17 votes
Accepted

DRM simple clone

I heard of DRM but could not get a reliable implementation of DRM There is a good reason for this: DRM is a hard problem, and a solution to it could be leveraged to obtain incredible amounts of money....
Ella Rose's user avatar
  • 19.6k
6 votes

DRM simple clone

To answer your actual question: Will this implementation work? can it protect my content from unauthorised clients, what are some of the drawbacks of using this? No, this implementation will not ...
Dai's user avatar
  • 208
2 votes

How do I verify a reset token if the token is hashed in DB?

I was pondering this as well and it was hard to find answers. My solution: don't hash the token with bcrypt. Instead hash it with e.g. SHA256 with no salt. It will be secure enough if the token is ...
mts knn's user avatar
  • 121
2 votes
Accepted

JWT Common Practices

How should verification work? - JWT documentation are your friend. Should I look at the JWT's signature section and verify with the private key each time? - https://scotch.io/tutorials/the-anatomy-of-...
Doron Segal's user avatar
2 votes
Accepted

Understanding token security

(1) Am I missing something? What is the real security provided by tokens in this case? Suppose you shop at Home Despot and IKING and they store payment information. Suppose Home Despot is breached ...
Squeamish Ossifrage's user avatar
2 votes

Base64 or hex to attach auth tokens to URL?

A longer URL will make request times a miniscule amount longer. Not enough to hinder brute-force attacks, and you should have rate limiting anyway which would make any differences negligible. Further, ...
SAI Peregrinus's user avatar
2 votes
Accepted

Is it feasible to execute a range query over tokenized data?

Since I was specifically mentioned in the question, I'll take a stab at answering it. First, note that the whitepaper was ghostwritten by a couple of marketing people. These (talented and lovely) ...
pg1989's user avatar
  • 4,636
1 vote
Accepted

Base64 or hex to attach auth tokens to URL?

I think I see the confusion. Making the string shorter isn't like having a shorter password. Shortening a password does make a brute-force attack faster, because the number of possible passwords gets ...
Dewi Morgan's user avatar
1 vote

Base64 or hex to attach auth tokens to URL?

Concerning the length: Be aware that Base64-Encoded Strings may contain +,/ or =. Therefore it is not direct usable in URLs. The necessary url-encoding can add to the length. A Hex-String can be added ...
aschoerk's user avatar
  • 111
1 vote

Question on Tokenization and the need to maintain a value to token lookup

You could use for example an asymmetric keys pair, where the private key is stored on the user's device, and where the public key is saved in the server side. At sign-in, the server send a challenge ...
lakano's user avatar
  • 51
1 vote

PAN authenticatable irreversible tokenization algorithm

The Primary Account Number (which can e.g. be a credit card number) often is 16 decimal digits, with the first 6 (Issuer Identification Number) typically guessable, and the last a check digit a public ...
fgrieu's user avatar
  • 140k

Only top scored, non community-wiki answers of a minimum length are eligible