Collaborate Disseminate
I keep reading the term "reversibly encrypted" and that confuses me because I thought that is kind of the point of encryption, that it can be decrypted.
I googled it, as a good student, and found this encyclopedia entry.
irrever… Continue reading Irreversible encryption – difference to hash?
I am black-box testing a video streaming website. They have 2 kind of IDs for videos. internal_id and external_id.
I need to find a way to enumerate internal_id but cannot guess what kind of ID this website is using.
Example:
video 1: inte… Continue reading GRZXW5EDY – Does anyone recognize what kind of hash/id is this? [duplicate]
I would like to implement my own CAPTCHA challenge for a website. The framework I use implements client-side session cookies, which are not encrypted, only signed with server’s private key.
The problem is persistence. How can one persist a… Continue reading CAPTCHA w/o Server-Side Persistence
I’m implementing custom authentication & session management system in Node.js & PostgreSQL. My goal is to implement sessions that expire after 2 weeks (if not refreshed/renewed).
OWASP and other resources suggest to store unhashed … Continue reading Hashing sessions and retrieving them using cookie(s) with session "id" and "token"
In my company, numeric user IDs are considered PIIs and therefore need to be pseudo-anonymized to be GDPR compliant.
To do so, we populate a lookup table where to each ID is assigned a monotonically decreasing gdpr_ID. Then when users are … Continue reading Choosing the right salt to pseudo-anonymize data and be GDPR compliant
I know that support for Argon2 was released with OpenLdap 2.4.5 according to this link https://bugs.openldap.org/show_bug.cgi?id=8575, but what if I want to use it with a previous version like 2.4.4 is there a way of doing this? Also if ar… Continue reading How to use scrypt or Argon for Openldap version < 2.4.5
I generated two hashes from this site:
Plaintext 1 (p1): world
Salt 1 (s1): hello
Hash 1 (h1): 936a185caaa266bb9cbe981e9e05cb78cd732b0b3280eb944412bb6f8f8f07af
Plaintext 2 (p2): world2
Salt 2 (s2): hello2
Hash 2 (h2): 36d357c14829ba5… Continue reading John the ripper not able to crack the password
Imagine a system supporting an online casino, consisting of a few subsystems, among which a player base where players onboard, manage their profile, pass KYC requirements, and a whole bunch of other stuff. Each time a player joins we give… Continue reading Hash for identity generation
I had configured subdomains on a site to share forms authentication, however decisions were made to change one of websites over to a different domain. So now site A needs to send a user to the site B. Normally I would use something like Co… Continue reading Does hashing really make this home rolled sso process more secure?
I guess I have halfway grasped the concepts of PGP, and I’ve halfway understood the concept of the Efail attack. However, I still don’t understand whether such attacks would be possible (and an MDC would be needed) even if all messages had… Continue reading Is there a use for an MDC even when all messages are signed?