Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

New answers tagged

0 votes

How to verify the salt in the SCRAM protocol?

The SCRAM protocol assumes that the client and server have already established trust at some point, agreed on the hash parameters (hash/HMAC algorithm, iterations, salt) and securely exchanged the ...
Ja1024's user avatar
  • 7,447
0 votes

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

In order to make an encryption key out of a password you'll need a slow key derivation function made for passwords, such as scrypt, bcrypt, argon2, etc. root_key = slow_kdf(password, salt_1) Then you ...
n-l-i's user avatar
  • 276
-2 votes

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

The primary point of using a salt is to make sure that your passwords don’t match other people’s passwords. Many people use 123456 as a password. Without salt, they all have the same hash. Lots of ...
gnasher729's user avatar
  • 2,395
0 votes
Accepted

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

It means that if the communications is logged or intercepted the salt can be intercepted, any other user could look to see the method and since it is client side you might presume the hash method ...
Willtech's user avatar
  • 124
0 votes

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

So my idea was to derive the salt from the email using a KDF. In theory, this makes it possible for attackers to precompute the salt, and precompute many hashes, and use those to quickly brute-force ...
Sjoerd's user avatar
  • 30.8k
0 votes

Is it safe to derive the salt from the users email/phone number when pre-hashing a password to be sent to a server?

Since your users send unencrypted data to the server, server sees unencrypted data before encrypting them and storing. Thus, "If a malicious actor ... wanted to access the customer data", ...
mentallurg's user avatar
  • 12.4k
0 votes

Evading authenticated diffie hellman with MITM

The attacker proposes only unauthenticated Diffie-Hellman to the victim as method of encryption. The victim agrees to the proposal [of anonymous DH], resulting in an SSL connection being established ...
ysdx's user avatar
  • 1,656
0 votes

How does a TPM verify the identity of the calling process/service?

TPM is a passive device and only responds to commands. It does not directly verify which application/software is sending the commands to access particular resources. It's the application that must set ...
saurabh's user avatar
  • 798
0 votes

Is it a good idea to reuse certificate issued by public CA for internal database client authentication?

On top of what Angel has mentioned above; Some additional drawbacks to consider; Single Point Of Failure : if certificate is compromised both API and database will be at risk Certificate Revocation ...
choppe's user avatar
  • 115
2 votes
Accepted

How OpenID over OAuth 2.0 can be trusted?

After the user has logged in via Google etc., your application receives a signed ID token from the Authorization Server (the Resource Server isn't involved in authentication). According to the ...
Ja1024's user avatar
  • 7,447
0 votes

Are all stateless authentication systems vulnerable to IDOR?

You seem to misunderstand the Insecure Direct Object Reference vulnerability. An IDOR is caused by a lack of authorization (not authentication) checks in combination with the ability to reference ...
Ja1024's user avatar
  • 7,447
2 votes
Accepted

Library to securely expose query language to end user?

Your approach doesn't require a library except a JSON serializer and an HTTP client. This is all very straightforward. I also doubt that it's common to expose the Elasticsearch API to the client. The ...
Ja1024's user avatar
  • 7,447
0 votes
Accepted

Should I validate json web tokens on my app backend or login backend?

Typically, you would verify the JWT on your app backend, without talking to the login server. You should verify the signature and several fields in the JWT, such as the expiration time. If you use a ...
Sjoerd's user avatar
  • 30.8k
3 votes
Accepted

Why does ssh `known_hosts` file need server name?

The other answers correctly deal with your question. I'm going to address your circumstances: When I push/pull repos on GitHub over SSH, sometimes there will a message about unidentified server which ...
Michael come lately's user avatar
1 vote

Is it impossible to protect an API from data redistribution?

As other answers have already stated, there is no perfect solution to this problem... but you can make life more difficult for someone trying to fetch all of your data programmatically. At some point, ...
Aaron Cicali's user avatar
1 vote
Accepted

Login with roles without internet

If a user can read and modify all files of your application, it is impossible to make it secure. It doesn't matter what you program the application to do, because the user can just change the behavior ...
Sjoerd's user avatar
  • 30.8k
-2 votes

Is it impossible to protect an API from data redistribution?

As the old saying goes, "He who has con has root." Which is: Anyone with physical access to a computer can be presumed to eventually have full access to a computer. I can put an ...
Sean Werkema's user avatar
  • 2,980
0 votes

Is it impossible to protect an API from data redistribution?

Another possibility you would need to worry about is the account being shared with many others -- think password sharing & Netflix. Typically, the token should identify an account, possibly an ...
Matthieu M.'s user avatar
4 votes

Is it impossible to protect an API from data redistribution?

While you can hardly prevent the user from reusing and retransmitting any such data, beyond the measures given in the other answers, one thing you can do is monitor usage patterns and/or limit usage. ...
jcaron's user avatar
  • 3,635
21 votes

Is it impossible to protect an API from data redistribution?

This is a classical Digital Rights Management (DRM) problem. There are no definite solutions, not even in your particular scenario. DRM techniques can make it more difficult to distribute data, but ...
Ja1024's user avatar
  • 7,447
31 votes
Accepted

Is it impossible to protect an API from data redistribution?

It's not something you can do with technology. As soon as the data leaves your server, it isn't your data anymore. There are several ways a malicious user can extract data from your application: ...
ThoriumBR's user avatar
  • 54.4k
0 votes

Is passing claims about the user in an access token "abusing" OpenID Connect?

Yes it's an abuse. In OIDC, claims about the user can be obtained by the client in two ways: The ID token (which is a JWT). The userinfo JSON endpoint (by exchanging the OAuth access token). The ...
benjimin's user avatar
  • 165

Top 50 recent answers are included