Collaborate Disseminate
In this Help Net Security interview, Jean-Philippe Aumasson, CSO at Taurus, emphasizes the often-overlooked complexities of key generation, storage, and distribution, underlining the necessity for a high level of security maturity in handling digital a… Continue reading Beyond blockchain: Strategies for seamless digital asset integration
Is it a good idea for a user who is the owner of encrypted data to share a secret passphrase with other users (workers) so that they can decrypt the encrypted data? Is there a better way? I’ll add that the data is encrypted on the client s… Continue reading Sharing secret passphrase with others
I obtained the code below from ChatGPT. It works but I’m trying to understand the purpose of KMS. Does it basically store passwords in KMS and allowing me to retrieve them each time I send over the CiphertextBlob? And could I store more th… Continue reading Using AWS Key Management Service to store passwords [closed]
In my current project we will have to encrypt a lot of S3 objects (a few billions) with KMS.
Our security department requires that we use KMS keys backed by CloudHSM. But since CloudHSM incurs some non negligeable extra charges in terms of… Continue reading High volume encryption: AWS KMS vs CloudHSM
Context
I’m working to make an embedded devices safe against physical access. (publicly accessible device and can be easily stolen)
I already made the following action :
secure boot is enabled on cpu, bootloaded is signed
Image is also si… Continue reading How to safely use dm-crypt as overlayfs uper partition?
I am new to client-side development and I have a naive question. Right now, I’m using Google APIs (the map ones). If I want my client-side application / webapp to display a map, I would include something like this in my index.html:
<scr… Continue reading API key embedded in clients: how to defend against over-usage?
I need to set up full disk encryption on my linux laptop.
Questions:
Does an encryption key on a USB pendrive protect against rubber-hose cryptanalysis?
Is it true that the key on a pendrive is riskier than a password because someone can … Continue reading Full disk-encryption key vs password
I’m looking into the differences between stateful and stateless key management. I understand that stateful key management means that I have a database that tracks my keys, and can become very large. There are obvious security implementatio… Continue reading Stateless Key Management
I see why it is obviously bad to store a secret key and client ID in the source code for a web application. However, how do you go about the alternative? Surely, that information has to be stored somewhere. Is it stored in a local text fil… Continue reading What does it mean to store secret keys as an "environment variable" as opposed to hardcoded in the source code?
We’re wanting to support out-of-the-box digital currency wallets for user’s of our web app.
We have passkeys / webauthn working and would ideally like to associate these credentials with wallet access.
Wallets should be self custodial with… Continue reading Passkeys WebAuthN PRF extension to encrypt/decrypt private key of non-custodial wallet