3 ms·

Thank you. Is asking the user to set and remember an encryption string the correct way? The only downside I can think of is that he may forget it, which is irre

• JohnFen 10mo ago
  If your goal is just to do a quick obfuscation, then it would be OK (and better than nothing) just as long as you never claim to users that you're storing the data in an encrypted or secure form. Saying that would lead to a security expectation that you aren't meeting. > Is asking the user to set and remember an encryption string the correct way? That wouldn't be remotely sufficient for two reasons: 1) The user-supplied string will not to be random. 2) You need a constant series of random values that is as long as the data you're wanting to encrypt. If the user is securing a 2k long ASCII text, then you need 2k new random numbers for it.