Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <h2>The system you are building is probably insecure</h2> <p>Except for storage you basically never want to just encrypt your data, but also <strong>authenticate</strong> it. Authentication in this context means that a valid message can only be generated by someone who knows the key. A widely used authentication scheme is <a href="http://en.wikipedia.org/wiki/HMAC">HMAC</a>. </p> <p>If you do not authenticate your messages anyone can feed data into your service. An attacker might not be able to fully control the outcome after decryption but he/she might still be very dangerous. For example, if you use CBC (which you do) and the most common paddings schemes (AES is a block cipher and can only encrypt 128bit Blocks of data) and an attacker can differentiate between a padding error and any other error then <em>all your messages can be decrypted by an attacker</em>. This is called a <a href="http://www.skullsecurity.org/blog/2013/a-padding-oracle-example">padding oracle attack</a> and is <em>far</em> too common. </p> <p>To protect from this class of attacks you can use an <strong>authenticated encryption scheme</strong>, for example the <a href="http://en.wikipedia.org/wiki/Galois/Counter_Mode">GCM</a> blockcipher mode.</p> <p>Also you have to protect against <strong><a href="http://en.wikipedia.org/wiki/Replay_attack">replay attacks</a></strong>. Consider a banking application and the data you are transmitting is a bank transfer order. Barring any TAN an attacker might record a previous transaction and replay this transaction to your service again and again thus transferring a multiple of the money the customer originally wanted to.</p> <p>Is the form you are getting the data from transmitted over HTTPS? If not: Can the key be eavesdropped by an attacker? How does a user know he got the form from you and not anybody else (SSL/TLS is as much about authentication as it is about confidentiality).</p> <p>Probably I have forgotten some other attack vectors simple CBC-encryption offers.</p> <h2>Alternatives</h2> <p>Probably the easiest way to protect against these attacks is to transmit the form data over HTTPS. SSL/TLS was designed to prevent all of the above attacks and the client and server side implementations had a long time to mature.</p>
    singulars
    1. This table or related slice is empty.
    1. POAES - Encryption with Crypto (node-js) / decryption with Pycrypto (python)
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USPerseids
    1. USPerseids
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COWell, i just covered the encryption action, i wont talk about all the other security systems we use cause not really relevant to the nodejs/python encryption/decryption compatibility. But thanks for this answer, it's really interesting
      singulars
      1. PO
      1. USnnaelle
    2. CO@Perseids Note that the padding oracle attack is an attack against CBC mode (though it does use the padding function as the oracle).
      singulars
      1. PO
      1. USntoskrnl
    3. CO@nnaelle Security is always about the big picture. A system is only as secure as its weakest link. Even the tiniest issue can completely undermine the whole system. That's why you can't deal with different parts of it in isolation.
      singulars
      1. PO
      1. USntoskrnl
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload