
10
votes
3answers
4k views

How can this input-sanitizer function be defeated?

There's a Classic ASP application at my job that is (I believe) highly vulnerable to SQL injection. I want to prove to management that this code isn't secure, but all I'm able to do is insert "SQLINJ" ...

15 30 50 per page
1
2 3 4 5
8