The tag has no wiki summary.

learn more… | top users | synonyms

71
votes
15answers
18k views

Why should passwords be encrypted if they are being stored in a secure database?

I have a web service. Right now, I have passwords stored in plain text in a MySQL table on my server. I know this isn't the best practice, and that is why I am working on it. Why should passwords be ...
28
votes
4answers
824 views

Zero-knowledge code hosting? [closed]

In light of recent revelations about widespread government monitoring of data stored by online service providers, zero-knowledge services are all the rage now. A zero-knowledge service is one where ...
22
votes
4answers
3k views

Is this simple XOR encrypted communication absolutely secure?

Say Alice and Peter each have a 4GB USB flash memory stick. They meet and save on both sticks two files named alice_to_peter.key (2GB) and peter_to_alice.key (2GB) which contain randomly generated ...
21
votes
4answers
3k views

Programmers' concerns about export restrictions from the United States

Which aspects do I need to consider when designing and publishing software that must meet the US export restrictions for cryptographic software? Wikipedia says that there are various categories which ...
14
votes
6answers
939 views

How to assure users that website and passwords are secure

On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All ...
12
votes
2answers
1k views

How can I get my own encryption algorithm tested?

I've just developed a block cipher symmetric-key algorithm and I am using it in some of my products. I want to put it to real test. How would one go about entering their encryption algorithm into an ...
11
votes
3answers
819 views

Where do you use ROT13?

I was reading through the docs for vim, and noticed there's a shortcut, for example g?w would transform the next word using ROT13. I also know that you can change the encoding of a Python file to ...
10
votes
2answers
162 views

Saving critical data in (third party) databases

How do you save important(privacy-wise) user data like SSN, Credit Card Numbers and Addresses in databases? Scenario: Only data which needs to be available is saved. For eg, SSN is saved because the ...
9
votes
2answers
914 views

Encryption Cannot Be Reversed?

I am under the impression that an encrypted string cannot be decrypted so the original value is lost forever. However, if the following string always equals "dominic" (my name), then can't there be ...
8
votes
6answers
7k views

Should I encrypt data in database?

I have a client, for which I'm going to do an Web application about patient care, managing patients, consults, history, calendars, everything about that basically. The problem is that this is ...
7
votes
2answers
266 views

Data encryption/protection - where to find info about high-level best practices [closed]

I feel that no one in the group I work in, myself included, really groks encryption and security, or the reasons behind making certain decisions. For example, we recently had a conversation regarding ...
6
votes
4answers
417 views

Public-key cryptography security given NSA resources

I was wondering how secure public private key encryption methods are. If two individuals were sending emails back and forth forever, where each person would encrypt the body of the email they were ...
6
votes
3answers
526 views

Cross border data obfuscation and how to deal with it?

I am currently facing a situation where I will need to obfuscate data for legal reasons (these are countrywide rules and not specific to me) I will still need to work with teams outside this area who ...
5
votes
3answers
5k views

How do I encrypt the source code on the webserver?

I have a web application developed using Python, HTML, CSS & JavaScript. The customer installs it in any of their own Machine and uses it through their LAN. In short the customer sets up the ...
5
votes
3answers
3k views

How does a web browser save passwords?

How do current web browsers (or mobile mail clients and any software in general) save user passwords? All answers about storing passwords say we should store only hashes, not the password themselves. ...
5
votes
2answers
534 views

Licensing issue for RSA and Rijndael algorithms

I'm using .Net to build a commercial application, i.e. a secure chat application. This application is using RSA and Rijndael algorithms. Do we need licenses for using RSA and Rijndael algorithms for ...
5
votes
4answers
339 views

Multiuser System With Encrypted Database

I am currently developing a hosted solution in ASP.NET using MVC3 and Entity Framework. This product will then be made available to a number of clients as a hosted solution. As the data stored by ...
5
votes
4answers
282 views

Copyright issues with encryption algorythms

I'm developing an application for Android/Java. This application is a kind of password manager, so I'm storing encrypted passwords under the hood of a master password. There are a number of encryption ...
5
votes
2answers
3k views

do I need French export compliance approval to submit an iOS app that uses encryption? [closed]

My company just (5th July 2011) received the following email from Apple: Starting in the first week of July, apps that meet the following criteria are required to comply with French ...
4
votes
5answers
909 views

Paranoid Encryption

Call me paranoid, but I really like to keep my stuff secret, but readily available on the cloud. So, asking this question. How safe and reliable is encryption software (e.g., truecrypt)? The reason ...
4
votes
4answers
672 views

Should I perform encryption in the front end or within the database?

I want to store an encrypted string (specifically, email addresses) in a database. I'm currently using Python and MySQL. I was initially going to use MySQL's AES_ENCRYPT/DECRYPT to handle it, but then ...
4
votes
3answers
370 views

Login into application at startup

Short version: I want "Login on program startup" checkbox like in Skype, for example, but don't know how to protect saved credentials securely. I'm writing client application which, before doing ...
4
votes
3answers
2k views

URL Encryption vs. Encoding

At the moment non/semi sensitive information is sent from one page to another via GET on our web application. Such as user ID or page number requested etc. Sometimes slightly more sensitive ...
4
votes
1answer
422 views

Is a PHP file secure enough on a GoDaddy Server to hard code an AES salt into the file?

So I am creating a web api for an app I am making. The data is sanitized before it is sent to my web api and then encrypted before it is stored in my MySql server. The phone app sanitizes then ...
3
votes
3answers
339 views

How would I go about changing encryption methods on existing passwords?

