For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

-4
votes
2answers
185 views

How do remote programmers working on proprietary software go about securing their work/source code? [on hold]

I was just wondering what kind of protocols a software engineer would go through if they were working at home for a company developing proprietary closed source software. Would you use a third party ...
0
votes
0answers
36 views

SQL Permissions differ in SSMS and ASP.NET? [migrated]

I have created a schema and user called "WebAPI" which is used by ASP.NET project to get stock levels. So, I have simple stored procedure: SELECT p.ProductCode, SUM( sl.Qty ) AS 'Qty' FROM ...
-3
votes
0answers
98 views

Is the bug that introduced the Heartbleed security flaw really trivial? [closed]

The Heartbleed flaw is a serious security threat that may expose a lot of useful information to hackers and spying agencies (Hello, NSA), I do understand that. So this question is not about the ...
3
votes
1answer
304 views

Which automated analysis tools can find the heartbleed bug? [closed]

After reading this description of the infamous heartbleed bug, and how the OpenSSL team is relatively small and lightly funded, I'm wondering: would this bug have been uncovered by coverity, valgrind ...
0
votes
0answers
58 views

Is my application secure enough

first of all, I don't have any code to display in my question here, because I'm still designing the application structure, so i only got design developed. I'm building a phone application that I'm ...
-2
votes
0answers
108 views

How to explain the heartbleed exploit to apathetic people while making sure it is patched up in software I am responsible for [closed]

openssl.org is getting hit pretty hard and is not responsive right now and may be for some time. What options do I have to get libeay32.dll and ssleay32.dll patched for my clients right away? Also, ...
0
votes
1answer
66 views

What are security advantages of Google Caja over using the web worker API? [closed]

I am currently looking into Google Caja to run user-supplied JS code in the browser and in Node. So far, I understand, that, in a browser context, "cajoled code" disallows reading and messing with ...
0
votes
0answers
31 views

Using PC's MAC address to allow access to PHP program [migrated]

Our PHP program runs in a web-server but we wanted that only PCs with a pre-identified MAC address can access it and update their data using the software program. Thus, any PC with a non-registered ...
1
vote
4answers
125 views

Is secretive systems development really possible?

An agency wants to develop a highly secret computer system using public contractors. So they hire different companies to implement different components of the system. When all the components are ...
-2
votes
2answers
158 views

Securing PHP source code from illegal copy [closed]

my IT boss asks what is the best way to secure the PHP source code against illegal copy of the code once it is deployed to clients. Is there a PHP compiler that will make the final codes unreadable? ...
1
vote
0answers
130 views

5 year old finds Xbox security bug but how did it get there? [closed]

In this rather cute newstory, a five year old boy found a way round the security and logged into his father's Xbox account. Microsoft send him some games and thanked him, all very lovely. What baffles ...
0
votes
0answers
65 views

Why aren't we all compromised on the internet? [migrated]

Well, I've been thinking about this for a while now. Within the last decade, we've used various ways to make our websites look dynamic and live. For example, in JavaScript, it's quite easy to send ...
1
vote
2answers
105 views

Is displaying an HTML email a security risk?

I am writing a simple webmail where I want (obviously) to display the emails. I'm wondering if I should take any precaution while displaying HTML emails: is dumping the email content into a ...
10
votes
6answers
1k views

Why do most sites require email activation [closed]

Most popular applications nowadays require account activation by email. I've never done it with apps that I've developed so am I missing some crucial security feature? By email activation I mean when ...
2
votes
2answers
114 views

When is the private key given to the client? [closed]

http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/ I've been reading the article and I haven't really grasped it yet. When is the private key given to the client? ...
0
votes
1answer
66 views

How do I access databases from a mobile device securely?

I have been doing some research on accessing a DB from mobile devices. There are so many different ways of doing it. There are also multiple ways to make it secure. What is a good way to access a ...
2
votes
5answers
227 views

secure photos on server [closed]

I would like to hear advice from the more experienced developers. The project is now in the design stage. It's mobile application and a simple web application. Content is pictures, comments, personal ...
0
votes
1answer
71 views

Is there a design pattern for updating lists?

I want to modify one list (actually info stored in a database). A person doesn't have access to update every part of the list, but can update and delete parts they do have access to and add whatever ...
1
vote
2answers
180 views

How to avoid unauthorized use of an API?

I have to design a "widget", a script that partners will embed in their websites to display some UI and make calls to our API. Basically it will display our data on these sites based on some IDs they ...
1
vote
1answer
43 views

How is same-origin policy implemented?

I was looking at cross-domain requests for a design and stumbled upon something that puzzles me. From a local site I'm firing an Ajax request to another domain (with jQuery and vanilla ...
1
vote
1answer
50 views

Is this mini-DSL for hiding URI passwords compatible with the URI spec?

Passwords exposed in URIs An application stores URIs to be used for file transfers via SFTP, FTP, FTPS and SCP. Many of these URIs contain passwords, for example: ...
0
votes
1answer
76 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
1
vote
4answers
243 views

Is just using an email address for login a good idea?

