For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

14
votes
6answers
2k views

Are private, unguessable URLs equivalent to authentication?

I want to expose a resource on the web. I want to protect this resource - make sure it is only accessible to certain individuals. I could set up some kind of authentication. For example, I could only ...
-5
votes
0answers
26 views

How to secure code of Java web project? [duplicate]

I am working on one application java/jsp application. I want to package this project in a way so that ONLY intended tomcat can decrypt and deploy it ? What are the possible ways to achieve this ?
0
votes
0answers
22 views

Seeking advice on accountsecurity in mobile application

I have the idea of developing a lightweight application that provides people playing a specific game (League of Legends) with VOIP. The appplication flow goes like this: User enters lol accountname ...
0
votes
1answer
28 views

Secure communication between a mobile app and a microcontroller

I have a MCU-based design that essentially controls other hardware and this MCU is controlled through an app. I was hoping someone could help me figure out how to secure this communication between the ...
5
votes
1answer
166 views

Why is it more unsafe to store your password in the URL of a git repo?

As a comment on a response to this question, someone says: It is not advisable to put the password in the URL for this file is saved on the .git/config . Is not safe, it is better to use ssh key ...
0
votes
0answers
22 views

External User ID to Internal User ID

There is an internal API, REST client over DB, all of which methods require User ID as parameter. User ID is an integer value - numeric PK in User table. Also there is an public API, that is like a ...
2
votes
3answers
140 views

Data from devices with unreliable clocks

Are there any viable approaches to dealing with data coming from devices with unreliable clocks? We have a database system running on a central server. The latest addition to the system is a bunch of ...
1
vote
1answer
52 views

How to implement a secure way to allow users to reset password via url?

Password reset option should be given only if the link has come from that specific user's inbox and not from somewhere else. How to implement url in such a way that the required information i.e. ...
5
votes
1answer
136 views

Is NuGet vulnerable to this typosquatting attack?

A recently-published article demonstrates a way to make "typo-squatting" attacks on popular programming package managers. It singles out Python's pip, Ruby's gem and Node's npm systems, and shows ...
2
votes
3answers
124 views

Preventing abuse of a RESTful Web API (can the server trust the remote IP address?)

I'm designing a RESTful API for my organization. We do use password-based authentication, which generates tokens. One part of our API requires that the users be physically in the office, i.e. there is ...
0
votes
1answer
47 views

Hash system to generate same (specified) hash from multiple datasets?

I have a hashed value X and need to ensure that any of the data sets D1...Dn can be concatenated with a correctional value C1...Cn and passed into a hashing algorithm to result in the value of X. ...
0
votes
1answer
45 views

Extensible web application where users can upload client-side code

I have a simple web application built with Angular which fetches some state from a web server and shows it to the user. Additionally I want to implement a feature where users are able to customize the ...
0
votes
2answers
58 views

Can a website get user details if the site is using facebook account kit to log in?

Is it possible to for a website to get my number and email id if they are using facebook account kit to verify users without facebook accounts.And how to collect the user details accessing this ...
4
votes
3answers
130 views

How to store uploaded client documents securely in webapplication

A small company without any IT skills wants to run a web application where customers can enter various bits of data and upload pdfs. The documents regard product specifications and have to be kept ...
0
votes
0answers
56 views

How do I build a policy in ASP.NET MVC 5 (or 6) with AuthorizationPolicyBuilder that incorporates an IP address?

I have been studying this, https://leastprivilege.com/2015/10/12/the-state-of-security-in-asp-net-5-and-mvc-6-authorization/ and on that page, public class Startup { public void ...
0
votes
0answers
38 views

Are there any JSON based notations for Access Control Lists? (Alternative to S-Expression)

I'm looking for a notation that is familiar to modern developers and can supersede s-Notation. (additional insight into Rivest's proposal of s-Expression is here) Is there any Swagger, JSON or other ...
0
votes
3answers
81 views

Preventing information leakage while returning an error message

Say my website contains 2 functions: Allow a user to change their own password Allow an administrator to change a user's password (the user must change again before they login) Now let's say that ...
1
vote
0answers
23 views

From PreAuthentication to JWTAuthorization

I would like to ask about a problem I have designing a security flow. The context I have a webapp designed in two modules web and server Web: it's a single page client, built with Angular 1.5.5 (...
2
votes
2answers
59 views

JWT refresh token exponentially?

This is how I do my JWT refresh token: A token is check for validity every time a request is made. If it's not expired, allow access. If it's expired calls another function named RefreshToken to ...
1
vote
0answers
23 views

When do I reset Two Factor Authentication secret keys?

I have built a simple authentication system for my web application that makes use of the open-source time-based OTP algorithm (RFC 6238). The key for each user is generated when the user is registered ...
-2
votes
1answer
85 views

In what way does programming help towards cyber security [closed]

I've been studying the cyber security field with great interest. I understand how networking can help cyber security but I am not sure how advanced programming knowledge can help fight cyber crime or ...
7
votes
2answers
177 views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...
0
votes
1answer
64 views

Universal Form Handler

I'm building a API that gets called from web / mobile applications written using Ionic (web languages on mobile), which uses Angular.js. We want to be able to do server side validation of forms but ...
0
votes
0answers
49 views

How to deal with it that not all HTTP response headers reach the browser?

