New answers tagged

0

How do I avoid storing other data and especially unencrypted data in the database via reverse engineering on the frontend? If you really don't want any unencrypted data in the database, you could perform a second encryption on each piece of data prior to putting it into the database (with a key on the server) . Alternatively, you could just turn on full-...


0

Ciphertext encrypted with AES should be indistinguishable from randomly distributed bytes. So, if the bytes submitted to your back-end do not appear to be randomly distributed, then it is safe to assume that these are not ciphertext. However, the converse is not always true. If the bytes submitted to your back-end appear to be randomly distributed - they ...


45

You should serve this data over HTTPS regardless. As Gh0stFish pointed out, you can simply use an S3 bucket policy to require this. There are a couple reasons for this: Using plain HTTP makes it very easy to perform traffic analysis. If I know that encrypted blob 123 is sensitive because I've already seen it or it comes from a site with sensitive ...


9

Firstly, you don't need need to faff around with CloudFront or an Nginx proxy - you can just enforce TLS with an S3 Bucket Policy. It's hard to know whether there are any specific benefits in your circumstances without knowing more about exactly what your use case is. It's worth remembering that TLS doesn't just provide confidentiality, it also provides ...


Top 50 recent answers are included