Many a times I need to log into a website that I used months ago and have forgotten my password. So clicking the reset password link and the site sends me an email with a single use link which allows ...
12
votes
4answers
781 views

What to do when your company doesn't encrypt passwords

Background I'm been contracted to help a company maintain their server. I work on some minor PHP projects but also look over performance issues and recently, scan logs for hackers. These guys have ...
1
vote
2answers
165 views

Fixing a security exploit - but then everyone knows about it

Earlier, I was messaged about a potential security risk in one of my projects. I checked it and found that it allows for "arbitrary code execution". (Quotes because it is running in a VM, but the ...
1
vote
1answer
167 views

How important is an SSL certificate for a internal website?

I know many people have asked the same question but I think it really depends on the type of the website. So that's why I am asking the question about my website. I am developing a PHP web ...
1
vote
1answer
95 views

Is masking really necessary when sending from Websocket client

The current Websocket RFC requires that websocket clients mask all data within frames when sending (but server is not required to). The reason the protocol was designed this way is to prevent frame ...
2
votes
2answers
75 views

Security concern regarding web service

I'm currently working on a pet project with two of my buddies. This web service will basic functionality such as Login/Password Modification/Registration etc. All of us are comfortable with jQuery ...
0
votes
2answers
134 views

How can I solve this potential security exploit (concerning the saving of REST resources)?

I have a File database table with the following columns: Id (PK), Filename And a Document database table with the following columns: Id (PK), Name, Description, FileId (FK) When a user wants to ...
0
votes
1answer
57 views

How to provide data to a web server using a data warehouse?

We have data stored in a data warehouse as follows: Price Date Product Name (varchar(25)) We currently only have seven products. Once every business day, seven new data points are added ...
0
votes
1answer
101 views

Do we have any special design considerations for maintaining anonymity in an application?

This is an open-ended question which I am analysing while doing some fun projects in leisure. Websites like Google, Facebook do store user activities and perhaps sell them or use them for ...
3
votes
1answer
277 views

Is it possible to protect json api scraping using random tokens?

I have built a restful json api for an online store using Laravel. I now wish to create an AngularJS app to run the front-end web application. Product prices for my store need to update every second, ...
23
votes
6answers
2k views

How is major software protected? [duplicate]

I am a new software developer and I wish to sell my software. I recently realized that from C++ code we can not stop the user seeing parts of the code that are related to scripts or system commands. ...
8
votes
5answers
538 views

Where to store the private key?

Say I want some parts of my software to be encrypted. For example, the credentials for a database, etc. I need to store those values somewhere, but doing so in cleartext would make it easy for an ...
1
vote
4answers
280 views

Is securing the credit card data is considered a requirement from the customer

I'm taking an Introduction to Agile Software Development course, The instructor was discussing an example about online store and asked us to write the User Stories and the Conditions of satisfactions ...
2
votes
3answers
153 views

Is it possible to check a client side application identity from server side? [duplicate]

Assume there is a web service which is visible publicly but it must be just responsive to a specific client application. Is there any mechanism to check client side application identity to prevent ...
1
vote
1answer
203 views

Is it an implementation of a stateful mechanism for Rest API authentication?

In many articles about Rest API's best practices, it is recommended to not depend upon sessions on server side since it leads to a stateful mechanism. I currently use Play 2.2 framework, with a ...
0
votes
0answers
43 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
11
votes
7answers
677 views

Why do modern websites still insist on archaic username/password requirements? [duplicate]

I was signing up for a website last night, and once again was greeted with the fact that my username cannot contain certain characters (including spaces), and neither could my password. Is there a ...
3
votes
6answers
481 views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
3
votes
2answers
240 views

Would using rainbow tables to detect weak user passwords feasible?

As I understand in most security breach where the list of hashed password are compromised, attackers do use brute-force to try to find weak password and, invariably, they always find quite some (like ...
23
votes
9answers
1k views

Why not expose a primary key

In my education I have been told that it is a flawed idea to expose actual primary keys (not only DB keys, but all primary accessors) to the user. I always thought it to be a security problem ...
1
vote
2answers
200 views

How do I dissuade users from using the same password with similar systems?

I'm building a web application that connects to other web services (using strictly anonymous binding, so no user passwords are being used). However the web application maintains its own users itself, ...
2
votes
1answer
334 views

Does facebook store multiple password hashes for each user? [closed]

I noticed that Facebook allows multiple variants of my own password : My password as it is. My password with first letter capitalized. My password with all letters capitalized. It is commonly ...
28
votes
5answers
947 views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
1
vote
2answers
88 views

Recommended secure approach to confirming an URL is called by a legitimate caller

I'm using a CRON on AppEngine and the cron calls my web app at a specific app. I only want to execute functionality when called by my AppEngine app. What's is/are recommended approach to confirming ...
0
votes
1answer
137 views

Making Agile and DevOps methodology compatible with PCI requirements [closed]

Would like to hear from those working in a PCI compliance environment and is practicing agile development and devops methodology, how you maintain compliance with PCI requirements. Specifically, what ...
2
votes
1answer
144 views

Approach to Authenticate Clients to TCP Server

I'm writing a Server/Client application where clients will connect to the server. What I want to do, is make sure that the client connecting to the server is actually using my protocol and I can ...
9
votes
5answers
1k views

How do web servers enforce the same-origin policy?

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
2
votes
2answers
152 views

Principles of an extensible data proxy

There is a growing industry now with more than 30 companies playing in the Backend-As-A-Service (BaaS) market. The principle is simple: give companies a secure way of exposing data housed on premises ...