If I have an application that is using a less secure method for storing passwords, such as SHA-1, how would I go about converting to SHA-256 or SHA-512?
3
votes
2answers
382 views

What encryption method should I use?

I am looking for some information on encryption. Here's what I'm trying to do: Get unique information from our customer (an ID or something) Generate and encrypt some data on our side (using the ...
3
votes
2answers
1k views

I need advice developing a sensitive data transfer/storage/encryption system

I got closed on SO and told to post this here as it's about general application design as opposed to specific code. Intro I'm currently working on a project which involves the daily extraction of ...
3
votes
4answers
205 views

How to implement simple secure client side encryption

I know these sorts of questions come up, but I couldn't find a simple answer, most of the answers are "don't do that" For play, I built myself a webapp, it uses sjcl to encrypt and decrypt notes on ...
3
votes
1answer
535 views

Are PGP keys as good for certificates as X.509 keys?

I'm working on a decentralized transaction processing system that needs both authentication and general encryption, and I have a design decision to make: should I use PGP or X.509 certificates? While ...
3
votes
4answers
96 views

Can I save & store a user's submission in a way that proves that the data has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
3
votes
4answers
524 views

Public-private key pair handling on a Windows ecosystem

I've been thinking about how to architect an infrastructure for one of our business applications with the following requirement: Data written by some user can only be read by that user and his ...
2
votes
4answers
106 views

How to restrict viral file sharing

So I have a website I would like to make that would essentially be selling files. For the sake of discussion let's say that these files are like the raw text of a book. If somebody buys a file from my ...
2
votes
3answers
588 views

Options for client-side encryption of local web databases

My scenario is as follows: Web application, run from the browser, designed for mobile devices. Uses WebSQL storage which may contain sensitive data. Uses Application Cache to enable offline use ...
2
votes
2answers
213 views

help for choosing an encryption method for a database column

I'm storing some phone numbers in the database which should kept totally secret (they're supposed to access via web). BTW, because of the position of these people, I need to prevent any chance for ...
2
votes
3answers
443 views

Do you know of any encryption techniques used to validate url redirection

I'm adding a click-tracking feature on my website to track click-thrus for my advertisers. So, on my site, instead of having a direct link, I link to my re-direct page passing the destination url as ...
2
votes
2answers
430 views

How to handle encryption key conflicts when synchronizing data?

Assume that there is data that gets synchronized between several devices. The data is protected with a symmetric encryption algorithm and a key. The key is stored on each device and encrypted with a ...
2
votes
1answer
210 views

How to encrypt data using the private key?

I understand that in asymmetric crypto systems: The public key is generally used to encrypt data and only the private key can be used to decrypt that data. It's trivial to derive a public key from ...
2
votes
1answer
316 views

Books or guides regarding secure key storage and database encryption [closed]

I have an idea for a SaaS product I want to create, however, this product will store extremely sensitive data that needs to be encrypted at rest. The trouble is not so much the encryption, but the ...
2
votes
1answer
407 views

Client side authentication through signatures instead of passwords

I want to save some user-generated data with some signature of the user that generated it (let's say that the user has to fill some forms with some data and I want him to sign the written data). The ...
1
vote
3answers
354 views

Security through obscurity and storing unencrypted passwords

What exactly does "Security through obscurity" means in the context of stroing unencrypted passwords? I'm using a small program (I won't name it, to not enlarge enough large shame on its author) that ...
1
vote
4answers
209 views

How to handle the problem of modified encrypted files

I have a simple encryption/decryption application that I am testing to learn more about security. I found out that if the user modifies the encrypted file, then decryption fails because the hashing ...
1
vote
4answers
291 views

Why do web sites require certain characters in their credentials? [closed]

It seems like when web site lists requirements as to what characters MUST be in the password they're only providing a password map for someone who wants to hack their system. For instance, fsd.gov ...
1
vote
4answers
474 views

Implementation ideas to store multiple files within a single file for faster access?

My requirement is to store a large number of files within a single file.The files stored could be anything like images, videos or simple text files as well. I want some ideas to implement the same. I ...
1
vote
5answers
2k views

Building a web app with encrypted MySQL database entries?

I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be ...
1
vote
2answers
82 views

PHP Source Code Encryption Concept

Scenario: I'm looking to protect my software that is written in PHP. The nature of PHP is that it is delivered as plain text and therefore cannot be protected by itself. I don't want to install libs ...
1
vote
2answers
227 views

Safest way (i.e. HTTPS, POST, PGP) to send decryption keys through the web?

I am in the final stages of development for my Revit plugin. This plugin is programmed in C#, and distributed via a DLL. One of the DLLs is an encrypted SQLite database (with proprietary data) that is ...
1
vote
1answer
345 views

Are python's cryptographic modules good enough?

I mean, say you were writing professional grade software that would involve sensitive client information. (Take this in the context of me being an amateur programmer.) Would you use hlib and hmac? ...
1
vote
1answer
4k views

HTML5 localStorage and encrypted sensitive data

I'm looking for a way to have a website remember sensitive data, but without actually storing it server side. And I was looking at HTML5 localStorage to do it. Here's the plan as I see it. User ...
1
vote
1answer
87 views

Random number for HTTPS MAC

Recently I found that Netscape used quite simple algorithm to generate random number for Message Authentication Code to establish an HTTPS connection (Nestscpe used time, process identification ...
1
vote
1answer
219 views

Polymorphic engines in C and/or C++ [closed]

I stumbled across polymorphic engines and I don't know anything about them. However, I am curious about how they are written. Every example that I've looked up writes them in assembly, my assembly is ...