Collaborate Disseminate
I have software written in C#, which handles sensitive PDF documents (think, healthcare data). How can I ensure that this data is erased from memory as soon as it is no longer used?
Is it sufficient to just force garbage collection, such a… Continue reading How can I guarantee that sensitive data does not remain in memory in C#?
When storing a JWT for authentication in a web application, my first instinct would be to store it as a "hardened cookie", meaning all the required flags such as "HttpOnly" and "Secure" being set. This would s… Continue reading Is there a reason not to store a JWT as hardened cookie?
Imagine a simple API, which offers an endpoint POST /account/authenticate, which takes a username and password, then returns a JWT on success and an error on failure. In the backend, the endpoint uses some key-derivation function like Argo… Continue reading Do Key-Derivation Functions pose a Denial-of-Service Threat for APIs?
Imagine the following situation: You created a KeepassXC database and secured it with a strong passphrase, as well as the HMAC-SHA1 based Challenge-Response mechanism provided by a YubiKey. The secret for the YubiKey is backed up on paper … Continue reading How to decrypt a KeePass database using YubiKey Challenge-Response, but without token?
Physical 2FA tokens, such as smart cards or YubiKeys, are becoming more popular in large companies for authentication purposes. However, one issue with them is availability: When a physical 2FA token is lost or gets broken, the user is by … Continue reading How should a company manage physical 2FA tokens?
I’m currently testing an application, which connects to a MS-SQL database. Through Wireshark, I can see that the application uses TDS to connect to the database. Furthermore, I can see that both the queries and results are UTF-16 encoded a… Continue reading How is TDS authentication data protected?
In theory, authenticating with a public key should be much simpler than with a password. There is nothing to remember for the end-user, and registration can be done just by clicking a button. For all intents and purposes, this should be mu… Continue reading Why is Webauthn not used as primary authentication method?
I’ve seen conflicting opinions on whether or not setting a cipher order is recommended. testssl.sh prints a red warning when no cipher order is encountered, implying that a lack of cipher order is considered a deficit. It also makes intuit… Continue reading Should a server set a cipher order?
I own a Pixel C tablet, which currently has Android 8.1 installed. The Pixel C has officially been discontinued at the end of 2017, and received its last security update 2019. I would like to keep using it, since I only use it to watch You… Continue reading How can I safely use an old Android tablet?
I recently wrote this answer, in which I explained the process of HSTS preloading. However, I noticed that I didn’t actually know the exact mechanism for fetching preload information works. I have checked the Chromium Documentation, MDN We… Continue reading How do browsers get HSTS preload data?