Nic
  • Member for 6 years, 11 months
  • Last seen this week
General security of offline databases (like SQLite)
2 votes

What you're asking is a variant of the DRM problem. In extremely generic terms, this is your scenario: You have a thing which you want your software to do, on the customer's machine, and You don't ...

View answer
Why do web browsers provide websites with plain text passwords?
2 votes

What are the downsides? None, really, aside from significantly increased complexity1, which is rarely a good thing, as well as high migration costs for literally every website with a password field, ...

View answer
How to securely share sensitive info (such as API keys) with freelancers?
Accepted answer
4 votes

The exact procedure you follow will necessarily change depending on the service you use. However, there are some common precautions you can take: Switch to services that have robust, featureful key ...

View answer
Is `curl {something} | sudo bash -` a reasonably safe installation method?
39 votes

It it's about as safe as any other standard1 installation method as long as you: Use HTTPS (and reject certificate errors) Are confident in your certificate trust store Trust the server you're ...

View answer
How to identify the right hash from a list of salts and pre-given password during authentication?
Accepted answer
1 votes

Someone is trying to log in. That means they've provided two things: Who they claim to be. Something they claim proves they are that person. The salt should be tied to #1, as it's unique per user (...

View answer
Password policies and keyspace question
Accepted answer
2 votes

Yes, that's the goal of password policies. They also seek to expand the required brute-force search space; requiring the presence of numbers and special characters includes those characters in the ...

View answer
Does encapsulation of encryption within a library provide some kind of additional security?
1 votes

There's a saying in security: If an adversary has physical access to your hardware, it's not your hardware anymore. HSMs try to circumvent that rule, but even they aren't perfect; nothing is. HSMs ...

View answer
Mystery link containing fragment identifier in malicious email
Accepted answer
7 votes

I have an idea. It boils down to "they goofed". Let me lay out my reasoning first, though: %23 is percent-encoding. It's how you encode special characters in a URL. The format is a percent sign, ...

View answer
Why does pinning a CA root certificate not present a security risk?
Accepted answer
7 votes

TL;DR: No. That's not how certificates or pinning work. All certificate pinning does is limit the root of the trust chain to a smaller set, for a specific domain. It doesn't change how the ...

View answer
Is HMAC required when using TLS communication?
0 votes

Without knowing more about your threat model, it's hard to answer this question. However, I want to make a few notes: TLS (as SSL is known these days) will only protect you from people in the middle ...

View answer
Is anything missing in the offline software licensing plan?
Accepted answer
4 votes

You're trying to invent a perfect DRM. That doesn't exist, and will never exist, because of one fundamental rule: Anything your software does, the person running it can use and change. Even if you ...

View answer
Difference between OpenPGP symmetric encryption and AES-256?
Accepted answer
1 votes

OpenPGP is a standard defining a message format. That message format is fairly complex, but in short, it contains: Which algorithm it's using, if any Any required parameters for that algorithm (e.g. ...

View answer
Cache side-channels: Prime & Probe attack
2 votes

Just to reiterate, this is how cache timing attacks work: Attacker fills up the cache with arbitrary data. The actual values don't matter, so long as the cache is full of data that isn't what's ...

View answer
Data Encryption by Application vs Data Encryption in Database
30 votes

Letting your database handle the encryption/decryption is probably for the best: You don't need to write any encryption/decryption code and risk breaking your own security by accident. This also ...

View answer
Is there a way to safely run untrusted code on a local machine for a videogame
1 votes

Securing mods is hard. You have some apparently conflicting requirements: High performance, both in terms of running fast and communicating efficiently with the base game (and/or other mods). This ...

View answer
Anonymity: standardization or randomization?
3 votes

Complete fingerprint elimination is impossible for a wide variety of technical reasons -- in short, a lot of fingerprintable data is required for correct website operation, so you can't deny it to ...

View answer
OpenSSL EVP aes_256_cbc Initialization Vector Size
1 votes

Moved from the question to an answer. Stephen was correct. This was very simple to check, I just changed the IV to be the correct length and the ciphertext remained the same. Hence, the ...

View answer
Generate Fake Encrypted Data
2 votes

TL;DR Don't do it. Just use authentication and 404s. How Fake encrypted data is just random data, from a CSPRNG or TRNG. You don't need to actually run any encryption. To keep attackers from ...

View answer
How can Instagram cause Chrome to attempt to login and show me my username when I'm using incognito mode?
3 votes

Instagram can't, and isn't, doing that. Chrome is. Chrome knows your Google account because you've signed in to it, and they know that you have your Instagram credentials saved in your Google account, ...

View answer
Isn't "Dave's protocol" good if only the database, and not the code, is leaked?
33 votes

This doesn't answer the question about Dave's protocol specifically, but I wanted to address the more general question, for the Daves around the world who are writing their own hashes. There are a few ...

View answer
SQL Injection Escaping Challenge Security Shepherd
1 votes

Short answer: Abuse how their escape works. Try \' OR 1=1; --. Long answer: Their escaping function works by replacing every ' with \'. All of them, including ones already preceded by backslashes. ...

View answer
Private contact discovery - calculating probability of false positive
2 votes

The mathy bit Let's play with the numbers, but correctly. SHA-256 outputs a 256-bit hash. An n-bit string can represent 2n possible values, so the odds of randomly guessing a given n-bit string are ...

View answer
Github account hacked and repo wiped - Github Response
3 votes

From the OP: Ok looks like the source has been found. https://en.internetwache.org/dont-publicly-expose-git-or-how-we-downloaded-your-websites-sourcecode-an-analysis-of-alexas-1m-28-07-2015/ ...

View answer
What kinds of attacks are possible with credentials to a read-only Postgres user?
Accepted answer
1 votes

A few things: Bugs There are two sources for bugs here: Your role definition, and the database software itself. If you configure the role wrong, or the database software has a bug which allows ...

View answer