Tagged Questions

0
votes
2answers
133 views

Security through obscurity and storing unencrypted passwords

What exactly does "Security through obscurity" means in the context of stroing unencrypted passwords? I'm using a small program (I won't name it, to not enlarge enough large shame on its author) that ...
1
vote
4answers
229 views

Why do web sites require certain characters in their credentials? [closed]

It seems like when web site lists requirements as to what characters MUST be in the password they're only providing a password map for someone who wants to hack their system. For instance, fsd.gov ...
-5
votes
3answers
288 views

Is sending password to user email secure? [closed]

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should I use encryption?
3
votes
2answers
339 views

I need advice developing a sensitive data transfer/storage/encryption system

I got closed on SO and told to post this here as it's about general application design as opposed to specific code. Intro I'm currently working on a project which involves the daily extraction of ...
1
vote
1answer
177 views

Are python's cryptographic modules good enough?

I mean, say you were writing professional grade software that would involve sensitive client information. (Take this in the context of me being an amateur programmer.) Would you use hlib and hmac? ...
2
votes
2answers
145 views

help for choosing an encryption method for a database column

I'm storing some phone numbers in the database which should kept totally secret (they're supposed to access via web). BTW, because of the position of these people, I need to prevent any chance for ...
0
votes
1answer
172 views

How do PGP and PEM differ?

Email messages are sent in plain text which means that the messages I send to Derpina are visible to anyone who somehow gets access to them while they are in transit. To overcome this, various ...
3
votes
4answers
441 views

Public-private key pair handling on a Windows ecosystem

I've been thinking about how to architect an infrastructure for one of our business applications with the following requirement: Data written by some user can only be read by that user and his ...
1
vote
1answer
2k views

HTML5 localStorage and encrypted sensitive data

I'm looking for a way to have a website remember sensitive data, but without actually storing it server side. And I was looking at HTML5 localStorage to do it. Here's the plan as I see it. User ...
2
votes
1answer
268 views

Books or guides regarding secure key storage and database encryption [closed]

I have an idea for a SaaS product I want to create, however, this product will store extremely sensitive data that needs to be encrypted at rest. The trouble is not so much the encryption, but the ...
19
votes
4answers
1k views

Programmers' concerns about export restrictions from the United States

Which aspects do I need to consider when designing and publishing software that must meet the US export restrictions for cryptographic software? Wikipedia says that there are various categories which ...
3
votes
3answers
279 views

How would I go about changing encryption methods on existing passwords?

If I have an application that is using a less secure method for storing passwords, such as SHA-1, how would I go about converting to SHA-256 or SHA-512?
1
vote
4answers
193 views

How to handle the problem of modified encrypted files

I have a simple encryption/decryption application that I am testing to learn more about security. I found out that if the user modifies the encrypted file, then decryption fails because the hashing ...
0
votes
1answer
144 views

Legal Requirements for Software Makers

Since the Legal site of Stack Exchange isn't ready quite yet, I figured this would be the best place to ask this question. What are, if any, the legal requirements (or online resources for finding ...
7
votes
2answers
182 views

Data encryption/protection - where to find info about high-level best practices

I feel that no one in the group I work in, myself included, really groks encryption and security, or the reasons behind making certain decisions. For example, we recently had a conversation regarding ...
3
votes
1answer
236 views

Are PGP keys as good for certificates as X.509 keys?

I'm working on a decentralized transaction processing system that needs both authentication and general encryption, and I have a design decision to make: should I use PGP or X.509 certificates? While ...