New answers tagged

0

Storing credentials in an encrypted Veracrypt container would be a great thing, but you should consider the following: a stronger password for the accessing the container: 16 characters should be a minimum to consider make sure the operating system you access the container from is not compromised: if you have an infected OS stealing your container password ...


0

"Safe" is relative. In general Veracrypt has a good reputation and supports strong crypto. Assuming reasonable use, your weakest link is your stated 8-character password. It may be safe enough depending upon the password and the expected threat, but why limit yourself to an 8-character password? Veracrypt supports "pass phrases" up to 64 characters. You ...


1

8 character is not strong enough to make your Veracrypt volume secure even if it includes symbols. See this answer which is five years, or this article On a supercomputer or botnet, this will take 4 hours. You should use at least 12 even beyond for 16 characters or better and the password must include small and capitals letters, numerals, punctuations, ...


1

Unless I'm mistaken, I understand that both a BIOS password and the BitLocker pre-boot PIN can help to prevent DMA attacks. I'm also guessing that these features are distinct The BIOS password does not have any effect on DMA attacks. The BitLocker pre-boot PIN can assist in mitigating a specific type of DMA attack called "early DMA", which is carried out ...


8

There's a few different things here. a public key is the product of two large prime numbers That is partially true for RSA, though RSA public keys also contain an additional integer (e, in the algorithm's description). Other public key algorithms, and even public key ciphers, do not work the same way (see ElGamal Encryption, for example.) as long as ...


2

In simple terms, RSA encryption is a trap-door function: easy to calculate in one way, hard in reverse. Chiphertext is generated by using modulo operation on a result of the computation involving public key and the message. message = 123 result of the computation = 1234567890 ciphertext (result of the computation modulo 1000) = 890 The numbers in the ...


1

It depends on the strength of your password. Winrar implements proper AES-128 encryption with 262144 iterations of KDF, there's no known bypass for that. You need to estimate the number of possible passwords (what's the length, what characters were used, did it contain words, etc.), and if it is large enough to not be bruteforceble there's nothing you can do,...


0

AFAIK Firefox does not encrypt passwords unless you set a master password; instead it uses BASE64 to encode the data. That protects you from seeing the passwords when opening files with an editor, but it's trivial to get the original secrets. Unfortunately Mozilla is not very open regarding the algorithms in use when a master password is set: You'll have to ...


0

Make sure you already do routine preventive measures you have access to today, and its free. Again, protection methods reduce the speed of penetration and requires more skill level of the perpetrator so it deters 'evil maids' from accessing your unattended laptop to try and plant malware. Note, how these features prevent access varies by make and model. ...


1

OpenPGP is a standard defining a message format. That message format is fairly complex, but in short, it contains: Which algorithm it's using, if any Any required parameters for that algorithm (e.g. nonces) The (encrypted) message body Some other metadata which isn't relevant here OpenPGP is, notably, not an encryption algorithm. It can use encryption (and ...


2

The volume master key is encrypted by one or more key protectors. You have a range of key protectors to choose from depending on the machine's configuration and hardware, each can be used to unlock the volume master key independently. In your configuration above you have two encrypted copies of the volume master key - a TPM key protector, as well as a ...


2

An unauthorized party gaining access to the network without any prior knowledge (eg. by a neighbor brute-forcing the PSK) If you have a sufficiently strong password, such as }H/,uj^kGbtQ(WtqjdY{KCdQT[_G@[R>Bm+~\Sb[X(3na, then the chances of an attacker recovering this password with brute force are negligibly small. Note that this doesn't prevent an ...


0

Network access control products usually have capabilities to defend against these kinds of threat. Some may have more relevant feature sets than others. At least one that I know of can do evil twin detection, and has some additional actions when that kind of threat is detected. It's also a common feature to be able to quarantine a device on the network if it ...


3

Adding encryption on its database per-field or per-group-Of-field basis seems like the best trade off provided that an index field(s) is also created alongside with each field being encrypted. You would solve several problems at once. Searching index would be just as fast Not all fields need to be encrypted Overhead of encryption is kept to a minimal ...


27

Letting your database handle the encryption/decryption is probably for the best: You don't need to write any encryption/decryption code and risk breaking your own security by accident. This also means, as Guntram Blohm pointed out, you won't have to prove your own security to be secure, if it comes down to it. And proving your custom software secure is as ...


1

Moved from the question to an answer. Stephen was correct. This was very simple to check, I just changed the IV to be the correct length and the ciphertext remained the same. Hence, the extra byte is not used in the algorithm and somebody miscounted. Default IV: /* A 128 bit IV */ unsigned char *iv = (unsigned char *)"...


