In end-to-end encryption where should the asymmetric encryption keys be created?

I’m playing around with learning encryption with a mini messaging project, so far I can do symmetric encryption (AES) where everyone shares the same key, obviously not secure or ideal, I want to turn learn how to implement a true end-to-end encryption system. I’ve been told RSA is what I should use? My question is,

  • Do I generate the keys completely on the client end in javascript, or is it ok to do the key generation on the server and give them to the client?

  • Where do you store the private key in a website, is using sessions okay? Do i save the private key to storage?

  • Is there a good walk through with examples of implementing something in JavaScript or Python?

Media keys, xfce4-notifyd stops working if headphones are unplugged once after startup, ubuntu 18.04

Following this post: https://askubuntu.com/a/1164973/574240

I was able to get media keys working again by enabling xfce4-notifyd. Brightness and media keys work.

The problem is, if I unplug headphones even once (from either an external sound card, or internal sound card jack), the ability to use media keys stops. The keys won’t change the sound for the headphones. Brightness and other keys still work.

The only resolution is a computer restart to get the notify / volume change working again on the headphones.

Restarting the notify service, nor pulse audio changes this.

18.04 xubunu doesn’t seem to have xfce-volumed or xfce-mixer packages anymore. The new functionality is also fairly frustrating with all of these small bugs with sound.

Any idea how to fix media keys so that even if headphones are re-plugged in, the system will listen for them?

Multimedia keys stop working when you restart Spotify app

I’m using Ubuntu 18.04.2 LTS on Dell XPS 13 9350. The version of the Spotify app I’m using is 1.1.12.449.g4109e645. On startup of my PC, if Spotify is the only music app I open, the media keys work with Spotify whether I’m in the Spotify app or not. As soon as I close Spotify or I open another media player, the media keys stop working with Spotify. Even when I close every media player including Spotify and open Spotify alone, the media keys don’t work with Spotify. It only works again when I restart my PC. Please, is there any solution for this?

I’ve tried using this solution: Send media play/pause shortcuts to music player rather than video player. But my settings doesn’t let me use media key play/pause as custom shortcut

Xubuntu 16.04 -> 18.04 media keys don’t work, brightness keys are very laggy to enable

There are other posts on this, but nothing seems to help.

Before when changing volume with media keys, you would see a little overlay (in the color you select in your theme) that shows the adjusted volume.

Brightness keys also had this.

Now in 18.04 upgrade for xubuntu, volume media keys just don’t work, and brightness keys are extremely laggy.

Is this as known bug, or what are possible solutions to this?

My only guess is programs used to do this are disabled, or the polling for these events is extremely delayed, or configs changed.

Any help would be appreciated!

What is the gsettings schema for Settings > Universal Access > Sounds Keys

look I’m using Ubuntu 19.04 and currently trying to enable the sound keys from a command line but not sure where to look for the schema. At first, I thought it was gsettings set org.gnome.desktop.sound event-sounds "true" but I don’t think that was it. I’ve tried to browse for it throughout dconf-editor but still has no idea where it’s at; not to mention googled for the information many times. Thanks in advance!

Is it a security risk to give out ssh key and one of or both public and private keys to my webhosting provider?

My web hosting provider requires my ssh password and one of or both private and or public ssh keys to setup ssh access. This seems like a security risk to me. Aren’t private keys supposed to stay on your machine. If I gave out my ssh password couldn’t they just create my private and public keys themselves? Wouldn’t that allow them access to my machine? Or am I mistaken?

For clarity: it’s on the hosting providers website that they are asking for the ssh key and one or both public and or private ssh keys in a web form not an error openssh terminal connection or human interaction. They have two text areas that you can choose one or both and they are for your public and private keys. Then they have one mandatory text area for ssh key.

Im used to gaining access to sites that allow ssh by only giving out my public key so this seems fishy.

Also hoping this falls under risk management as Im trying to understand if this is a risk to my machine.

screenshot from webhost asking for public and or private keys and passphrase

Generate API keys with JWT and regenerate the same key when needed

I recently found my self in need of developing a public API for my application. I developed my application with node.js and MongoDB. After some research, I decided to use jwt for generating API keys for users and authentication. For authenticating jwt tokens, they come with the benefit of not needing to store them in a database, as they can be decoded and verified without knowing the exact generated token.

But I see that lots of applications show the users their API keys in the application dashboard, so I need to store the token to show them to the users later on. I know that storing tokens is a bad idea and in case of a database breach, it could let the hackers impersonate others with the API keys.

So long story short I am trying to find a way to not to store the exact tokens, but store only the payload in the database and every time users request their API keys I just generate the same one with a SECRET and pass it to them. I currently find that if on the signing token step, I pass the same payload with the same iat (issued at) every time, the generated token will be the same every time. So by saving the iat with the payload data in the database, I can generate the exact token every time.


Now my questions are:

  • Does this approach is good or is there a better way to achieve this?
  • Is there any good practice for generating API keys without storing them?
  • Does this even necessary (considering if there ever be any database beach, all of the data is already stolen)?
  • Is there any method other than using jwt to achieve this?

Stuck keys but not really stuck

This is my first post so I apologize in advance for any grammar error, missing information or if there’s too much info.

I have an old Dynabook b452/22gm currently with no OS installed. It wasn’t dual boot, only Ubuntu was installed.

This has been going for the last 3 days and since this is a very specific problem, I need help.

At first my laptop suddenly wouldn’t boot the OS, going directly to the bios setup. I thought I had a bad hard drive so I took it off the laptop and plugged a new one. Same problem. Then plugged my hard drive running Ubuntu 19.04 in my Desktop PC. Hard drive worked perfectly.

So it’s not the hard drive.

Then I thought it could be the bios battery, because the time and date were messed up. Got a new one and didn’t solve the problem.

I thought it could be some poor bios configuration so I went searching, did all kinds of trickery with safe mode, unsafe mode, boot order, CSM boot, UEFI boot.

Nothing.

Then I found boot-repair in my searches that at first solved it, but I went to bed and when I woke up with the same problem.

I noticed that when the screen is flickering, I could see the commands the machine were running and between these commands that were most visible on the boot-repair screen were some weird slashes…

“[[[B^[[[B^[[[B^[[[B^[[[B^[[[B^[[[B^[[[B^[[[B^[[[B^”

I didn’t suspect many keys could be firing between the commands so I thought it was part of what should’ve happened but gave it a try and disconnected the keyboard from the motherboard and miraculously it worked perfectly.

The problem is that those keys aren’t physically stuck, they only do this during the booting stage, when I manage to boot it, it doesn’t EVER happen with the OS running.

What could it be?

Thank you very much if you read it all!

Is sha256 a good function to derive keys from a secret of sufficient length and entropy?

Assuming I have a secret key of sufficient length and entropy (I get to decide the length and have a good random source).

I would like to generate 256 length keys by hashing the root key with the name of each key, ex:

key1 = sha256(rootKey +"key1")  key2 = sha256(rootKey +"key2")  ... keyN = sha256(rootKey +"keyN")  

Is the sha256 hash a good choice ?

If yes, what length should the root secret be ? I’m thinking 256 bit is pretty good, but it wouldn’t cost much to make it bigger…

Shortcut keys for commands in Gnome Terminal

What I need are buttons in my Gnome Terminal to which I can assign commands I want, so when I click on the specific button, a command is executed in a terminal tab I’m at.

I’ve been looking for this all over the internet for the past few months and was unable to find it. And I really not even know how do I search for this I always find irrelevant results…