Linked Questions

22
votes
1answer
4k views

Is assigning decrypted keys to a variable in application secure? [duplicate]

Let's say I've retrieved an encrypted secret key from the server. I decrypt it to get the actual secret key, assign the decrypted key to a variable in my app. Something along this: const encryptedKey ...
230
votes
10answers
77k views

Is “the oft-cited XKCD scheme […] no longer good advice”?

I was stumbling around and happened onto this essay by Bruce Schneier claiming that the XKCD password scheme was effectively dead. Modern password crackers combine different words from their ...
56
votes
8answers
21k views

Keeping secrets from root on Linux

I am looking for ways to harden a linux system so that even when gaining full root access (through legit or non-legit means), some secrets remain inaccessible. But first a little background. Many of ...
30
votes
3answers
4k views

Does overlaying the mouse on a virtual numeric keyboard really protect against keyloggers?

I just saw for the first time a new way to enter a password, at the Banque Postale (French Bank). You are given a virtual numeric keyboard and to type you can just leave the mouse cursor over a number ...
19
votes
6answers
3k views

How can the impact of cold boot attacks be minimized?

Short of powering down and maintaining physical security for sufficient time, what are effective strategies for keeping keys from being disclosed by cold-boot attacks, and can anything be done without ...
11
votes
7answers
7k views

Does adding dictionary words to passwords weaken them?

This might sound like a stupid question, but hear me out. If I'm encrypting my financial information and sensitive data via a program like TrueCrypt, the strength of the password is going to matter a ...
3
votes
3answers
8k views

Passwords in memory, practical ways to improve security

Storing a password in an application's memory is risky. The OS may write a portion of memory to disk as a swap file. Processes may access each others' memory, even though they shouldn't. (More) I'm ...
6
votes
2answers
5k views

Safely disable firewire/thunderbolt, patching up DMA exposure

I understand that Firewire 400/800 and Thunderbolt have DMA enabled, and a malicious hardware device can easily read and manipulate system memory at will. If I disable the software drivers for these ...
5
votes
1answer
1k views

Is data-remanence a concern in RAM?

I know data-remanence is a concern on hard drives, but is it a concern on RAM? For example, once a program completes, is its data still available on RAM, just as data on a hard drive remains after ...
2
votes
2answers
596 views

Can unencrypted keys & logins be kept out of program memory?

No matter what technique is used to store encryption keys & logins, it seems that all roads lead back to program memory (as far as I know), as an unencrypted version of the keys & logins will ...
1
vote
0answers
859 views

Accessing the Exchange EWS API with safety in mind

I'm new to the security stack exchange, so feel free to edit the question or redirect me to another forum if this is not fitting. I'm currently working on a web application that will allow the user ...
0
votes
3answers
998 views

Storing Username and Password in Application memory (ram)

I've created a user application running on Windows 7 desktops. This application allows users to enter their username and password for another system. My application does this with a simple textbox. ...