Linked Questions

5
votes
2answers
815 views

Why not slightly modify an existing hashfunction to create your own? [duplicate]

I read this interesting question on why improvising your own Hash function out of existing hash functions is bad. However this is specifically focusing on 'mixing' existing hashfunctions. What if for ...
0
votes
2answers
2k views

What is a good way to generate a one time pad, and is this a good way? [duplicate]

Is there a good/better/best way to generate a one time pad? I would like to only utilize about 40 characters (a-z, 0-9, .,!-). What I have come up with is perhaps not the BEST way, but seems to fill ...
1
vote
1answer
137 views

Where to submit an algorithm for analysis? [duplicate]

I'm developing a cryptographic toolkit and plan to employ custom algorithms for hashing, password stretching, etc. Is there a way I can get them analysed? Yes, I can post it on my website and on sites ...
1
vote
2answers
90 views

Reason for not implementing own algorithms/implementations [duplicate]

I get that people don't want to encourage other people to implement their own algorithms/implementations of algorithms due to safety issues. But on the other hand, questions about creating your own ...
68
votes
21answers
57k views

Lessons learned and misconceptions regarding encryption and cryptology

Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
92
votes
9answers
16k views

Does anybody not store salts?

We talked about password hashing and salting in class today. Our professor had a very different understanding of the use case of salts from mine and said that you might not store the salt at all and ...
80
votes
10answers
8k views

Why improvising your own Hash function out of existing hash functions is so bad

I'm afraid I'll have tomatoes thrown at me for asking this old question, but here goes. After reading that cooking up your own password hash out of existing hashing functions is dangerous over and ...
61
votes
7answers
13k views

Is it safe/wise to store a salt in the same field as the hashed password?

In using Argon2 for hashing passwords in my application, I've noticed it generates a string like this (e.g. for password "rabbit"): $argon2i$v=19$m=65536,t=3,p=1$YOtX2//7NoD/owm8RZ8llw==$...
27
votes
10answers
12k views

How to secure passwords over HTTP?

Say my password is abc. I want to send it to the server over HTTP. I could send it in plaintext and let the server hash it and compare it to the entries in its database, but then anyone that can see ...
39
votes
8answers
16k views

Is salting a hash really as secure as common knowledge implies?

(I did search on this topic, but I found no complete question/answer that addressed it, or even good portions of questions that might be relevant.) I'm implementing a salt function for user passwords ...
43
votes
11answers
7k views

Isn't all security “through obscurity”?

I know that one shouldn't rely on "obscurity" for their security. For example, choosing a non-standard port is not really security, but it also doesn't usually hurt to do so (and may help mitigate ...
73
votes
5answers
14k views

What makes Random Number Generators so fragile?

It seems to me that a hardware component which generates random numbers is extremely simple - just measure tiny vibrations in the hardware with a sensor, right? Maybe I'm wrong but it seems like if ...
25
votes
6answers
9k views

What would be the key size for a picture used as a key?

I'm working on a cryptosystem that uses colour pictures as keys for encryption. I'm trying to guess what is the key size of my cryptosystem in order to find the feasibility of a brute force attack. My ...
58
votes
4answers
5k views

What security risks are posed by software vendors deploying SSL Intercepting proxies on user desktops (e.g. Superfish)

There has been quite a bit of concern noted relating to the recent discovery that Lenovo are pre-installing a piece of Adware (Superfish) which has the capability of intercepting SSL traffic from ...
33
votes
3answers
7k views

Is using the username encrypted with the password as key a good password storage scheme?

On web applications I build I don't hash the passwords. Instead I symmetrically encrypt the username using the user's password and store the result in the password field. I use RijndaelManaged on ...
40
votes
5answers
55k views

How secure is a Windows password protected zip file?

I need to send some sensitive information to a client. I thought I would email a password protected zip file I created using Windows XP and then call them with the password. Presuming I pick a good ...
33
votes
3answers
7k views

What does “in-house hash function” mean?

