Questions tagged [encryption]
For questions about encryption and decryption of data, which is the process of encoding data in such a way that adversaries cannot read or tamper with it. Technical questions about encryption (e.g. how does algorithm X work?) are off-topic but might be in scope for our sister sites about Information Security and/or Cryptography.
137
questions
4
votes
5
answers
3k
views
How to protect sql connection string in clientside application?
I am developing a .NET Windows application and i need to make requests to a SQL Server.
How do i secure the auth data in my code in case someone decompiles my application?
I know there are ways to ...
- 1,005
0
votes
0
answers
43
views
SSO Application Storing a Custom Secret in the User Profile
I have an application that employs "zero knowledge" data security, where even with full backend access to our application, customer data cannot be read without knowing their individual ...
- 109
8
votes
3
answers
2k
views
Encryption Cannot Be Reversed?
I am under the impression that an encrypted string cannot be decrypted so the original value is lost forever.
However, if the following string always equals "dominic" (my name), then can't there be ...
- 3,092
1
vote
2
answers
194
views
Best ways for startups to handle sensitive user information [closed]
Many companies struggle with even basic sensitive information handling. One screaming example I can give is the attack on TalkTalk's servers resulted as 4 millions customer's personal information ...
- 72k
0
votes
2
answers
40
views
At which points in the process/stack is Cloud data not encrypted - Cloud Security
Assume an application developed in a PaaS public cloud environment. The application stores and processes some kind of sensitive data.
Encryption-at-rest seems clearly described already, and the option ...
- 20.9k
45
votes
13
answers
13k
views
Encrypted content in games
I have been having this idea of using encryption to prevent users from figuring out content in my program outside of the program itself. Like users may find textures never used in the game meant to be ...
- 3,117
6
votes
3
answers
8k
views
Easy Licensing enforcement techniques for C++ Program in Windows
I am developing software in Window 10 and Visual Studio in C++. I would like to restrict the use of the software to a set of computers, by implementing a license control.
My thought is to query a ...
- 11
1
vote
1
answer
120
views
Why does Tor need to use onion routing instead of decrypting then re-encrypting when passing to the next node? [closed]
I understand why Tor needs many nodes in each relay, although in the case of connecting a hidden server, the packet is encrypted end to end.
So why then must there be multiple layers of encryption on ...
- 3,092
3
votes
4
answers
2k
views
How to store a password so that it can be passed to another site/service which is expecting a plaintext input
I am developing a website and I would like to allow users to use XMPP for live chat. I would like users to have the option use an existing XMPP account if they wish and store their XMPP username and ...
- 151
0
votes
3
answers
146
views
Is offline secure two party computation possible?
Is there a solution for the following problem?
We have a function f(x,y) where the inputs are secret an cannot be
known by anyone besides the party that submitted them.
The output of f is public and ...
- 789
0
votes
0
answers
59
views
How should I handle keys in production
I'm creating an authorisation service, which does signing using a key.
For local development I was randomly generating a key on application start-up.
Now I'm deploying to the cloud (currently going ...
- 675
77
votes
15
answers
29k
views
Why should passwords be encrypted if they are being stored in a secure database?
I have a web service. Right now, I have passwords stored in plain text in a MySQL table on my server. I know this isn't the best practice, and that is why I am working on it.
Why should passwords be ...
- 40.5k
-2
votes
1
answer
64
views
Automated Encryption Keys
A question that I have been wondering for quite some time now, is how do two devices send encrypted data over the internet know the encryption keys to encrypt and decrypt the data, or more importantly ...
- 101
3
votes
1
answer
116
views
Designing a privnote clone - security considerations
I'd like to build a simple privnote-type clone for fun. The idea is this:
User A writes a note in their browser, browser encrypts it client-side
Server saves the pre-encrypted note without knowing ...
- 134k
-5
votes
2
answers
194
views
Library protection in C++
We have developed an algorithm that processes some data at runtime and is slight efficient in terms of time and computing compared with other solutions out there. Though we sure anyone can develop a ...
- 44.1k
1
vote
1
answer
292
views
designing a secure/encrypted file storage for a multi-tenant saas app with local and cloud storage in mind
as the title suggest, I need to handle the tenant files in a multi-tenant saas app. fairly common scenario I believe and should have been solved by the gurus already.
right now the app is in infancy ...
- 15.7k
-1
votes
2
answers
1k
views
How to access an encrypted INI file from C on an embedded system with little RAM
I want to encrypt an INI file using a Delphi program on a Windows PC.
Then I need to decrypt & access it in C on an embedded system with little RAM.
I will do that once & fetch all info; I ...
1
vote
1
answer
72
views
What is the threat model for deciding between unencrypted vs. encrypted EBS volumes?
Let me start by saying that I'm not questioning the utility of encrypting EBS volumes, nor asking how it works.
I'm just wondering what specifically encrypting EBS volumes is protecting against?
For ...
- 32.5k
-1
votes
1
answer
271
views
Pattern to encrypt / decrypt data to / from a server without entering the secret key each time?
The title maybe it's a little bit confusing but I am certain that what I want to achieve is a common pattern, even if I didn't found anything on internet.
I'm developing a web app that store ...
CommunityBot
- 1
1
vote
1
answer
90
views
Encryption using a nonstandard-IV
So i got a few xml files that need to be encrypted and it works, no problems here. Now since the latest update of the CodeAnalyzers i got a new warning ( CA5401 ) that tells me, that it is a bad idea ...
- 130k
1
vote
0
answers
153
views
How can i implement two way asymmetric encryption for my app and backend server?
I'm planning to setup a hybrid encryption procedure in my app. So basically i did encryption for data send from client to server using this method, now i'm confused on how to encrypt data send from ...
- 153
0
votes
2
answers
98
views
How to increase difficulty of intercepting resources downloaded from developer console
I have a web application that allows user view our data that front-end in JavaScript fetches the data via a Restful request to back-end, then render it in the application. The size of each data can ...
- 8,821
-3
votes
1
answer
70
views
Protecting research source from spyware/data mining
My question is simple: What steps should you take to protect research from the vast amount of spyware or insecure applications on a given device?
Background:
I do research into developing new models ...
- 108k
4
votes
1
answer
367
views
How can social security numbers be safely stored in databases and retrieved?
How can personal information that needs to be retrieved at a later date be stored securely in a database? For instance when companies store social security numbers and use them for taxation purposes. ...
- 103
-2
votes
1
answer
176
views
How to encrypt player's cards in a Poker client/server architecture in NodeJS?
I am making an online poker server in NodeJS. Currently, the state of the game is being sent to each client. So using debugging tools a client can see all the other player's card IDs. I would like to ...
- 24k
2
votes
4
answers
4k
views
Is there a way to store a secret API key to my backend, which the frontend can safely ask for?
I'm using the google maps API, which has a secret key that I need to use on the client side.
I was thinking of some alternatives to store it safely. One of them is storing it in my flask database. ...
- 10.8k
1
vote
1
answer
235
views
Encryption key on passwordless authentication
A PHP based webshop running on a shared hosting stores libsodium encrypted personal data in it's MySQL database. To let users have access to their own data, a design very similar to the one discussed ...
- 130k
0
votes
1
answer
320
views
Strategies for Rotating MYSQL Encryption Keys
I have a web app that connects to a MYSQL database which has some encrypted data in it. The encrypted data is encrypted using the the mysql AES_ENCRYPT function and a key.
Now, this key has been ...
- 161
0
votes
2
answers
237
views
How is there no hit in performance with MongoDB's new FLE?
MongoDB recently announced their new field-level-encryption method for helping tackle DB breaches. (https://www.wired.com/story/field-level-encryption-databases-mongobd/)
In other articles it is ...
- 70.2k
1
vote
2
answers
2k
views
Live encryption and decryption of audio
So I am trying to mix my software skills with my electronics skills, and I want to try something a bit different. Basically: buy a walkie talkie, take it apart, remove the microphone and put a rasp pi ...
- 198k
2
votes
1
answer
110
views
Is it possible to create once loadable files?
I know very little about encryption, so I figured I'd ask the internet if it's possible to do the following (and if so, what kind of algorithm should I be looking at):
Write some code that saves data ...
- 70.2k
0
votes
1
answer
82
views
More explicit explanation for password authenticated key retriveal
How can i realize password authenticated key retrieval? I found some description of PAKR:
A PAKR (Password-Authenticated Key Retrieval) protocol and its multi-server system allow one party (say, ...
- 130k
0
votes
1
answer
74
views
Encrypted Network Traffic in local Network for IoT Devices
I didn't find any helpful questions to this topic, so I am just asking a new question, correct me if I am wrong.
I am looking to build my own little smarthome stuff, e.g. a doorlock with an rfid ...
CommunityBot
- 1
11
votes
3
answers
10k
views
How does a web browser save passwords?
