/explore
|
You are here 
|
www.daemonology.net | ||
| | | | |
notsosecure.com
In this blog post we will discuss a case study where we were successful in exploiting a faulty password reset functionality. The end result was that we were able to set a newpassword onany arbitrary user account. We could do this because of a weak cryptographic implementation, in this case the functionality was utilising Electronic Code Book (ECB) mode encryption. |
|
| | | | | ||
| | | | |
paragonie.com
How to implement field-level data encryption while still allowing fast queries. |
|
| | | | | ||
| | | | |
rdist.root.org
NaCl is a new crypto library, courtesy of Dan Bernstein of qmail fame and Tanja Lange. After my series of posts on why crypto libraries have seriously hurt web security by offering an API that is too low-level, I was pleased to find NaCl's main interface is high-level. In addition to the kind of fanatical... |
|
| | | | | ||
| | | | |
developerlife.com
TLS is the backbone of web security. We will explore using TLS with Rust, and CFSSL to create a certificate authority to issue self signed certificates & keys. We will also create a server and client that communicate securely over the network using tokio and upgrade insecure TcpStream to TLSStream, and work with TLSAcceptor and TLSConnector. |
|
| | | |||
