Linked Questions
109 questions linked to/from Why shouldn't we roll our own?
8
votes
4answers
16k views
Can we trust onetimesecret?
Alice: I need the file
Bob: Sure, and I want to encrypt it first. Please put the strong PGP symmetric key with the copy&paste method to https://onetimesecret.com/ and send me the link.
Alice. ...
0
votes
2answers
166 views
Replace hashing function with asymmetric cryptography when password authentication
I would like to know if the following ideas are feasible:
Hash function is one-way function.
Generate public key from private key is irreversible(asymmetric cryptography).
User password entry -> ...
-1
votes
1answer
89 views
A proposal to prevent man in the middle attacks
Let us assume that there is a man in the middle who can read (not modify) all the data that's being transferred between a client and the server. We want the client to be able to log in without ...
0
votes
1answer
49 views
Protect password from apache user by making file executable-only
I (will) have a binary executable file. It's only permission is user-execute. It cannot be read by user, group, or world. The owner of the file is the Apache user. I don't want the apache user to be ...
0
votes
3answers
237 views
DTLS vs direct use of AES. What are the threats unique for direct use of AES instead of DTLS?
For regular traffic in mesh network (between Internet of Thing devices) customer decided to use one of two options:
DTLS PSK ciphersuite - DTLS based on pre-shared symmetric key
or direct use of AES -...
0
votes
2answers
58 views
Data Transport Encryption - Small Scale Solution
I have a web based application for a network that needs to be able to run without internet access. I have wanted to add TLS to protect certain data in transport. I have explored options like Lets ...
0
votes
1answer
95 views
Writing a Simple SHA256 Salted Hash Generator
I saw a video detailing how to write a simple salted hash program in C# here. Below is the code they wrote (slightly edited for console applications):
using System;
using System.Text;
using System....
29
votes
9answers
18k views
How to secure passwords over HTTP?
Say my password is abc. I want to send it to the server over HTTP.
I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
64
votes
7answers
15k views
Is it safe/wise to store a salt in the same field as the hashed password?
In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"):
$argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
3
votes
1answer
247 views
Good practices for protecting a machine certificate against extraction
Consider the following scenario:
You are providing VPN access for a number of machines running Windows 10.
The machines are configured and hardened according to company standards.
You rely on machine ...
2
votes
1answer
84 views
Is it OK practice to use the same public and private keys for TLS and to generate JWTs?
. . . Or is that discouraged, and it's better to use separate key pairs for TLS and JWT? (It would be slightly easier to manage one key pair only, but probably better security to use two separate key ...
0
votes
2answers
213 views
Can anyone give feedback on this encryption program? [closed]
I am 14 years old and I have just created an encryption program with a friend.
I wanted to know if anyone here could give me back any feedback on it.
Here is how the program works,
Imagine you want ...
3
votes
0answers
77 views
Is this JWT/JWS authentication scheme missing anything important to security? [Educational Question Only]
I'm using the following authentication scheme for my current MERN project. I'd like to know if it's secure, particularly the renewal approach (more details after the description).
User signs in over ...
2
votes
1answer
101 views
Is this key exchange algorithm secure and valid? [closed]
I'm writing reliable UDP implementation and I want it to be secure. Also, I want to make use of elliptic curve cryptography. I don't have the proper education to really understand the math behind this ...
10
votes
3answers
4k views
How can this input-sanitizer function be defeated?
There's a Classic ASP application at my job that is (I believe) highly vulnerable to SQL injection. I want to prove to management that this code isn't secure, but all I'm able to do is insert "SQLINJ" ...