How do current web browsers (or mobile mail clients and any software in general) save user passwords? All answers about storing passwords say we should store only hashes, not the password themselves. ...
- 25.6k
3
votes
3
answers
2k
views
Best approach to creating a secure offline login system in C#?
I'm rather new at programming so I'm still getting a grip on things.
I'm creating an offline login system in C# that will have the ability add/remove users. The computer will not be connected to the ...
CommunityBot
- 1
5
votes
2
answers
20k
views
HTML5 localStorage and encrypted sensitive data
I'm looking for a way to have a website remember sensitive data, but without actually storing it server side. And I was looking at HTML5 localStorage to do it. Here's the plan as I see it.
User ...
- 161
0
votes
1
answer
58
views
Encrypted ID to 3rd party application
I would like to ask you a questions that arose these days with GDPR new rules.
What I have is a payments service which use BrainTree to make the payments. In my side I store some information ...
CommunityBot
- 1
0
votes
1
answer
5k
views
VB.NET - Serial Key Generating (Encryption, Hashing, Encoding?) Algorithm
I am trying to create a basic licensing system where I take a unique ID from the client computer, and I get this Hexadecimal string (hyphens removed e.g. "84-18-CE-...."):
"...
CommunityBot
- 1
5
votes
2
answers
1k
views
Is a PHP file secure enough on a GoDaddy Server to hard code an AES salt into the file?
So I am creating a web api for an app I am making. The data is sanitized before it is sent to my web api and then encrypted before it is stored in my MySql server.
The phone app sanitizes then ...
- 173
3
votes
4
answers
2k
views
Security through obscurity and storing unencrypted passwords
What exactly does "Security through obscurity" means in the context of stroing unencrypted passwords?
I'm using a small program (I won't name it, to not enlarge enough large shame on its author) that ...
CommunityBot
- 1
0
votes
2
answers
891
views
Open source desktop application and security
I'm currently working on a desktop application in Java (using JavaFX).
This application stores some user information, parts of which are sensitive. For example, if the user configures a proxy, it ...
- 296
1
vote
2
answers
208
views
securely store credentials for an unsecure API
I'm writing a slack bot that interfaces end users with an API.
That API only method of identification is the raw "login:password" encoded to base64 (it doesn't answer back a token) ...
Currently in ...
- 113
2
votes
2
answers
4k
views
Keeping sensitive data encrypted in memory
I'm working in a Electronic Funds Transfer (EFT) system and need be very careful with sensitive data like credit card numbers.
We need this information do mount the ISO 8583 data before sending to ...
- 14.7k
0
votes
1
answer
112
views
Thoughts on Data Encryption Strategy for Large Number of Records MongoDB and Azure Key Vault
I have previously implement Client Side Data Encryption using Azure Key Vault using the following approach:
Encryption Approach:
Every record that needs to be encrypted gets a Content Encryption Key ...
- 116
1
vote
1
answer
816
views
encrypting a string with public key in client side and decrypt it in backend using private key
I have a client side android app which needs to send an encrypted string to a server implemented in PHP. For this I have chosen an asymmetric algorithm (RSA).
Should I:
Save a public key in client ...
- 1,305
0
votes
1
answer
111
views
On an encrypted connection, are packets' destinations visible to a third-party?
Example:
I'm in a coffee shop in Maine, using a VPN whose physical location is in Berlin.
I know that my packets between Maine and Berlin are encrypted, so someone snooping on that coffee shop's ...
- 32.8k
-2
votes
1
answer
82
views
How to let users send to a link
I'm building for a client's service that allows developers to build client side forms, similar to formspree.io, etc. Basically, developers can set an action to their HTML forms which send the POST ...
- 111
1
vote
1
answer
492
views
Should I encrypt my cookies using AES?
I'm going to encrypt the following data (server side):
email, IP, username
{
*IP*: {
email: *email at this IP*
username: *username of email IP*
}
*IP2*: {
email: ...
4
votes
5
answers
2k
views
Should I encrypt mobile number and otp when sending to backend
I have a login page, where user logs in via his mobile number, He gets an OTP send via backend server, once he enters a One-Time Passcode (OTP), we hit an API like this:
https://backend.com/api/login?...
- 13.3k
1
vote
2
answers
2k
views
Encrypt data in code or stored procedures?
I'm working on a Web App where the data is quite sensitive and is required to be encrypted before it is stored in the database.
Now there are two ways through which I can achieve this:
Encrypt data ...
- 26.3k