Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>If the data is extremely sensitive, you could go the online backup way (like Mozy, Carbonite, etc) where if you lose your password or private key, you lose your data.</p> <p>If it's not that sensitive, you just use a master password for all account data, and allow them to reset their password. On the server you only store a random salt and the salted+hashed password, during communication you only send the salt. The client hashes that and you only have to compare the hashed values, so the raw password is never transmitted. Either way, if they hack your server, they can probably get to the master password too, unless you have to insert it to start the app every time. If it's physically separate from the database server, at least with encryption a breach of just that or a hard drive loss won't expose you.</p> <p>If you're worried about traffic sniffing and hash reuse, which is a possibility if someone wants the account badly enough, you have two good solutions: The better is probably using SSL to connect, which completely eliminates any possibility of exposure, but can require a fair amount of money and setup if you build out to multiple servers. Otherwise you can create a poor man's Diffie-Hellman, like so: With the salt, send another a one-time use key; the client hashes their password with the salt first, then hashes the result with the key and sends it. Server-side, you keep the key in memory or database, and as soon as they're authenticated you forget the key.</p> <p>You can never defend against keyloggers and rootkits with encryption, though. That needs other security models, like making the user confirm via text message with a new client or IP logs on.</p>
    singulars
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload