Questions tagged [secret-sharing]
The secret-sharing tag has no usage guidance.
0
votes
2answers
62 views
Could someone recommend me a citable definition of honest but curious/semi-trusted?
As far as I know honest but curious or also called semi-trusted means that a client follows protocol but will try to learn as much information as possible, without actively “cheating”. Does anyone ...
7
votes
1answer
120 views
Is it unsafe to use environmental variables for secret data?
After reading this blog post in which the author lays out arguments against using environmental variables for storing secrets, I am unsure how to proceed with deploying my application.
His primary ...
1
vote
1answer
191 views
GPG: Is 'pubring.kbx' safe to share?
This public keyring pubring.kbx (as I merely guess from the name) must be safe to share publicly or is it not? Does it contain any sensitive information with respect to private keys?
I want to back ...
1
vote
2answers
180 views
What is Byzantine password system?
How safe are password managers like LastPass?
One comment there asks:
Does anyone know of any Byzantine password systems? E.g. 3 or 5 online
systems, where breaking any single system would not ...
0
votes
1answer
149 views
Is there any mechanism that using multiple keys encrypt and decrypt a shared document?
I wanted to achieve the following mechanism to encrypt a document
each person in a group of N (user a, b, c...)has her own key;
user a and user b somehow decided to encrypt document M, and they can ...
5
votes
2answers
134 views
Is there a secure way to share a PGP key for use with security.txt?
One of the options for security.txt is to include a reference to a PGP key for use when reporting vulnerabilities in a private, secure way. It makes perfect sense to me for a researcher to use PGP to ...
9
votes
2answers
2k views
Is it a bad idea to have the user choose the TOTP secret instead of generating it automatically?
Reading about TOTP-based authentication systems that use smartphones as one-time code generators, I seem to understand that typically the shared secret is generated automatically by the "server" (the ...
1
vote
0answers
62 views
Password protected secrets on Vault
We're currently improving our custom secrets management system and I'm looking into different solutions such as Hashicorp Vault or AWS KMS.
So far Vault seems to meet most of our current requirements,...
-4
votes
1answer
74 views
How Secret is splitted in Shamir Algorithm [closed]
I have been reading about the Shamir Secret Sharing algorithm. While researching I am still not sure how a secret is split.
So let's suppose we follow example given here.
The secret is 1234 and we ...
2
votes
1answer
241 views
Can I use HashiCorp Vault to restrict access to credentials based on CIDR ranges?
This seems like a pretty simple use case, but it would depend on some pretty recently added functionality which I might not understand yet:
A python script gets populated by configuration management ...
3
votes
0answers
120 views
Shamir's Secret Sharing for Windows? [closed]
Is there a good implementation of Shamir's Secret Sharing for Windows? I would like to securely transfer files over multiple channels and ensure that only the recipient receiving ALL (and possibly ...
-1
votes
1answer
64 views
Passing a secret in url: as a part of the url or query string? [duplicate]
If I need to make get request to an html page and thus pass a secret via the url using https, is it true that I'd need to pass it in a query string versus a part of a path url?
my_domain.com/some_url/...
3
votes
1answer
79 views
Hiring a Third Party Developer, what config files & certificates are ok to share?
So my cofounder and I hired a developer through Guru to build our native iOS and Android MVP's. Long story short, he agreed to integrate Firebase and BrainTree, and originally asked for our account ...
1
vote
2answers
495 views
Store a secret on a Windows computer so that even an administrator cannot access it
I am looking for a way to store a secret on a Windows computer so that even the administrator cannot access it.
But executables that are signed with a specific code signing certificate should be able ...
1
vote
1answer
459 views
Is it secure to store encryption key (encrypted with master key) with the data it was used to encrypt?
I am working on a password sharing web site. I would like users to be able to enter their credentials and share them with other users. I am thinking about using KMS service to store master key (just ...
1
vote
2answers
193 views
Is it safe to hide secrets this way?
I have n secrets to hide, my goal is to remember only a seed and derive them from the seed. Is this a safe aproach?
Calculate n keys:
k(1) = seed XOR secret(1)
...
k(n) = seed XOR secret(n)
Store ...
3
votes
4answers
547 views
What is the most secure way of transferring a secret between 2 processes running on the same system?
As a part of my system, I have many processes, each of them created through a script. One of the processes can be considered as a "Master Process" in the sense that this process communicates with the ...
2
votes
1answer
254 views
Is it safe to store secrets in LDAP?
Many systems store secret or sensitive information in LDAP attributes. For example, IEC/TS 62351-8 prescribes storage of user tokens in LDAP.
Is it safe to store secret or sensitive information as an ...
3
votes
0answers
88 views
Credential leaking while unconscious [closed]
Bear with me here, because this admittedly sounds nutty, but I had a dream last night in which I distinctly recall (accurately) typing the master password for my password manager into a (dream) ...
1
vote
1answer
90 views
Sharing credentials based on the network profile
Is there a way to share logins/passwords with a number of individuals, basing on their public network profile?
Example: a number of people working together in the office should have access ...
2
votes
0answers
82 views
Node.js ENV VAR Security
Recently I had a debate with a fellow dev about where to store Node.js env vars.
I always use .env files and load these as proper ENV VARs at runtime, however my fellow dev uses JSON config files and ...
3
votes
1answer
97 views
Which is the most recommended way to expose a file to a computer in an external network in a secure way?
I have two machines in an internal network. One is a development server, which is isolated from external communications (neither through HTTP, HTTPS, SSH, etc). The last one is a production server (...
0
votes
1answer
93 views
Can a secret, S, be efficiently recovered from a list of usernames and SHA256(S + username)s?
Given a set of usernames and their corresponding proofs of knowledge of a shared secret: SHA256($SECRET + username), can an attacker recover $SECRET more efficiently than by brute force?
(This is ...
2
votes
1answer
63 views
Spam email with my address details
I have registered domain under .xyz 123reg domain registration company. Recently I got an email from ummed.org company informing me that my SEO engine will be going to expire soon and I need to make ...
11
votes
1answer
3k views
What security advantages does Hashicorp Vault have over storing secrets (passwords, API keys) in environment variables?
There seems to be a general recommendation to store secrets in the Hashicorp Vault instance (or similar key-management software) and avoid passing secrets via environment variables.
In what particular ...
0
votes
1answer
45 views
Secure message transportation [duplicate]
It is secure to use the shared secret as the key for a HMAC? is it better to derive one key for all of the messages that are going to be HMACed or a key for each message?
Is it safe to use the shared ...
1
vote
0answers
58 views
Detecting cloaking at the client side
According to this paper(reference: section IX), it may be possible for clients to detect cloaking. It basically says, whenever you fetch a page from a url(assumed to clicked from the search results),...
1
vote
0answers
105 views
pass secret key over tls\ssl [closed]
Let's say that I have a client and server connected over SSL\TLS.
Once the handshake is done, both sides have a shared secret key that they will use to encrypt\decrypt the data.
Can I use this ...
5
votes
2answers
2k views
How to securely store secrets in Docker container?
The application I'm working on has more than a dozen of secrets, SSL certificates and API keys. Currently I have a file that's added into .gitignore and it contains all my secrets. How to securely ...
0
votes
1answer
5k views
RADIUS Authentication and Shared Secret, is secure?
I am considering the implementation of a 2 Factor Authentication server and I am concerned that the RADIUS authentication via Shared Secret is not secure enough as for example an attacker could at ...
6
votes
2answers
8k views
Securely generate and store public/private keys on Android
I am making a web application that distributes data encrypted with the public keys of its clients. At this moment this is working for dedicated devices which I distribute myself. Before they are ...
7
votes
2answers
2k views
What is the worst that can happen if your OAuth client secret is leaked?
Let's say you have an app which uses OAuth so app can log in to the user's services (e.g. OneDrive, Google Drive, etc.)
Inside the app you have included the OAuth client secret (and client ID) as ...
2
votes
1answer
518 views
Sharing a JWT between devices in close proximity of each other
Setup:
iPhone (let's assume 6 and newer for the sake of this question).
Raspberry Pi 2.
The Raspberry runs a REST web service which the iPhone queries. The web service uses JSON Web Tokens for ...
1
vote
1answer
298 views
Automatic detection of credential leaking and secret servers
Are there any frameworks or applications available for automatic detection of credential or secrets being leaked?
So far, I've found a number of academic papers on papers on the subject but no ...
6
votes
2answers
5k views
Secure OAuth 2 flow for client-side or mobile app
I'm implementing an API and a client-side web app, and they are supposed to communicate via an API and use OAuth 2 for authentication.
I can't get over my confusion on what's the right way to ...
2
votes
0answers
36 views
Distributed Shared Secret for RNG that only Distributor knows?
For one of my projects I want to create a way to sync up all participants' RNG with a seed where each participant does not know the seed of the RNG but also in a way that minimizes the number of times ...
5
votes
3answers
2k views
Best practice for sharing a (.zip) file password with recipient
When sharing confidential documents, it's common to zip up and encrypt the files with a good password.
However, all too often the file is emailed as an attachment with the password in the body of the ...
1
vote
1answer
758 views
Key rotation for shared secret keys - recommendation
When using software that does encryption using shared secrets what are the recommended practices for changing the keys.
To be specific, this is a distributed software running in a cluster and the ...
0
votes
1answer
55 views
Share private key with expiry period
I'd like a way to encrypt my data, and temporarily share access to 'semi-trusted' parties.
If I encrypt my data with my private key, is it possible to share my private key (or some derivative of it)...
1
vote
1answer
64 views
Sharing a password for short term access to a shared resource
I sometimes need to delegate access to a single-user/shared user website for short term administration purposes (eg. with a junior administrator for programmed maintenance).
I have requested ...
146
votes
8answers
16k views
How should I set up emergency access to business-critical secrets in case I am “hit by a bus”?
I work as the primary developer and IT administrator for a small business. I want to ensure that business can continue even if I suddenly become unavailable for some reason. Much of what I do requires ...
1
vote
1answer
112 views
Is it safe to publish my development private key?
For my development environment, the following three SSL files allow me to access my application from https://localhost on my local machine.
Private key: server.key
Certificate signing request: server....
8
votes
2answers
4k views
What is the best strategy to store and share pem files between team?
Our company's small tech team works with several different servers, to which we connect with pem files. What is a good way of storing the pem files so that it can be accessed by other team members if ...
0
votes
0answers
577 views
Hashing Identifiers to Create Pseudonyms
I'm wanting to share datasets between two organisations in a pseudonymised way such that they link together via mutual entities (e.g. people) but so that the entities cannot be identified. E.g.:
...
2
votes
2answers
308 views
What can I do to increase the security of my app based on a shared secret?
I'm working on an app that will run on a users TV and has a companion mobile app.
I wanted to present a QR code to my users from the the TV app, which is then scanned by the companion mobile app's ...
14
votes
4answers
6k views
What to do when you can’t protect mobile app secret keys?
We have a mobile app for iOS and Android available in the Apple and Google Play stores. The app communicates with our server’s Web Services over HTTPS.
We have attackers able to spoof the app traffic....
5
votes
1answer
824 views
Vault Secret server best practices
Recently Hashicorp released a secrets management solution called Vault.
It is a free and open source general secrets storage and secret generator, acting as a Vault for passwords, encryption keys, ...
3
votes
1answer
1k views
Is it a safe to hardcode my secret key in my iOS app?
Cloudinary iOS SDK configuration suggests to hardcode your api_secret in your iOS app's source code.
Isn't that a security vulnerability since string literals can be extracted from the app binary, e....
94
votes
6answers
22k views
Why can't I MitM a Diffie-Hellman key exchange?
After reading the selected answer of "Diffie-Hellman Key Exchange" in plain English 5 times I can't, for the life of me, understand how it protects me from a MitM attack.
Given the ...
2
votes
0answers
145 views
Simple method requiring no installation of special tools to share a file over the internet
I have searched for related topics, but found other existing answers to not be satisfactory, because they require installing special tools.
This is a very common use case. For example, I want to ...
