security – Codes And Notes

Published on 13 January 2020

Generate SSH keys using Ansible

By Diego , In Ansible, Code, DevOps

This post proposes a couple of techniques to generate SSH keys on your local host machine, using Ansible. Always useful when configuring your servers!

Published on 11 June 2019

Elliptic Curve Cryptography with OpenPGP.js

By Diego , In Code, Javascript

PGP encryption is not only about RSA keys. Elliptic Curve Cryptography (ECC) offers another twist on the subject, requiring smaller key sizes to provide an equivalent level of security.

Published on 29 March 2019

OpenPGP Integration (Java and JavaScript): PGP exchange between Java and JavaScript

By Diego , In Code, Java, Javascript

At last! It was about time! Allow me to bring a conclusion to our experiments in encryption. Let’s use what we previously learned about working with PGP on Java and JavaScript and make the two exchange PGP messages.

Published on 10 November 2018

OpenPGP Integration (Java and JavaScript): OpenPGP.js

By Diego , In Code, Java, Javascript

So far in this series of posts we have examined how to handle PGP encryption’s core tasks in Java. We now move to the front end side and examine the incredible power of OpenPGP.js !

Published on 04 September 2018

OpenPGP Integration (Java and JavaScript): Java PGP encryption

By Diego , In Java

In the previous installment we examined how to generate PGP keys using Java. Now that we have those, we can start encrypting! This post examines how to leverage the excellent Bouncy GPG library to make Java PGP encryption as easy as it gets.

Published on 17 July 2018

OpenPGP Integration (Java and JavaScript): Java keys generation

By Diego , In Code, Java

Last time we examined whether Efail and SigSpoof were a game breaker or not. Spoiler: it’s not half as bad as it was claimed. Today we will get our hands dirty: we will implement OpenPGP key generation in Java with BouncyCastle’s seminal library.

Published on 18 June 2018

OpenPGP: no, it’s not broken yet

By Diego , In Code, Opinion

You may have noticed: encryption has received some bad rap lately. I’m talking about Efail and SigSpoof of course, two flaws that impacted OpenPGP-based applications such as GnuPG, Enigmail, etc. Does it mean that OpenPGP is broken?

Published on 18 December 2017

From stateful to stateless RESTful security using Spring and JWTs – Part 7 (Reference material)

By Diego , In Code, Java, Spring

To complete this series about stateless security, I decided to take a bow and list all the blogs posts and websites I’ve studied to get here. If you’re looking for more information on stateless authentication and JWTs, this might be a good place to start from!

Published on 17 November 2017

From stateful to stateless RESTful security using Spring and JWTs – Part 6 (Should I go stateless?)

By Diego , In Java, Opinion, Spring

After a small pause, I resume our exploration of stateless RESTful security by asking THE big question everyone should consider when deciding to go stateless: is it worth it?

Published on 16 October 2017

From stateful to stateless RESTful security using Spring and JWTs – Part 4 (JWT-based authentication)

By Diego , In Code, Java, Spring

Previously we have managed to finally get rid of that Session object and transform our RESTful API security to leverage a stateless authentication solution. We replaced our beloved JSESSIONID with a simple string of text, a token, that allowed us to identify a user. But the solution we used is not secure at all. We still need to find a token with the right characteristics to be safe enough in this world of leaks and breaches. Enter JWTs…

Tag: security