Questions tagged [encryption]
Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.
5,829
questions
503
votes
8
answers
507k
views
RSA vs. DSA for SSH authentication keys
When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type).
What is the difference between RSA and DSA ...
- 13.1k
417
votes
14
answers
68k
views
How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?
I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
- 4,465
262
votes
3
answers
143k
views
What are ssh-keygen best practices?
Most users would simply type ssh-keygen and accept what they're given by default.
But what are the best practices for generating ssh keys with ssh-keygen?
For example:
Use -o for the OpenSSH key ...
- 2,795
258
votes
12
answers
138k
views
Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?
Why can't a password hash be reverse engineered?
I've looked into this ages ago and have read lots on it, but I can't find the explanation of why it can't be done. An example will make it easier to ...
- 2,697
241
votes
6
answers
288k
views
Is Telegram secure?
There is a new WhatsApp-killer application called Telegram. They said that it's open source and that it has a more secure encryption.
But they store all the messages in their servers and WhatsApp ...
- 2,753
241
votes
5
answers
154k
views
What is the difference between https://google.com and https://encrypted.google.com?
Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)?
In terms of security what were the ...
- 5,097
234
votes
8
answers
209k
views
What is the difference between SSL vs SSH? Which is more secure?
What is the difference between SSH and SSL? Which one is more secure, if you can compare them together?
Which has more potential vulnerabilities?
- 3,083
211
votes
10
answers
30k
views
What should you do if you catch encryption ransomware mid-operation?
You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and ...
- 3,107
204
votes
7
answers
34k
views
How do mobile carriers know video resolution over HTTPS connections?
Verizon is modifying their "unlimited" data plans. Customers in the USA can stream video at 480p -or- pay to unlock higher resolutions (both 720p and +1080p). They are not the only mobile carrier to ...
- 1,843
181
votes
6
answers
170k
views
ECDSA vs ECDH vs Ed25519 vs Curve25519
Among the Elliptic Curve Cryptography (ECC) algorithms available in OpenSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
- 1,913
181
votes
9
answers
672k
views
How to determine what type of encoding/encryption has been used?
Is there a way to find what type of encryption/encoding is being used?
For example, I am testing a web application which stores the password in the database in an encrypted format (WeJcFMQ/8+8QJ/w0hHh+...
- 2,294
179
votes
8
answers
40k
views
Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?
As far as I understand, the 4 digit passcode is combined (in some fashion) with a key stored in secure read only memory (e.g. secure enclave chip or similar), where it is directly embedded into ...
- 1,689
173
votes
4
answers
149k
views
Where to store a server side encryption key?
I have some data that is symmetrically encrypted with a single key in my database. Rather than hard coding it into my code, I am looking for a safer way to store the encryption key. Where can I safely ...
- 1,833
167
votes
6
answers
21k
views
Apple's open letter - they can't or won't backdoor iOS?
Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism.
Here's a summary:
The FBI has an iPhone in ...
- 9,182
162
votes
7
answers
258k
views
Why most people use 256 bit encryption instead of 128 bit?
Isn't 128 bit security enough for most practical applications?
- 2,977
150
votes
12
answers
28k
views
Do I need to encrypt connections inside a corporate network?
Provided that I have a decent level of physical security in the office, I monitor the physical addresses of devices connected to the network and only give VPN access to trusted parties, do I need to ...
- 1,451
143
votes
9
answers
96k
views
How secure is Chrome storing a password?
Whenever I enter a login into a new site, Chrome asks me if it should store the login details. I used to believe this was fairly secure. If someone found my computer unlocked, they could get past the ...
- 1,373
143
votes
14
answers
48k
views
Is there any technical security reason not to buy the cheapest SSL certificate you can find?
While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
- 2,237
141
votes
5
answers
27k
views
Is it secure to store passwords with 2 way encryption?
I'm a parent who has a parent account with my local school district so that I can log in to their website to view my child's grades etc.
I clicked the "forgot password' button, and my password was ...
- 1,083
120
votes
4
answers
77k
views
How can RFID/NFC tags not be cloned when they are passive technology?
Everywhere a question like this is asked, I see people responding that (in a scenario where a card is used) the card does some processing with the data it receives/generates some data when it receives ...
- 1,251
118
votes
6
answers
48k
views
Why should one not use the same asymmetric key for encryption as they do for signing?
In an answer to a question about RSA and PGP, PulpSpy noted this:
It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for both). ...
- 27.1k
112
votes
9
answers
80k
views
Why can we still crack snapchat photos in 12 lines of Ruby?
Just came across this bit of ruby that can be used to decrypt Snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked without a problem, considering ...
- 1,181
110
votes
5
answers
26k
views
What kinds of encryption are _not_ breakable via Quantum Computers?
There's the recent article NSA seeks to build quantum computer that could crack most types of encryption. Now I'm not surprised by the NSA trying anything1, but what slightly baffles me is the word "...
- 7,788
105
votes
5
answers
67k
views
Is sending password to user email secure?
How secure is sending passwords through email to a user, since email isn't secured by HTTPS.
What is the best way to secure it? Should i use encryption?
- 1,403
101
votes
5
answers
33k
views
How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]
I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute.
Question
How can my employer be a man-in-the-middle when ...
- 1,144
99
votes
5
answers
49k
views
What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?
