Hot answers tagged

203 votes

How to approach replacing md5 for transporting Unity game data to a remote server

This approach is fundamentally flawed. Anything on the client side can and will be tampered with by players. It is the same problem which makes DRM untenable - the user owns the machine and all the ...
user avatar
  • 132k
137 votes
Accepted

Writing my own encryption algorithm

Of course you can start small and implement your own algorithms. But do not assume they provide any security beyond obfuscation. The difficult thing when it comes to cryptography is finding reasons ...
user avatar
  • 2,319
84 votes
Accepted

Is using the username encrypted with the password as key a good password storage scheme?

What you do really is hashing: you built a hashing function out of a block cipher. Incidentally, "encryption of a known value with the password as key" is how the traditional DES-based crypt scheme ...
user avatar
72 votes
Accepted

Best place to store authentication tokens client side

There are two ways you can save authentication information in the browser: Cookies HTML5 Web Storage In each case, you have to trust that browsers are implemented correctly, and that Website A can't ...
user avatar
48 votes

How to avoid using System.String with Rfc2898DeriveBytes in C#

The .NET Core team specifically recommends against using SecureString for new development. See the SecureString documentation: We don't recommend that you use the SecureString class for new ...
user avatar
  • 530
47 votes

Is obfuscation worth it

The problem with client sided Obfuscation/Protection is that the attacker will always win. Your code runs on his PC so he can intercept and manipulate everything in the end. In the specific case of ....
user avatar
  • 534
40 votes

How to approach replacing md5 for transporting Unity game data to a remote server

There are three problems here: What you're trying to do is fundamentally misguided in several ways, as described in Polynomial's answer. If you insist on doing it anyway, then you're not even using ...
user avatar
38 votes
Accepted

Secure big, old ecommerce website from XSS?

I propose the following four step program, where you first pick the low hanging fruit to give you some minimum of protection while you work on the bigger problems. 1. Activate client side filtering 1....
user avatar
  • 64.2k
37 votes

Writing my own encryption algorithm

Coursera Here's my 2 cents: Join the Coursera Cryptography online class: Coursera: Stanford University, Professor Dan Boneh, Cryptography I The class takes six weeks. Each week there are several ...
user avatar
33 votes
Accepted

How to avoid using System.String with Rfc2898DeriveBytes in C#

Using SecureString correctly is difficult, and protects against a threat surface that is unlikely for most use cases. As you say, if an attacker can read your memory, you have other problems. I would ...
user avatar
  • 28.6k
27 votes
Accepted

How to approach replacing md5 for transporting Unity game data to a remote server

Edit: To clarify, I can't speak to the security of your approach, only the hash portion. There are some strong comments here discouraging your approach. (i.e. a good hash can be part of a secure ...
user avatar
  • 13.8k
25 votes
Accepted

Is Rfc2898DeriveBytes using HMAC SHA1 still considered "secure enough" for hashing passwords?

Rfc2898DeriveBytes implements the standard algorithm known as PBKDF2 and defined in RFC 2898 (hence the name). That algorithm uses a configurable underlying pseudorandom function, which is usually ...
user avatar
21 votes

Writing my own encryption algorithm

Start by breaking, not building your own. There's a worrisomely large number of stackexchange posts by people who've written their own algorithms. Take a look around and figure out what's wrong with ...
user avatar
18 votes
Accepted

Difference Between MD4 and MD5 encryption

MD4 and MD5 are not encryption algorithms. They are one-way hash function designed for cryptography. It is important you understand the difference. MD5 is a slightly modified version of MD4 that ...
user avatar
  • 18.5k
16 votes

Protect PHP hashing algorithm (from bots)

You cannot. It is unfortunate, but you cannot. Whatever is running as the client (barring some situations you are almost certainly not in involving TPM) can, if someone is sufficiently motivated, be ...
user avatar
  • 6,281
13 votes

How can I detect a VPN connection (even just in some cases) to get the real location of the user

Finding out that a user is using a VPN service provider isn't that difficult. Most of them have static IP addresses for their exit gateways, so it could just be using a list of known IP addresses to ...
user avatar
  • 48.8k
13 votes

Writing my own encryption algorithm

Bruce Schneier's Applied Cryptography is a must read if you want to start studying this field. I am surprised that nobody suggested it before. And yes, you need to know a lot about crypto even ...
user avatar
  • 5,040
12 votes
Accepted

How to bypass .Net 4.5 request validation, for an XSS attack?

There area a number of places that Request validation may be bypassed, depending on the architecture and function of the application under review, which is likely why Microsoft don't recommend relying ...
user avatar
  • 60.7k
11 votes

Is using the username encrypted with the password as key a good password storage scheme?

The other answers already say No, "roll your own" is rarely a good password storage scheme and yours is no exception. I'd like to add: It isn't a good scheme for storing/communicating the username ...
user avatar
  • 111
11 votes

How to approach replacing md5 for transporting Unity game data to a remote server

A friend of mine once made a flash game (yes it's that long ago) and used the same scheme: md5(authenticated data + secret key), then validate it on the server. I reverse engineered it with some tool ...
user avatar
  • 31.8k
11 votes

Protect PHP hashing algorithm (from bots)

HashCash You could incorporate proof of work into the system: use something like HashCash to require the user to spend, say, 1 second of CPU-time to message your server. This system could be as ...
user avatar
10 votes

Best place to store authentication tokens client side

The best way to protect your access token is to not store it client-side at all. How does that work? Well at the point of generating the access token, generate some other cryptographically secure ...
user avatar
  • 1,698
10 votes

Writing my own encryption algorithm

A good start would be to implement existing algorithms and learn how they work in depth. For example, the one-time pad algorithm is easy to learn and implement, and studying its strengths and ...
user avatar
10 votes

Is obfuscation worth it

Is obfuscation worth it? Yes, of course it is worth it. Any extra layer which does not interfere with another layer is always worth it. It will deter the average person and keep the majority of people,...
user avatar
  • 4,255
8 votes
Accepted

Does encrypting a setting in web.config actually provide security?

No, when you encrypt a web.config section, you specify which application and site the configuration belongs to. The container is going to be specific to that site and application, and will not be ...
user avatar
  • 35.5k
8 votes

Protect PHP hashing algorithm (from bots)

Rate limiting, plain and simple. You need to determine just how important the service is. If it's a service that your application depends on, it needs to have security implemented. It could take the ...
user avatar
  • 1,102
8 votes
Accepted

Where to store secrets in .NET applications?

The Windows-built-in secret store (analogous to Apple's Keyring) is called Credential Manager. See https://stackoverflow.com/questions/9221245/how-do-i-store-and-retrieve-credentials-from-the-windows-...
user avatar
  • 38.9k
7 votes

How do I hack this login page by using SQL injection?

You should ensure that you have the right skill set before offering to perform work for a client. This means that you looking at the website will be worthwhile and you won't give the client a false ...
user avatar
  • 612
7 votes

How can I detect a VPN connection (even just in some cases) to get the real location of the user

Given that the VPN headers around each packet will take up space and then disappear, they could be looking at packet size vs MTU to come up with a way of guessing (it would be a wild guess) that the ...
user avatar
  • 3,966
7 votes
Accepted

ECDH BouncyCastle KeyAgreement length

An elliptic curve is a point in a bi-dimensional space, hence it has two coordinates (usually called X and Y) which are values in some field. In the case of P-192, the field consists in integers ...
user avatar

Only top scored, non community-wiki answers of a minimum length are eligible