In security news, I faced a new term related to hash functions: it is reported that the "in-house hash function" used in IOTA platform is broken (i.e. Curl-P hash function). You can find the complete ...
32
votes
5answers
3k views

Password Storage - Self Encryption vs Hashing?

Self Encryption: Encrypting a password using the password itself (as a symmetric key). Basically, by doing this, I'll get random data as an output. Now, in order to retrieve the password from this ...
13
votes
4answers
4k views

Is this passwordless system secure?

A person has a form that asks for a name and password. The password is sent to the server where a hash is created from hashing the name and password. This hash is converted into a number using the ...
10
votes
3answers
9k views

How can i find what hashing algorithm was used?

One of my clients has asked me to modify the login page that their board members use to access their materials. The problem here is that the person previously responsible for this has left no ...
5
votes
2answers
2k views

Security of my homebrew hash algorithm [closed]

I am developing a 16 chars long hash algorithm. I have a second algorithm that generates random 1024 char strings. This algorithm loops and detects if there's a collision between the newly generated ...
20
votes
3answers
4k views

Using SHA-256 to preprocess password before bcrypt?

I would like to allow users of my web application to have long passwords, if they so wish. Today I became aware of bcrypt's password length limitation (72 characters, the rest truncated). Would it be ...
13
votes
2answers
3k views

Is this a secure data exchange scheme for a game?

I am writing a multiplayer game. I have a central server which processes everything. For data exchange I use HTTPS protocol. Because this is a game I cannot use computationally expensive systems like ...
15
votes
7answers
1k views

Has cryptography reached the development level where social engineering is the only reliable method of attack?

Note that for the purpose of this question, "social engineering" means extracting information from humans, be your methods compliant with Geneva Conventions or not. Simply put: Do cryptographic ...
3
votes
4answers
3k views

Sql database password encryption opinion needed

I am trying to understand if my database password encryption structure is good, or not much use. So when i register, the php will generate a 50 character random key, and that key will be put into a ...
15
votes
4answers
3k views

Why use random salts?

I read this blogpost on how to store passwords in a database, the secure way. Elbert tells us to do this: Generate a random salt and include something random and the username in it. Hash this. Hash &...
26
votes
4answers
4k views

Flaw in encryption through pseudorandom number stream (from PGP documentation)

I was reading PGP docs and came upon a part written by Phil Zimmermann (PGP's creator) that piqued my curiosity: When I was in college in the early 70s, I devised what I believed was a brilliant ...
17
votes
4answers
4k views

One Time Password Algorithm for Humans

Is there a one time password generation algorithm (based on predefined secret and a changing value/time/counter/etc) that is simple enough that it can be processed by an average human but safe enough ...
1
vote
3answers
3k views

Any hints for programming my own password manager? [closed]

I mostly want whatever help & suggestions you can give me about what I should avoid & what I should think about when making this. I'm a reasonable programmer & I want to make my own ...
1
vote
4answers
3k views

Encrypting text data by replacing characters?

I have been thinking on this method but did not really get into it because I thought it was stupid to do for some reason, maybe because I've never heard of it and it's pretty obvious. But today I got ...
0
votes
6answers
395 views

What sort of security method is this called (if it has a name)?

I have thought of a way of securing access to an application interacting with another application. Using this method Application 1 - "What is the sum of 1+1?" Application 2 - "3" Application 1 - "...
5
votes
2answers
15k views

How to store banking information,collected on website, securely and implement encryption?

So I have this website in which I will ask users to input the following banking information. Bank account holder name: Bank account number: 9 digit routing number: I need these information from ...
5
votes
1answer
1k views

Should I be worried about brute-forcing passwords that encrypts AES?

I am building an application that needs to locally store sensitive data, that is encrypted using the SHA-256 of a password provided by the user. It uses AES for encryption. I am worried that some ...
4
votes
4answers
2k views

Isn't microtime() or mt_rand() sufficient for password reset?