The expensive one: https://www.dustinhome.se/product/5010873750/ironkey-basic-s1000
The cheap one: https://www.dustinhome.se/product/5010887912/datatraveler-100-g3
Over 14,000 SEK difference in price. ...
- 477
99
votes
3
answers
89k
views
What's the advantage of using PBKDF2 vs SHA256 to generate an AES encryption key from a passphrase?
I'm looking at two comparable pieces of software which encrypt data on disk using a passphrase. One uses PBKDF2 to generate the encryption key from a passphrase, while the other uses two rounds of ...
- 1,313
98
votes
10
answers
32k
views
If a provider sees the last 4 characters of my password, can they see it in full?
I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
- 1,212
95
votes
15
answers
23k
views
Why would someone "double encrypt"?
If I have a website or mobile app, that speaks to the server through a secured SSL/TLS connection (i.e. HTTPS), and also encrypt the messages sent and received in-between user and server on top of the ...
- 2,378
93
votes
2
answers
85k
views
How secure is Ubuntu's default full-disk encryption?
How secure is the encryption offered by ubuntu (using the disk utility)? What algorithm is used underneath it?
If someone could at least provide a link to some documentation or article regarding that ...
- 1,041
92
votes
9
answers
19k
views
Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?
I don't have any experience or scientific knowledge in security, I just wanted to ask if this is possible because I am interested in it.
What if I encrypt data and every password decrypts it, but ...
- 891
88
votes
7
answers
21k
views
Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?
I did some research about how secure and private SMS messages are.
Providers and governments can see these SMS messages in plaintext,
but what is weird is that these messages are not encrypted in ...
- 1,209
84
votes
6
answers
97k
views
Should RSA public exponent be only in {3, 5, 17, 257 or 65537} due to security considerations?
In my project I'm using the value of public exponent of 4451h. I thought it's safe and ok until I started to use one commercial RSA encryption library. If I use this exponent with this library, it ...
- 1,093
83
votes
6
answers
170k
views
Why would I ever use AES-256-CBC if AES-256-GCM is more secure?
I guess the gist of my question is: Are there cases in which CBC is better than GCM?
The reason I'm asking is that from reading this post by Matthew Green, and this question on cryptography stack ...
- 1,039
79
votes
4
answers
81k
views
Is it generally a bad idea to encrypt database fields?
I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that ...
- 841
79
votes
3
answers
12k
views
Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?
For example, say the following are HTTPS URLs to two websites by one IP over 5 mins:
"A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2".
Would monitoring of packets reveal:
nothing,
reveal only ...
- 5,062
79
votes
6
answers
75k
views
How does PGP differ from S/MIME?
Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
- 893
78
votes
16
answers
16k
views
Ensure that a file can only be decrypted after a specific date
Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted after specific date?
I assume it would be ...
- 2,129
77
votes
10
answers
10k
views
Why even use a one-time pad if the key distribution is fully secured?
I had a job interview yesterday where they asked what the only scenario where a one-time pad can be broken would be, my answer to which was "when the key distribution process is not secure enough".
...
- 1,139
76
votes
12
answers
24k
views
Is Google overreaching by forcing me to use TLS?
Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts?
...
- 83.1k
75
votes
5
answers
129k
views
Advantages and disadvantages of Stream versus Block Ciphers
Encryption algorithms such as Blowfish,AES,RC4,DES and Seal are implemented in one of two categories of ciphers. What are the advantages/disadvantages to the type of ciphers?
- 3,311
74
votes
3
answers
29k
views
symmetric encryption session keys in SSL/TLS
This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-...
- 1,210
74
votes
2
answers
15k
views
How is WhatsApp sending end-to-end encrypted messages in push notifications?
WhatsApp implemented end-to-end encryption (whitepaper) in their latest update.
How is it possible for WhatsApp to send push notifications with message contents to the Apple Push Notification service?...
- 768
73
votes
7
answers
54k
views
Why can't you work backwards with public key to decrypt a message?
As the title suggests, I am curious to know why you can't work backwards using a message, public key and encrypted message to work out how to decrypt the message!
I don't understand how a message can ...
- 849
73
votes
8
answers
69k
views
Are powerline ethernet adapters inherently secure?
I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
- 1,761
72
votes
5
answers
15k
views
What makes Random Number Generators so fragile?
It seems to me that a hardware component which generates random numbers is extremely simple - just measure tiny vibrations in the hardware with a sensor, right? Maybe I'm wrong but it seems like if ...
- 775
71
votes
2
answers
154k
views
Security comparsion of 3DES and AES
Which one is more secure and least possible to be broken through cryptanalysis AES or 3DES (no matter performance)?
I need to use encryption for my projects to store and secure sensitive information ...
71
votes
3
answers
125k
views
How to estimate the time needed to crack RSA encryption?
How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
- 961
70
votes
5
answers
205k
views
Understanding 2048 bit SSL and 256 bit encryption
On DigiCert's page, they advertise a 2048 bit SSL with a 256 bit encryption: http://www.digicert.com/256-bit-ssl-certificates.htm
What exactly is the difference here and why are two encryption bits ...
- 867
69
votes
5
answers
30k
views
Is a 'dumbphone' mobile more secure for basic phone calls than a smartphone?
By dumbphone I mean: no internet connection, very limited features, etc.
By more secure I mean: secure from malicious and direct hacking. I don't mean as in protected from government tapping/snooping;...
