4 votes
Accepted

Should an access token really be cryptographically signed?

Signed cookies/tokens are particularly useful when either the token is issued by one party but must be verified by a third party; or the contents of the token are guessable, so that tampered/forged ...
user avatar
  • 123k
1 vote

Which approach can be used to verify that information has not been manipulated after it has been recorded?

You should take a look into RFC 3161 Time-Stamp Protocol: A time-stamping service supports assertions of proof that a datum existed before a particular time. Basically, on X, you hash your data, ...
user avatar
  • 11
1 vote

Which approach can be used to verify that information has not been manipulated after it has been recorded?

Without additional information, the data consumer can only know that the data set was signed before time X+10, because that's when he got the signed data set. It is impossible for them to see whether ...
user avatar
1 vote

Which approach can be used to verify that information has not been manipulated after it has been recorded?

One aspect of what you are looking for here is non-repudiation. Which is typically solved by digital signatures, as you suggest. The issue is that you would need to have the signature at time X in ...
user avatar
  • 22.1k
1 vote
Accepted

Is it a good idea to use database sequential id as a key in external key-value storage?

To start, some terminology helps, I think: The user table in Postgres has id's generated by a Postgres sequence This is called a surrogate key. also it has unique identifiers for each user which ...
user avatar
  • 22.1k

Only top scored, non community-wiki answers of a minimum length are eligible