New answers tagged

0

Short answer: Decode the token locally. This is most likely what those other applications / dashboards you mention are doing. Do ask the question of why you would want to show the token to the user. Maybe just display when the session will expire, and/or when they last authenticated (exp and iat fields in the token) Unless you specifically need the ...


0

Does this approach is good or is there a better way to achieve this? I believe there is a better way. When a user signs up for an API key, display it to them once via the GUI and have them copy it. Then one-way hash it into a database. The only way to retrieve it at that point is to create a new one. Think of what you might need to do to secure any data at ...


3

(I feel sure I've answered essentially this question before, but I can't find a dupe.) OpenSSL partly created, and supports, two (or four depending how you count) types of PEM formats for private keys. Your first file, with BEGIN EC PRIVATE KEY (and no Proc-type,DEK-Info inside), is the 'traditional' or 'legacy' format which is specific to one algorithm, ...


2

The encoding of the OpenSSH keys is just base64 so once they do not have passphrase, you can analyze the content. The first one: $ base64 -d | hexdump -C b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNl Y2RzYS1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQTVFzHxmjzhqpJapP/u Lk03un48jp1F8Z0UUlql9wGUyEyMWwmSvGG+dwumEe5kcGgQgtEwp/uF9Un60zAc ...


0

It means that the cryptography from the certificate is breakable - the ROBOT attack is a good write up on how. ECDHE uses elliptic-curve cryptography, which is faster, uses less data for the same level of security, and relies on newer mathematical techniques (although it's not necessarily a good thing...but as a quick aside ECs were needed for solving ...


Top 50 recent answers are included