Questions tagged [encryption]

Encryption is the process of transforming plaintext using a cipher to make it unreadable to anyone except those possessing the key.

Filter by
Sorted by
Tagged with
497 votes
8 answers
493k views

RSA vs. DSA for SSH authentication keys

When generating SSH authentication keys on a Unix/Linux system with ssh-keygen, you're given the choice of creating a RSA or DSA key pair (using -t type). What is the difference between RSA and DSA ...
user avatar
  • 13k
412 votes
14 answers
65k views

How is it possible that people observing an HTTPS connection being established wouldn't know how to decrypt it?

I've often heard it said that if you're logging in to a website - a bank, GMail, whatever - via HTTPS, that the information you transmit is safe from snooping by 3rd parties. I've always been a little ...
user avatar
254 votes
12 answers
132k views

Why are hash functions one way? If I know the algorithm, why can't I calculate the input from it?

Why can't a password hash be reverse engineered? I've looked into this ages ago and have read lots on it, but I can't find the explanation of why it can't be done. An example will make it easier to ...
user avatar
  • 2,657
240 votes
5 answers
153k views

What is the difference between https://google.com and https://encrypted.google.com?

Is it there any difference between the encrypted Google search (at https://encrypted.google.com) and the ordinary HTTPS Google search (at https://google.com)? In terms of security what were the ...
user avatar
238 votes
6 answers
286k views

Is Telegram secure?

There is a new WhatsApp-killer application called Telegram. They said that it's open source and that it has a more secure encryption. But they store all the messages in their servers and WhatsApp ...
user avatar
  • 2,703
229 votes
8 answers
206k views

What is the difference between SSL vs SSH? Which is more secure?

What is the difference between SSH and SSL? Which one is more secure, if you can compare them together? Which has more potential vulnerabilities?
user avatar
  • 2,993
223 votes
3 answers
106k views

What are ssh-keygen best practices?

Most users would simply type ssh-keygen and accept what they're given by default. But what are the best practices for generating ssh keys with ssh-keygen? For example: Use -o for the OpenSSH key ...
user avatar
  • 2,385
211 votes
10 answers
29k views

What should you do if you catch encryption ransomware mid-operation?

You boot up your computer one day and while using it you notice that your drive is unusually busy. You check the System Monitor and notice that an unknown process is using the CPU and both reading and ...
user avatar
  • 3,076
202 votes
7 answers
32k views

How do mobile carriers know video resolution over HTTPS connections?

Verizon is modifying their "unlimited" data plans. Customers in the USA can stream video at 480p -or- pay to unlock higher resolutions (both 720p and +1080p). They are not the only mobile carrier to ...
user avatar
  • 1,823
179 votes
8 answers
40k views

Why can't the FBI read the key embedded in the iPhone's secure chip/ROM directly from hardware (silicon)?

As far as I understand, the 4 digit passcode is combined (in some fashion) with a key stored in secure read only memory (e.g. secure enclave chip or similar), where it is directly embedded into ...
user avatar
  • 1,689
175 votes
9 answers
614k views

How to determine what type of encoding/encryption has been used?

Is there a way to find what type of encryption/encoding is being used? For example, I am testing a web application which stores the password in the database in an encrypted format (WeJcFMQ/8+8QJ/w0hHh+...
user avatar
  • 2,234
168 votes
6 answers
21k views

Apple's open letter - they can't or won't backdoor iOS?

Apple released an open letter to the public outlining their reasons for not complying with the FBI's demands to modify the iPhone's security mechanism. Here's a summary: The FBI has an iPhone in ...
user avatar
  • 9,122
163 votes
4 answers
136k views

Where to store a server side encryption key?

I have some data that is symmetrically encrypted with a single key in my database. Rather than hard coding it into my code, I am looking for a safer way to store the encryption key. Where can I safely ...
user avatar
  • 1,733
160 votes
6 answers
140k views

ECDSA vs ECDH vs Ed25519 vs Curve25519

Among the ECC algorithms available in openSSH (ECDH, ECDSA, Ed25519, Curve25519), which offers the best level of security, and (ideally) why?
user avatar
  • 1,703
158 votes
7 answers
251k views

Why most people use 256 bit encryption instead of 128 bit?

Isn't 128 bit security enough for most practical applications?
user avatar
  • 2,877
151 votes
12 answers
27k views

Do I need to encrypt connections inside a corporate network?

Provided that I have a decent level of physical security in the office, I monitor the physical addresses of devices connected to the network and only give VPN access to trusted parties, do I need to ...
user avatar
141 votes
5 answers
26k views

Is it secure to store passwords with 2 way encryption?

