Linked Questions

0
votes
6answers
395 views

What sort of security method is this called (if it has a name)?

I have thought of a way of securing access to an application interacting with another application. Using this method Application 1 - "What is the sum of 1+1?" Application 2 - "3" Application 1 - "...
5
votes
2answers
15k views

How to store banking information,collected on website, securely and implement encryption?

So I have this website in which I will ask users to input the following banking information. Bank account holder name: Bank account number: 9 digit routing number: I need these information from ...
5
votes
1answer
1k views

Should I be worried about brute-forcing passwords that encrypts AES?

I am building an application that needs to locally store sensitive data, that is encrypted using the SHA-256 of a password provided by the user. It uses AES for encryption. I am worried that some ...
4
votes
4answers
2k views

Isn't microtime() or mt_rand() sufficient for password reset?

In Can anyone provide references for implementing web application self password reset mechanisms properly? it is mentioned to use strong cryptographic randomness to generate the reset token that is ...
10
votes
2answers
3k views

How can this input-sanitizer function be defeated?

There's a Classic ASP application at my job that is (I believe) highly vulnerable to SQL injection. I want to prove to management that this code isn't secure, but all I'm able to do is insert "SQLINJ" ...
1
vote
5answers
3k views

making an iPhone/Android app which sends a user password to my server, how to secure?

I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login. I don't have SSL on my website, but it's just a reviews website and ...
4
votes
4answers
5k views

Can we trust onetimesecret?

Alice: I need the file Bob: Sure, and I want to encrypt it first. Please put the strong PGP symmetric key with the copy&paste method to https://onetimesecret.com/ and send me the link. Alice. ...
-9
votes
5answers
2k views

create a variants of MD5

I have also asked similar q here : To create a variants of MD5, I made following changes : MD5 uses a non-linear sin(i)* pow(2,32) ----> i plane to use cos(i)*pow(2,32) Instead ...
6
votes
2answers
486 views

Am I weakening symmetric OpenPGP encryption by deploying a custom pre-derivation?

I often use GnuPG to encrypt files with a passphrase. I'm very paranoid, and afraid that the key derivation used by GnuPG isn't slow enough. For this reason, I've decided to do my own key derivation ...
-9
votes
4answers
1k views

Is my user authentication method secure? Am I reinventing the wheel?

I have read many articles advising me to use OpenID, including on Stack Overflow, for authentication. Unfortunately I can't use OpenID because my auth is not based on an email - it is based on a ...
5
votes
2answers
2k views

Multi sub-domain login for content, spring security for main

Illustration : mainsite.com and contentsite.com both are being developed for same company by two teams. we will have login etc at mainsite.com contentsite.com will have some content that is not ...
1
vote
3answers
2k views

How to prevent someone guessing the token in a reset password link

Currently I have the following set-up for handling users that forgot their password. A user types in his/her e-mail address and presses the forgot password button. I look up the user belonging to ...
2
votes
2answers
4k views

Hash user id securely

In my app I'm using Facebook login and creating a local user in my DB after retrieving the data. When saving the Facebook ID in the DB I need to hash it, as I don't want the ID to be in clear text if ...
3
votes
2answers
2k views

Encryption in peer to peer chat

For a homework assignment I'm developing a chat service that will be able to communicate within a single network. The communication channel should be encrypted with RSA. Should I generate keypairs ...
3
votes
6answers
440 views

Is it okay to wrap a cryptographic hash with MD5 for storage?

Is there any security issues if you wrap your cryptographic hash with MD5 for storage purposes? For example: $hash = md5(hash($password,$salt,$rounds)); Note: hash() uses scrypt or bcrypt or pbkdf2 ...

15 30 50 per page