473,698 Members | 2,873 Online
Bytes | Software Development & Data Engineering Community
+ Post

Home Posts Topics Members FAQ

Encryption keys for cookies and https

Some basic security questions:

1) Is there any difference in the sort of encryption keys needed for encrypted
cookies versus for https connections?

2) Does one need encrypted cookies for people who log on to a site using forms
authentication?
Dec 7 '05 #1
1 1162
Http-encryption (SSL/HTTPS) uses certificats. cookie do not.

The FormsAuthentica tion cookies value is an encrypted ticket.

Cheers,

--
Daniel Fisher(lennybac on)
http://www.lennybacon.com
"Randall Parker" <NOtechieSPAMpu ndit_please@fut ure_avoidjunk_p undit.com>
wrote in message news:%2******** **********@TK2M SFTNGP10.phx.gb l...
Some basic security questions:

1) Is there any difference in the sort of encryption keys needed for
encrypted cookies versus for https connections?

2) Does one need encrypted cookies for people who log on to a site using
forms authentication?

Dec 7 '05 #2

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

4
3445
by: Harold Crump | last post by:
Greetings, I have a requirement of storing some .xml files on a web server. The files will contain financial information like credit card numbers, so I would like to encrypt them. The files will stay there until another program downloads them and deletes the files. My question is - which of the functions in the mcrypt library provide
14
1942
by: Ray Cassick \(Home\) | last post by:
Ok, time to ask the question here.. I have been battling over this one for sometime now and just have to ask it. I have created a few classes that I use to act a security keys. These classes get serialized using a binary formatter and then symmetrically encrypted. The app will deserialize them and use the contents to judge licensing capabilities, etc. Currently the license key and vectors are stored in the code. I don't like the idea...
0
1756
by: Michael Evanchik | last post by:
Hello all, since i wanted to use ssl and its seems easy to do so with this object. Im trying to login to a webserver (aol) for this example. But for some reason, im packet sniffing with ethreal and cookies are not being sent along with the header and post data. here is the code im using. Can anyone please tell me why this is happening? I do not want to go back to using VB6 and the inet control!!! If you notice in my class below, i...
9
7666
by: Michael Evanchik | last post by:
Hello all, since i wanted to use ssl and its seems easy to do so with this object. Im trying to login to a webserver (aol) for this example. But for some reason, im packet sniffing with ethreal and cookies are not being sent along with the header and post data. here is the code im using. Can anyone please tell me why this is happening? I do not want to go back to using VB6 and the inet control!!! If you notice in my class below, i...
1
1607
by: veg_all | last post by:
As I read about security it seems that the only secure way to encrypt data is to not store the key anywhere on the server. So I have the user manually type it in and it gets stored as a persistent cookie on their machine. In other words, when the log in, they are prompted for the key . the key is then posted via a form to a php script which stores the key as a cookie. Is this secure? Is there any loophole in doing it this way?
4
4140
by: pintu | last post by:
Hello everybody.. I hav some confusion regarding asymmetric encryption.As asymmetric encryption it there is one private key and one public key.So any data is encrypted using private key and the same is decrypted at client side using public key and vice-versa..Now i hav confusion like i.e. * Are both the keys available to both sender and receiver.? * When data is encrypted using public key ,Is the same data decrypted using private key(...
25
2395
by: eggie5 | last post by:
I have a form where a user can change his password, but I'm confused on how to prevent this from being transmitted in plain text. Well, I know how not to transmit it in plain text - use any type of encryption, but then the problem is, how do I decrypt it on the server to store it? If I use some type of key based encryption, the how do I get the key to the client without it being intercepted, rendering the whole process useless.
2
6476
by: olafinsbraaten | last post by:
I am using column-level encryption (ENCRYPT_CHAR, DECRYPT_CHAR) to protect selected columns in DB2 LUW v.9.1 and v.9.5 on Linux. The ultimate goal is to support the requirements put forward in Payment Card Industry Data Security Standard (PCI DSS) which states: "Protect stored cardholder data anywhere it is stored". The encryption functions above requires a password to be set for each db2 session (SET ENCRYPTION PASSWORD =...
7
5248
by: Walter Sobchak | last post by:
The connection is ssl encrypted and I need to write some sensitive information in a cookie. I'd like to encrypt the cookie on the client so it could be decrypted later on the server. 1. If I use a symmetric algorithm how do I send the encryption key? 2. Is there any asymmetric algorithm that doesn't have an impact on performance? 3. Is there a difference in writing cookies with http an https? I think https in that case doesn't help.
0
8683
marktang
by: marktang | last post by:
ONU (Optical Network Unit) is one of the key components for providing high-speed Internet services. Its primary function is to act as an endpoint device located at the user's premises. However, people are often confused as to whether an ONU can Work As a Router. In this blog post, we’ll explore What is ONU, What Is Router, ONU & Router’s main usage, and What is the difference between ONU and Router. Let’s take a closer look ! Part I. Meaning of...
0
9170
Oralloy
by: Oralloy | last post by:
Hello folks, I am unable to find appropriate documentation on the type promotion of bit-fields when using the generalised comparison operator "<=>". The problem is that using the GNU compilers, it seems that the internal comparison operator "<=>" tries to promote arguments from unsigned to signed. This is as boiled down as I can make it. Here is my compilation command: g++-12 -std=c++20 -Wnarrowing bit_field.cpp Here is the code in...
1
8904
by: Hystou | last post by:
Overview: Windows 11 and 10 have less user interface control over operating system update behaviour than previous versions of Windows. In Windows 11 and 10, there is no way to turn off the Windows Update option using the Control Panel or Settings app; it automatically checks for updates and installs any it finds, whether you like it or not. For most users, this new feature is actually very convenient. If you want to control the update process,...
0
7741
agi2029
by: agi2029 | last post by:
Let's talk about the concept of autonomous AI software engineers and no-code agents. These AIs are designed to manage the entire lifecycle of a software development project—planning, coding, testing, and deployment—without human intervention. Imagine an AI that can take a project description, break it down, write the code, debug it, and then launch it, all on its own.... Now, this would greatly impact the work of software developers. The idea...
0
5867
by: conductexam | last post by:
I have .net C# application in which I am extracting data from word file and save it in database particularly. To store word all data as it is I am converting the whole word file firstly in HTML and then checking html paragraph one by one. At the time of converting from word file to html my equations which are in the word document file was convert into image. Globals.ThisAddIn.Application.ActiveDocument.Select();...
0
4372
by: TSSRALBI | last post by:
Hello I'm a network technician in training and I need your help. I am currently learning how to create and manage the different types of VPNs and I have a question about LAN-to-LAN VPNs. The last exercise I practiced was to create a LAN-to-LAN VPN between two Pfsense firewalls, by using IPSEC protocols. I succeeded, with both firewalls in the same network. But I'm wondering if it's possible to do the same thing, with 2 Pfsense firewalls...
1
3052
by: 6302768590 | last post by:
Hai team i want code for transfer the data from one system to another through IP address by using C# our system has to for every 5mins then we have to update the data what the data is updated we have to send another system
2
2341
muto222
by: muto222 | last post by:
How can i add a mobile payment intergratation into php mysql website.
3
2007
bsmnconsultancy
by: bsmnconsultancy | last post by:
In today's digital era, a well-designed website is crucial for businesses looking to succeed. Whether you're a small business owner or a large corporation in Toronto, having a strong online presence can significantly impact your brand's success. BSMN Consultancy, a leader in Website Development in Toronto offers valuable insights into creating effective websites that not only look great but also perform exceptionally well. In this comprehensive...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.