In short:
1) Nxt Account Private Keys are 50 chars randomly generated by cryptographic standard algorithm
2) Keys are AES 256 encrypted twice. One time using a site-wide private AES key and one time using the user's salted password.
3) Only SSL is allowed through the site
If an attacker ever gets on hold of my database, they won't be able to decrypt the account private keys without having both the user password AND the site-wide AES private key.
No system is 100% safe, we all know this. But I think this wallet is much safer than simply using brain wallets (as it is today). Humans are not very good in creating and then storing truly random passwords.
1) Nxt Account Private Keys are 50 chars randomly generated by cryptographic standard algorithm
2) Keys are AES 256 encrypted twice. One time using a site-wide private AES key and one time using the user's salted password.
3) Only SSL is allowed through the site
If an attacker ever gets on hold of my database, they won't be able to decrypt the account private keys without having both the user password AND the site-wide AES private key.
No system is 100% safe, we all know this. But I think this wallet is much safer than simply using brain wallets (as it is today). Humans are not very good in creating and then storing truly random passwords.
Sounds good.
What is the cryptographic standard algorithm for creating the passwords?
Linux's urandom whch uses environmental noise from drivers to generate truly random numbers.
Thank you.
This should be the certificate fingerprints:
sha-256: 15 0B D5 E2 89 C9 73 4A D5 89 29 07 10 28 22 F4 4B 8F 9B 72 90 B9 58 AF 47 73 E7 98 7B BD 0C 79
sha-1: 88 5F 57 E9 93 51 F9 48 96 9F 1A 31 A6 B9 93 C9 8E 28 3E A0
issued on 2/2/14
expires on 2/3/15
I think that should be enough data for everyone to decide whether they trust you and the security of the server.
Am I right that the physical device is in the cloud?
yes, thanks.What do you mean by "device is in the cloud"?
).
.
in online.