3

Overall I would recommend that you use hybrid encryption. It's more performant than using "only asymmetric encryption" (public-private-key). Some problems could even occur when you encrypt very long messages with asymmetric encryption. The server should never know the symmetric keys. It's main task is to guarantee the transmission of the messages. 2-...


2

It depends. Objects are Secret If the data being uploaded with those GUID is considered secret, then you do not want users to share the same GUID. For that reason, you want to include another identifier in your primary key to make sure that each customer has its own set of GUIDs. In other words, as Conor mentioned in his comment, every user would be able ...


2

The reason to prompt for the password factor first instead of the second factor tends to be either to prevent harassment of the user or to reduce costs associated with usage of the 2FA service. For example, with Twitter they send a push notification to the user's device for login verification. If it didn't require the user's password first to authenticate ...


2

There is no need to reinvent the wheel or design your own cryptographic protocol that will likely be flawed due to lack of experience. Message Layer Security (MLS) is a trend in the cryptology academy due to the complexity of implementing end-to-end encryption for large scale chat applications (like WhatsApp/Snapchat/Telegram). There are multiple proposals ...


2

Voting to close this as it is not a question about security. It is a question about software engineering and architecture: The best place to handle the exception is as close as possible to where the exception occurs - the separation of functionality is all about abstraction - the remote higher levels are separate because they don't know about what is going ...


Only top voted, non community-wiki answers of a minimum length are eligible