I'm a parent who has a parent account with my local school district so that I can log in to their website to view my child's grades etc. I clicked the "forgot password' button, and my password was ...
user avatar
  • 1,083
141 votes
9 answers
92k views

How secure is Chrome storing a password?

Whenever I enter a login into a new site, Chrome asks me if it should store the login details. I used to believe this was fairly secure. If someone found my computer unlocked, they could get past the ...
user avatar
  • 1,353
141 votes
14 answers
47k views

Is there any technical security reason not to buy the cheapest SSL certificate you can find?

While shopping for a basic SSL cert for my blog, I found that many of the more well-known Certificate Authorities have an entry-level certificate (with less stringent validation of the purchaser's ...
user avatar
114 votes
4 answers
67k views

How can RFID/NFC tags not be cloned when they are passive technology?

Everywhere a question like this is asked, I see people responding that (in a scenario where a card is used) the card does some processing with the data it receives/generates some data when it receives ...
user avatar
  • 1,191
114 votes
6 answers
45k views

Why should one not use the same asymmetric key for encryption as they do for signing?

In an answer to a question about RSA and PGP, PulpSpy noted this: It is possible to generate an RSA key pair using GPG (for both encryption and signing -- you should not use the same key for both). ...
user avatar
  • 27k
111 votes
9 answers
80k views

Why can we still crack snapchat photos in 12 lines of Ruby?

Just came across this bit of ruby that can be used to decrypt Snapchat photos taken out of the cache on a phone, apparently adapted from here. To my surprise, it worked without a problem, considering ...
user avatar
  • 1,171
108 votes
5 answers
25k views

What kinds of encryption are _not_ breakable via Quantum Computers?

There's the recent article NSA seeks to build quantum computer that could crack most types of encryption. Now I'm not surprised by the NSA trying anything1, but what slightly baffles me is the word "...
user avatar
106 votes
5 answers
66k views

Is sending password to user email secure?

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should i use encryption?
user avatar
  • 1,413
101 votes
5 answers
32k views

How can my employer be a man-in-the-middle when I connect to Gmail? [duplicate]

I'm trying to understand SSL/TLS. What follows are a description of a scenario and a few assumptions which I hope you can confirm or refute. Question How can my employer be a man-in-the-middle when ...
user avatar
  • 1,134
99 votes
5 answers
48k views

What is the benefit of having FIPS hardware-level encryption on a drive when you can use Veracrypt instead?

The expensive one: https://www.dustinhome.se/product/5010873750/ironkey-basic-s1000 The cheap one: https://www.dustinhome.se/product/5010887912/datatraveler-100-g3 Over 14,000 SEK difference in price. ...
user avatar
  • 477
97 votes
3 answers
82k views

What's the advantage of using PBKDF2 vs SHA256 to generate an AES encryption key from a passphrase?

I'm looking at two comparable pieces of software which encrypt data on disk using a passphrase. One uses PBKDF2 to generate the encryption key from a passphrase, while the other uses two rounds of ...
user avatar
96 votes
10 answers
32k views

If a provider sees the last 4 characters of my password, can they see it in full?

I have some domains/websites as well as emails with Bluehost. Every time I need support, they need the last 4 characters of my main password for the account. They cannot tell me how they store the ...
user avatar
  • 1,202
94 votes
15 answers
23k views

Why would someone "double encrypt"?

If I have a website or mobile app, that speaks to the server through a secured SSL/TLS connection (i.e. HTTPS), and also encrypt the messages sent and received in-between user and server on top of the ...
user avatar
  • 2,368
92 votes
9 answers
19k views

Is it possible make brute-force attacks ineffective by giving false positive answers to failed log-in attempts?

I don't have any experience or scientific knowledge in security, I just wanted to ask if this is possible because I am interested in it. What if I encrypt data and every password decrypts it, but ...
user avatar
  • 891
91 votes
2 answers
83k views

How secure is Ubuntu's default full-disk encryption?

How secure is the encryption offered by ubuntu (using the disk utility)? What algorithm is used underneath it? If someone could at least provide a link to some documentation or article regarding that ...
user avatar
84 votes
7 answers
21k views

Why is SMS used as a way of verifying a user's mobile, when it is not even encrypted in transit?

I did some research about how secure and private SMS messages are. Providers and governments can see these SMS messages in plaintext, but what is weird is that these messages are not encrypted in ...
user avatar
82 votes
6 answers
91k views

Should RSA public exponent be only in {3, 5, 17, 257 or 65537} due to security considerations?

In my project I'm using the value of public exponent of 4451h. I thought it's safe and ok until I started to use one commercial RSA encryption library. If I use this exponent with this library, it ...
user avatar
78 votes
6 answers
71k views

How does PGP differ from S/MIME?