Some companies use firewalls that filter unknown HTTP response headers. I've personally witnessed that a page used the default font instead of the chosen external Google font because the firewall was ...
2
votes
0answers
63 views

Technique to passively take down a host on the network [closed]

I am developing a program which is to be installed on a "simple" machine in a LAN, the only particularity is that the NIC are connected on mirror ports. The software can scan and monitor the network. ...
0
votes
0answers
42 views

How to use Integrated authentication for a user other than the logged in user?

I have a Winforms .net app that requires a user to login to our app. I want to use integrated database authentication, but the user logged in to the app may be a different (Windows/Active Directory) ...
0
votes
0answers
20 views

Where to store authentication/authorization entities with respect to crosscuting concerns?

Can you explain me how and where to store authentication/authorization entities in project structure. For example I have 4 projects in my solution in Visual Studio: SolutionName.WebApp SolutionName....
2
votes
2answers
169 views

Securing my own software… against myself?

I do a lot of programming work for other people's businesses. I am currently working on a project for my local Scouts group that I have worked with before. The problem is I have built them their ...
0
votes
1answer
264 views

How to secure my authentication code?

I'm working a PHP project where I need to authenticate users to a portal. Just wanted to get your opinion on the code, statistics of the website show some strange behaviour with the login form. ...
1
vote
2answers
108 views

Best ways for startups to handle sensitive user information [closed]

Many companies struggle with even basic sensitive information handling. One screaming example I can give is the attack on TalkTalk's servers resulted as 4 millions customer's personal information ...
1
vote
2answers
54 views

Why can't the Synchronizer Token Pattern be circumvented?

The synchronizer token pattern is the most effective protection against CSRF attacks. I understand the theory and implementation, but I do not understand why it can't be circumvented. Generally, the ...
2
votes
1answer
83 views

How to encrypt communication without hard coding key in client?

I've found description of vulnerability here. The kankun smart socket device and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app....
1
vote
0answers
23 views

Securing an Azure Service Bus topic and subscriptions

We are working on a solution that will publish messages on an Azure Service Bus topic but we don't know yet which other team or even third party might be interested in subscribing to those messages in ...
3
votes
3answers
272 views

Modern recommendations for password recovery

I'm going to implements password recovery in my authentication. I haven't put this together in a while and wondering if there is anything I ought to be aware of. My idea at the moment is: User ...
0
votes
2answers
74 views

Handling delay in entry of OTP for log in validation

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...
0
votes
2answers
36 views

Secure authentication using JWT

I read about JWT and how they can provide secure authentication for calling api routes over http. I naively implemented it and here is how it goes : a client posts username and password to a login ...
0
votes
2answers
192 views

Is providing a user login a functional requirement of a system?

Is providing a user login a non functional requirement? Since this is concerned with security which is a non functional requirement, I feel that providing a user login is also non functional but ...
0
votes
1answer
75 views

Question on password hashing security

I'm about to add some user account and password functionality to my software, so I'm reading about password hashing. So my understanding is Hashing is a one way function, and it works like this: ...
0
votes
0answers
57 views

WCF security with Java client

I'm about to develop a WCF service which is going to be called by an external Java client. I've developed a couple of services before but they were called internally, so security is now a concern. ...
2
votes
0answers
67 views

Windows Phone 8.1 & above - is there some equivalent for Apple's keychain

I want to store store some app specific secret on the phone - this should be available only for the app & no other app. I was looking at DPAPI - however, if the user does not have a logon ...
4
votes
2answers
240 views

Having an discussion about security concerns with another software engineer [closed]

Background: The company I work for uses different systems to hold their insurance data which is customer related. They want to have an app for their customers where they can find their insurance ...
2
votes
0answers
66 views

Client Browser, Node Server, Web API auth structure

I have a web API that accepts Authorization headers to allow access. It responds with the requested data in addition to setting a session cookie. Subsequent requests can be made with no auth headers ...
2
votes
1answer
96 views

Postgres roles for website users

I am setting up a PostgreSQL database with a very small number of tables for a simple website. I am looking at ways to make it as solid and auditable as possible. Is there any particular reason why ...
1
vote
0answers
33 views

Correlating Search Classifiers in a Database Scan for Sensitive Information

Problem Description I am working on an enterprise data discovery project that is designed to scan databases for sensitive information. The basic search unit is called a classifier and covers things ...
0
votes
1answer
124 views

Strategy for Public / Private API, Encrypted (or Hashed) Data, and Server Compromise

In this very simplistic but realistic scenario, I have 2 combo web/database servers (A) behind a load balancer and a single IP address. They also permit access only from one IP address -- the client (...
2
votes
2answers
192 views

ASP.NET storing encrypted & salted Password

I have a question about storing encrypted passwords in your database to help secure them. I have a class that encrypts the password passed in and returns a string. This string has 3 parts too it, all ...
3
votes
1answer
130 views

How do large corporations store API keys?

When FaceBook or Google give me an API key, are they just storing it in a database? Unlike a password, where you can hash and salt it before putting it in the database, it seems to me that a key ...
-2
votes
2answers
97 views

Tables vs. Booleans: Which of the two are more secure for setting admin roles in an app? [closed]

I'm currently in the process of setting up roles where there are regular users, admins, and super admins, each of which have special permissions. I deferred to this post on how to do so. It ...
1
vote
1answer
91 views

Access rights through database table

I made a login system with access rights (ASP.NET WebForm) and I store the info's in a database table. I don't use the built in feature of asp.net like Forms authentication and webconfig. My question ...
3
votes
1answer
135 views

Using SMS as transaction in offline situations

Currently, I have this hybrid mobile application which talks to my C# web service to do CRUD transactions. As the mobile application is always on the go, and there might not have internet connectivity ...