Handle data and encryption safely
Use encryption and TLS, manage keys, and keep cloud-stored data private.
- Explain what encryption in transit and at rest protect
- Follow how TLS authenticates a server and agrees on keys
- Verify message authenticity with an HMAC
- Explain cloud shared responsibility and recognize unsafe storage permissions
Modern systems combine two kinds of encryption:
- Symmetric (AES, ChaCha20): one shared key encrypts and decrypts. Fast - used for the actual data.
- Public-key (asymmetric): a key pair. Anyone can use the public key; only the private key holder can decrypt or sign. Used to agree on keys and prove identity.
Encryption in transit (TLS, the S in HTTPS) protects data moving across a network. Encryption at rest protects stored data if disks, backups or databases end up in the wrong hands. Neither decides who may read data inside your app - that’s still authorization’s job.
Try it
Up to 15 XPA TLS 1.3 handshake
Step through how your browser connects to https://shop.example.com. Predict the marked steps.
Heartbleed: a memory leak inside TLS software
A missing bounds check in OpenSSL’s heartbeat handling could let a connected peer read up to 64 KB of process memory per request. The flaw was in an implementation, not the TLS protocol itself.
- 01A peer sends a heartbeat request with a claimed length.
- 02Affected OpenSSL versions fail to check that length against the supplied data.
- 03The response can include adjacent process memory.
- 04Operators update OpenSSL and assess whether exposed secrets need replacement.
Keys and signatures
Encryption is only as strong as key management: keep keys in a key management service or hardware security module, restrict who can use them, rotate them, and plan recovery. Encrypting a database and storing the key next to it protects very little.
To prove a message came from someone holding a shared secret and wasn’t modified - say, a payment provider’s webhook - use an HMAC: a keyed hash. Compare MACs with a constant-time comparison (hmac.compare_digest) so timing doesn’t leak how many characters matched.
1import hashlib, hmac
2secret = b"shared-secret"
3tag = hmac.new(secret, b"amount=4200", hashlib.sha256).hexdigest()
4forged = hmac.new(secret, b"amount=1", hashlib.sha256).hexdigest()
5print(hmac.compare_digest(tag, forged))False
Cloud storage still needs an owner
A cloud provider protects its physical data centers and the service infrastructure, but your team still decides who can read your data, which objects are public, how keys are managed, and what gets logged. The exact split depends on the service. This is shared responsibility, not a transfer of all security work to the provider. Google Cloud’s explanation gives the general model.
For a bucket of private customer documents: deny public access, give the application only the permissions it needs, review grants to people and service accounts, and log access. Encryption at rest is valuable but does not prevent an authorized or publicly permitted read. If a user needs a temporary download, a short-lived signed URL can limit access to one object; treat the URL itself as a secret until it expires. OWASP’s cloud architecture guide explains public storage and signed URL trade-offs.
Try it
Up to 15 XPReview a cloud storage setup
This is a fictional admin-console summary for a bucket of private customer documents. Click the settings that could expose the data.
Click every suspicious section. There are 3.
Practice: inspect a certificate
Try it
Up to 15 XPWhy would a browser reject this?
You’re connecting to shop.example.com, and today is 2026-11-05. Click the line that explains the problem.
What’s wrong with this certificate?
Key takeaways
Symmetric crypto encrypts data fast; public-key crypto agrees on keys and proves identity.
TLS checks the server’s certificate and protects confidentiality and integrity in transit.
Protect keys, use HMACs or signatures for authenticity, and compare MACs in constant time.
Cloud customers must configure data access and audit it; encryption does not replace permission checks.
Lesson quiz
8 questions · pass with 6 correct · up to 50 XP
Passing this quiz completes the lesson and keeps your streak going. Questions you miss come back in review sessions later.
Practice: write Python
Write Python in the editor and run it against sample inputs. Python runs locally in your browser using a WebAssembly runtime.
Verify webhook signatures
The first line is the shared secret. Each following line is SIGNATURE PAYLOAD (the payload may contain spaces). Print valid if the signature equals the hex HMAC-SHA256 of the payload with the secret, otherwise invalid. Use hmac.compare_digest.
- Genuine, tampered, genuine
Python runs in a sandboxed browser worker with a 60 second time limit. Its runtime loads from the Pyodide CDN; your code stays in this browser.
Questions about this lesson
Stuck? Ask. Figured something out? Share it. Explaining is one of the best ways to learn.
Loading posts…