Is S/MIME an abstracted system for general MIME type encryption, whereas PGP is more for email? Why would I want to choose one over the other, or can I use both at the same time?
user avatar
77 votes
10 answers
10k views

Why even use a one-time pad if the key distribution is fully secured?

I had a job interview yesterday where they asked what the only scenario where a one-time pad can be broken would be, my answer to which was "when the key distribution process is not secure enough". ...
user avatar
  • 1,129
77 votes
16 answers
15k views

Ensure that a file can only be decrypted after a specific date

Are there any cryptographic schemes/protocols that would allow me to encrypt a file, make it publicly available, but ensure that it can only be decrypted after specific date? I assume it would be ...
user avatar
77 votes
4 answers
80k views

Is it generally a bad idea to encrypt database fields?

I work on a tiny company, it's literally me (the programmer) and the owner. The owner has asked me to encrypt several fields in a database to protect the customers data. This is a web application that ...
user avatar
  • 821
76 votes
3 answers
11k views

Are URLs viewed during HTTPS transactions to one or more websites from a single IP distinguishable?

For example, say the following are HTTPS URLs to two websites by one IP over 5 mins: "A.com/1", "A.com/2", "A.com/3", "B.com/1", "B.com/2". Would monitoring of packets reveal: nothing, reveal only ...
user avatar
  • 5,042
75 votes
12 answers
24k views

Is Google overreaching by forcing me to use TLS?

Gmail was recently changed to require HTTPS for everyone, whether they want to use it or not. While I realize that HTTPS is more secure, what if one doesn't care about security for certain accounts? ...
user avatar
  • 81.9k
73 votes
5 answers
126k views

Advantages and disadvantages of Stream versus Block Ciphers

Encryption algorithms such as Blowfish,AES,RC4,DES and Seal are implemented in one of two categories of ciphers. What are the advantages/disadvantages to the type of ciphers?
user avatar
72 votes
3 answers
28k views

symmetric encryption session keys in SSL/TLS

This question concerns the session send and receive keys used in SSL/TLS protocol. my understanding is that this key uses symmetric encryption (DES, AES, BlowFish, etc.) I'm wondering, if public-...
user avatar
  • 1,190
72 votes
8 answers
66k views

Are powerline ethernet adapters inherently secure?

I have 2 Zyxel PLA407 powerline adapters. Router is downstairs connected to one adapter, other adapter is upstairs about 30 feet away connected to a desktop. I have a house, not an apartment or ...
user avatar
  • 1,741
72 votes
2 answers
15k views

How is WhatsApp sending end-to-end encrypted messages in push notifications?

WhatsApp implemented end-to-end encryption (whitepaper) in their latest update. How is it possible for WhatsApp to send push notifications with message contents to the Apple Push Notification service?...
user avatar
71 votes
7 answers
51k views

Why can't you work backwards with public key to decrypt a message?

As the title suggests, I am curious to know why you can't work backwards using a message, public key and encrypted message to work out how to decrypt the message! I don't understand how a message can ...
user avatar
  • 829
71 votes
2 answers
154k views

Security comparsion of 3DES and AES

Which one is more secure and least possible to be broken through cryptanalysis AES or 3DES (no matter performance)? I need to use encryption for my projects to store and secure sensitive information ...
user avatar
71 votes
3 answers
121k views

How to estimate the time needed to crack RSA encryption?

How to estimate the time needed to crack RSA encryption? I mean the time needed to crack Rsa encryption with key length of 1024, 2048, 3072, 4096, 5120, 6144, 5120, 7168, 8192, 9216, 10240, 11264, ...
user avatar
  • 961
71 votes
5 answers
14k views

What makes Random Number Generators so fragile?

It seems to me that a hardware component which generates random numbers is extremely simple - just measure tiny vibrations in the hardware with a sensor, right? Maybe I'm wrong but it seems like if ...
user avatar
  • 765
71 votes
5 answers
130k views

Why would I ever use AES-256-CBC if AES-256-GCM is more secure?

I guess the gist of my question is: Are there cases in which CBC is better than GCM? The reason I'm asking is that from reading this post by Matthew Green, and this question on cryptography stack ...
user avatar
68 votes
21 answers
66k views

Lessons learned and misconceptions regarding encryption and cryptology

Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
user avatar
68 votes
6 answers
28k views

Pattern to allow multiple persons to decrypt a document, without sharing the encryption key?

Current setup We have a service that allows users to upload documents through a website and stores the uploaded documents encrypted on disk. The documents on disk are encrypted with a per-user key, ...
user avatar
  • 1,092

1
2 3 4 5
113