In Can anyone provide references for implementing web application self password reset mechanisms properly? it is mentioned to use strong cryptographic randomness to generate the reset token that is ...
10
votes
2answers
3k views

How can this input-sanitizer function be defeated?

There's a Classic ASP application at my job that is (I believe) highly vulnerable to SQL injection. I want to prove to management that this code isn't secure, but all I'm able to do is insert "SQLINJ" ...
1
vote
5answers
3k views

making an iPhone/Android app which sends a user password to my server, how to secure?

I'm making an iPhone/Android app for my website, users already have an account on the website and the app will allow them to login. I don't have SSL on my website, but it's just a reviews website and ...
4
votes
4answers
5k views

Can we trust onetimesecret?

Alice: I need the file Bob: Sure, and I want to encrypt it first. Please put the strong PGP symmetric key with the copy&paste method to https://onetimesecret.com/ and send me the link. Alice. ...
-9
votes
5answers
2k views

create a variants of MD5

I have also asked similar q here : To create a variants of MD5, I made following changes : MD5 uses a non-linear sin(i)* pow(2,32) ----> i plane to use cos(i)*pow(2,32) Instead ...
6
votes
2answers
486 views

Am I weakening symmetric OpenPGP encryption by deploying a custom pre-derivation?

I often use GnuPG to encrypt files with a passphrase. I'm very paranoid, and afraid that the key derivation used by GnuPG isn't slow enough. For this reason, I've decided to do my own key derivation ...
-9
votes
4answers
1k views

Is my user authentication method secure? Am I reinventing the wheel?

I have read many articles advising me to use OpenID, including on Stack Overflow, for authentication. Unfortunately I can't use OpenID because my auth is not based on an email - it is based on a ...
5
votes
2answers
2k views

Multi sub-domain login for content, spring security for main

Illustration : mainsite.com and contentsite.com both are being developed for same company by two teams. we will have login etc at mainsite.com contentsite.com will have some content that is not ...
1
vote
3answers
2k views

How to prevent someone guessing the token in a reset password link

Currently I have the following set-up for handling users that forgot their password. A user types in his/her e-mail address and presses the forgot password button. I look up the user belonging to ...
2
votes
2answers
4k views

Hash user id securely

In my app I'm using Facebook login and creating a local user in my DB after retrieving the data. When saving the Facebook ID in the DB I need to hash it, as I don't want the ID to be in clear text if ...
3
votes
2answers
2k views

Encryption in peer to peer chat

For a homework assignment I'm developing a chat service that will be able to communicate within a single network. The communication channel should be encrypted with RSA. Should I generate keypairs ...
3
votes
6answers
440 views

Is it okay to wrap a cryptographic hash with MD5 for storage?

Is there any security issues if you wrap your cryptographic hash with MD5 for storage purposes? For example: $hash = md5(hash($password,$salt,$rounds)); Note: hash() uses scrypt or bcrypt or pbkdf2 ...
3
votes
6answers
556 views

Is it safe to use HMAC with a public key for the purpose of salting?

I would like to store password hashes in a database. In order to prevent dictionary attacks, I was thinking to use HMAC with a key parameter which is public - like user id. That means the user id ...
1
vote
3answers
2k views

Authenticating user in same sub-domain using cookies

We have few in production websites say site1.dom1.com , site2.dom1.com , site3.dom1.com which are just replicas working on different server. Now we want to extend some application on another server ...
3
votes
2answers
378 views

How to check that the user entered the correct password when decrypting a file?

I'm trying to create a program for encrypting/decrypting different files. I have not problems with the code, I just don't know how to save the password for every file, which was encrypted through my ...
-2
votes
2answers
2k views

XSS attack on js variables

Let's say, I store a plain password of a user in a global JS variable. May anyone come up with an idea of how a hacker may get that value from user's browser? I now that it's "possible", but I need ...
1
vote
3answers
561 views

Rolling your own crypto [closed]

I know this is usually frowned upon, but supposing you were to roll your own encryption cipher (completely on your own or with a small group of friends, with no peer review possible), what could you ...

15 30 50 per page