3

You need to use signatures instead of encryption. Eg. Alice signs a message with her private key and optionally encrypys it with Bobs key. Bob decrypts the message (if encrypted), signs it, opyionally encrypys it with Carols public key and sends it to Carol. Carol checks that the message is signed by both Alice and Bob.


1

The use of TLS makes sense. The use of self-signed certificates makes sense as long as you properly deal with the servers certificate at the client side. This means that The trusted self-signed certificate properly validated for example by using the fingerprint (pinning) or the certificate itself. This means also that it is known before the first ...


2

It’s not the algorithm you should be concerned about as much as the encryption mode. Sure, you need to use a strong algorithm such as AES, but there are several you could choose from. What you really need is to use it in a secure mode (not ECB!) with a unique IV. As long as each message has its own IV, it won’t encrypt to the same ciphertext. That way an ...


1

This question is not really meaningful because there isn't a linear scale where algorithms can be rated. Non-cryptographic hashing algorithms are weak in the sense that they don't have the expected properties of cryptographic hashing algorithm. So if you're looking for hashes that are completely broken as cryptographic algorithms, look for non-cryptographic ...


1

No. The client connection to the webserver may be secured using TLS, commonly known as https. The connection from the web server hosting shell-in-a-box to the server you are controlling may be via ssh.


0

How do I protect users if their device or pin has been compromised? The best way is to avoid storing data on the device in the first place. This however means that the app won't be able to work offline, needs to re-download data each time and might have performance impact. In the end it depends on the risk you want to accept and the user experience you ...


0

Do not use user input (because you camnot trust it) This answer extends the accepted with what looks to me a significant simplification. Now, from your description and from my best understanding, you have said that you want to prevent Sales Agent A (namely 12345) to peek into Sales Agent B's (namely 54321) data. Simply, kill the agentId parameter from ...


0

Storing encrypted information in the app's database comes at the expense of inability to use power of SQL to retrieve/store information in a convenient way. Encrypted data can not be indexed. Because of that in order to search for a specific thing the application's server (or the app) needs to retrieve the whole block of data, decrypt it and then find what ...


1

KMS allows you to encrypt/decrypt data without ever seeing your master keys. It makes managing encryption keys simpler because there's nothing you can do that can allow you to leak the master key. They can also manage the choices of encryption algorithm, and the mechanism for upgrading algorithm choice. So these decisions are made for you so you can't ...


-1

What's the purpose/benefit of KMS? KMS prevents the leaking of decryption keys, similar to a HSM, but HSM's are expensive and hard to use. KMS's are cheap and easy to use because they have API endpoints. KMS shifts the problem of controlling access to encrypted data from a decryption key management problem (where granular access and ability to revoke access ...


0

I spent about 1 month setting up an in-depth PoC Vault Server, hosted on Kubernetes, 99% Infrastructure as Code. (Kubernetes yamls, Configuration, scripts, Vault Infrastructure Provisioning Secrets(encrypted), all stored as Code in Git.) My primary purpose was to evaluate its versioned key-value store. I ended up abandoning it for that purpose. After ...


3

You're barking up the wrong tree trying to build a DRM-like solution. Nothing akin to DRM ever works in the long run. Instead, do this: Ask the user for a passphrase when they save the private key. Run the passphrase through a KDF (such as PBKDF2, scrypt, or Argon2), and then use the result as the secret key for some secure symmetric encryption algorithm. ...


1

This original answer was to use HTTP/SSL/TLS to encrypt the information between the PHP server and NodeJS client and to use basic authentication in the HTTPS request. However from the conversation in the comments to this answer the server and clients are already using HTTPS to secure the traffic between the server and the client. Therefore as long as the ...


0

The answer is on your computer. Let's say the proxy used by your company is a standard, regular proxy... then, it probably don't touch HTTPS and you're OK (at least regarding exchanges, but as said previously, your company sysadmin will still be able to see that you're using whatsapp). On the worst case, your company could have deployed a more agressive ...


2

No. Whatsapp, Signal, and other secure messaging systems use end-to-end encryption. You can read more about the underlying algorithm here: https://en.wikipedia.org/wiki/Double_Ratchet_Algorithm. That being said, if you are using a work computer which your employer controls, your employer may be able to read your messages on your local machine before ...


0

Long story short. Whatsapp encrypts every outbound communication send to their servers, if you are in a corporate environment all of your requests are being intercepted and forwarded depending on the security layers that are present at the company. Your PC -- Proxy Server --- ( Some checks if you are requesting anything malicious ) -- if corrected forward ...


0

"VeraCrypt Setup 1.23-Hotfix-2.exe" works reliably with Windows 10 Home, after 6 months of testing which includes: weekly security updates two major feature updates, 1809 and 1903 No customization of the UEFI needed. Just follow the Veracrypt install instructions. Has worked under normal Win10 Home and available menu options, no special changes, scripts ...


Top 50 recent answers are included