Skip to main content
43 votes
Accepted

How to best obfuscate a built-in key in an application?

Hard-coded credentials are considered a vulnerability. Cisco gets caught time and time again, and have to issue a fix to remove them every time. No matter how many layers of obfuscation you employ, ...
ThoriumBR's user avatar
  • 54.5k
19 votes

Is Tor over VPN a security risk?

TOR connection to a VPN OK, VPN connection to TOR go to jail. This assessment, in general, is not accurate. Though it's true that there's always something that can go wrong with any security system. ...
aiootp's user avatar
  • 339
19 votes
Accepted

Hash as filename to protect data

I don't really see what problem hashing the filename is trying to solve. If the filename is provided by the user, then it's unlikely to be unique, and the user is unlikely to remember exactly what ...
Gh0stFish's user avatar
  • 12.9k
18 votes

Hash as filename to protect data

The approach has several major issues. If anybody ever accidentally enables directory listing in the webserver configuration, all sensitive files immediately become public. That alone is sufficient ...
Ja1024's user avatar
  • 9,235
8 votes

Derive a key (and not store it) from a passphrase, to be used with AES

Your approach is fine, but you are missing one thing: changing passwords. I would recommend changing PBKDF2 with a more modern KDF, like Argon2. With your approach, you will need to decrypt and ...
ThoriumBR's user avatar
  • 54.5k
8 votes

How to best obfuscate a built-in key in an application?

log into a website using built-in credentials. Going over HTTP(S) is always going to be an enormous hurdle to any obfuscation, especially if the website you are logging into has a regular username/...
le3th4x0rbot's user avatar
  • 3,249
6 votes
Accepted

Find password decryption used in MSSQL

It looks like the passwords are not actually encrypted; they are hashed. Both of the values that you posted are 16 bytes in length, which is the length of an MD5 hash. On a whim, I took the MD5 hash ...
mti2935's user avatar
  • 23.6k
6 votes

Omit IV for AES128-CBC when requiring to always get the same ciphertext encrypting random IDs

This approach looks very awkward. The fact that you need strange workarounds like this “halfway-CBC” mode to make it work shows that there's definitely something wrong. The solution to only allowing ...
Ja1024's user avatar
  • 9,235
5 votes

Did Phantom Secure use the same level of encryption as WhatsApp?

why would law enforcement not be as concerned with this application Law enforcement is similar concerned about other encrypted communication, like WhatsApp. That's why there are regularly proposals ...
Steffen Ullrich's user avatar
5 votes

Why do most VPN protocols work on the Transport Layer and not on the Network Layer instead?

I think you are confusing what the VPN is using to transport the encrypted data vs. what the VPN provides. You look at the first while you should instead look at the second. A VPN provides a virtual ...
Steffen Ullrich's user avatar
5 votes

Can Cellebrite be used to access any phone by the government? What is the point of encryption if they can get into any phone?

You cannot ensure that the device is 100% protected, the same way that you cannot 100% ensure that nobody could ever break into an apartment, get access to your bank account etc. It is instead always ...
Steffen Ullrich's user avatar
5 votes

If I control both sides of a connection, is there any reason to support alternate cipher suites?

If you control both ends of the tunnel, and there are no issues with intermediary server support, then it definitely makes sense to limit the ciphers. Additional ciphers just increases the attack ...
shellster's user avatar
  • 628
5 votes

Why would one use radio instead of the Internet for secure communications?

The question can be seen from different point of views. Is a radio channel required by a country to communicate with its embassies ? As many countries do not use it, the answer is probably not. The ...
Serge Ballesta's user avatar
5 votes

Is this solution I have programmed 100% hack-proof?

You're fixated on showing that the encrypted data on the server is secure. Sure, that may very well be the case. But the fact that AES has proven itself to be a solid encryption algorithm which will ...
Ja1024's user avatar
  • 9,235
5 votes

Hash as filename to protect data

I would probably not use a hash to generate the file name, as these are deterministic, and someone might be able to guess the filename if they knew some or all of the data that went into the hash. ...
Roger Hill's user avatar
4 votes

Derive a key (and not store it) from a passphrase, to be used with AES

Your approach is very similar to the method that openssl enc uses to encrypt files with AES, using a key derived from a password. The salt used for key derivation is created randomly when the file is ...
mti2935's user avatar
  • 23.6k
4 votes

How to best obfuscate a built-in key in an application?

Don't bother with the app - check the data instead (if you need to) Really, the only use case where you'd care about this kind of login is if the server has to trust the data produced by the app - and ...
Graham's user avatar
  • 671
4 votes

Authenticating a device for remote motor control

With regard to: As far as I can tell (maybe I'm wrong), any authentication scheme (even TLS?) I've found so far could be defeated if an attacker simply listens on the network, notices that some ...
mti2935's user avatar
  • 23.6k
4 votes

Would there be any utility for multiple clients sharing the same TLS session key?

Sharing the same TLS session key among multiple hosts, including proxies, is generally considered a bad idea from a security perspective. Instead of sharing the TLS session key, a better approach is ...
CaffeineAddiction's user avatar
4 votes

SSH-Agent writing unencrypted keys to swap memory

Full-system encryption is basically useless with unencrypted swap. There are ways for a program to deny swapping of its memory, but it's unreliable. All sorts of secrets could end up being swapped. ...
Bachsau's user avatar
  • 143
4 votes

Omit IV for AES128-CBC when requiring to always get the same ciphertext encrypting random IDs

Yes, you can set the IV to a fixed value. Of course, using CBC does not provide many advantages, and it has some disadvantages. CBC is vulnerable to bit flip attacks, where flipping a bit in the ...
Sjoerd's user avatar
  • 30.9k
3 votes

What does [email protected] mean for me?

Adding a new answer as the recently disclosed Terrapin vulnerability directly affects the [email protected] protocol (as well as / in conjunction with the *[email protected] protocols), ...
Mark's user avatar
  • 131
3 votes

Gmail encryption

Because Gmail is served with TLS (the https:// prefix), your ISP or any other manipulator in the middle (MitM) should not be able to see your content, only that you're conversing with mail.google.com (...
Adam Katz's user avatar
  • 11.8k
3 votes
Accepted

Why are there so many different encryption algorithms?

The reason there are so many different encryption algorithms is the same reason there are so many different character encodings, date/time formats, chat applications, etc. Different people inventing ...
Sergej's user avatar
  • 164
3 votes
Accepted

Recommended temporary key size for communication

First things first: Assuming this is all symmetric encryption (rather than something like ephemeral Diffie-Hellman), you're not really achieving anything. You're just kicking the problem up a level. ...
CBHacking's user avatar
  • 49.2k
3 votes

Derive a key (and not store it) from a passphrase, to be used with AES

Implementing file encryption properly is difficult, and there are countless possibilities for subtle mistakes which can compromise the security of the system. Even professionally written file ...
Ja1024's user avatar
  • 9,235
3 votes

Gmail encryption

The encyption in transit in the context of email communication refers to TLS between message transfer agents (MTA). Whether encryption in transit was used or not does not matter much if you are ...
Esa Jokinen's user avatar
3 votes

How to best obfuscate a built-in key in an application?

How do I best obfuscate this key so that it isn't visible in a file dump of the executable? Are there best practices for that as well? There is a system where you encrypt your key using AES, and the ...
Sjoerd's user avatar
  • 30.9k
3 votes

How to best obfuscate a built-in key in an application?

Security becomes more challenging in this area, but this is a legitimate question. You should look very carefully at the scenario to see whether additional user or device authentication are possible; ...
Thomas W's user avatar
  • 203

Only top scored, non community-wiki answers of a minimum length are eligible