For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

0
votes
1answer
45 views

Periodically polling an API, are there alternatives?

I'm currently working on a service that is supposed to aggregate data from a number of APIs, unify the data, and offer it through another API to the users. I had a couple of ideas for solving this, ...
3
votes
2answers
145 views

Are there any widely accepted sets of standards/practices for secure coding? [closed]

The title should be fairly self-explanatory. We need to update our coding standards, and as part of this process we've been asked to try and follow an industry standard from a ...
0
votes
2answers
78 views

What is the best way to present a portfolio of practice/training security research? [closed]

I keep a security research blog as a hobby, and finding out about all the ways one shouldn't code has helped me a lot in my career as a software developer. I would like to attribute my blog to a ...
-1
votes
0answers
35 views

Making hard to hack java standalone apps [duplicate]

I created an app in java, but this app (packed as .jar) will be distributed to people, and I want to charge for usage of this app. I chose java as I'm unfamiliar with C++, to make a source code ...
1
vote
2answers
97 views

How to send data between HTTP requests without user modifying it?

I'm currently developing a web application (using laravel) where I have a form that edit a resource. Something like this: <!-- URL: /editResource/3 --> <form action="/editResource/3" ...
1
vote
1answer
46 views

Is this type of data insertion safe and can stop sql injection in Python?

I am learning Database connection from MySQL Connector/Python Developer Guide. This is the code I am using to insert data: conn = mysql.connector.connect(user="user", password="password", ...
1
vote
1answer
91 views

Safe serial numbers generation

I want to generate a 6 digits serial number, ranged from A-Z (only uppercase allow), e.g. serial = "ABCDEF" the problem is, some letters are considered confusing to others letters/numbers, e.g. U ...
2
votes
1answer
91 views

NodeJs website webapp architecture

I would like some advice on how best to architect a website comprising the following: tool a landing page, open to the public, main marketing tool the main website/app, that people can access only ...
0
votes
1answer
35 views

How to create work for a client on login

I have a log-in service that runs a CPU-intensive hash multiple times when a user logs in. In order to reduce the effect of a login DDOS, is there any sort of function that I can "ask" that the client ...
1
vote
1answer
259 views

Should I hide certain HTTP status codes?

So I have different seniors taking different positions on this. Some saying hide nothing, those codes are there for a reason. Others saying to hide most status codes, reducing the number to a much ...
4
votes
2answers
178 views

How to prevent third party misuse of what is intended to be a private api (avoiding what happened to Snapchat)?

I have never used Snapchat and do not intend to but I have been reading up about what happened to them with respect to the recent media coverage about pictures being leaked especially because I am ...
0
votes
0answers
75 views

Row and Field level Security Management through Code First EF, WebApi2

I could not find such question specific to asp.net webapi row level security on SO. I am building an API through .NET Webapi2 with Entity Framework. I am trying to assess various options that are ...
0
votes
2answers
246 views

Is JavaScript safe? [closed]

My company has been developing a site for a very large company. The site is now live, and it has received its fair share of hits. The site relies enough on JavaScript to make far less aesthetically ...
1
vote
2answers
59 views

How do I handle a spam server invalidating my tokens?

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
0
votes
2answers
82 views

How does Google manage their Google Images SSL certificate?

When an SSL certificate is installed on a website, but the page also calls content from another website without an SSL certificate, the SSL certificate icon will turn grey instead of green: instead ...
-3
votes
2answers
143 views

Protecting application against piracy [closed]

Can I somehow protect a source available (you can see the source, but you don't have rights to use it) application against piracy? Is it even theoretically possible? Not all of the application has to ...
4
votes
3answers
242 views

How to securely implement Roles in a Windows Form application?

As an ISV, what is considered best practice for implementing Application Role based security? In other words, only allow users to access certain features in the application based on what Roles they ...
0
votes
1answer
103 views

Anonymous access to api REST, protection

I have a public website that does not require authentication. It's a lighting calculator for indoor cultivation. Anyone can enter and complete the process and ultimately save your settings for future ...
1
vote
3answers
266 views

How do you make sure a .net client application is not being hacked to bypass authorization claims?

We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are: CanOverrideSalesAmount ...
1
vote
0answers
71 views

How to limit users of a service to a specific program

I have built an android game - I would like to add a "high score" leaderboard to it, such that people can show off how high they managed to score. How should I design it so that people can't "hack" it ...
0
votes
0answers
45 views

Database conceptual Question [duplicate]

When querying in database through PHP, is it good to open mysql connection before every query and close it as the query completes? or should we open the mysql connection as soon as the first query ...
0
votes
2answers
224 views

Database Handler and SQL injection prevention

I've written a database model class in PHP and have written a controller class that specifically validates the data before sending it to db. I'm getting criticism that I should handle the data in ...
0
votes
2answers
74 views

Making internal search engine return results that adhere to local permissions on an internal web application

I have an ElasticSearch search engine and an internal web application. Prior to applying the security model, search results were very fast. The security model restricts some users from accessing ...
2
votes
1answer
53 views

Security Pattern to store SSH Keys

I am writing a simple flask application to submit scientific tasks to remote HPC resources. My application in background talks to remote machines via SSH (because it is widely available on various HPC ...
1
vote
2answers
364 views

Is hashing of just “username + password” as safe as salted hashing

I want to hash "user + password". [EDIT: prehashing "user" would be an improvement, so my question is also for hashing "hash(user) + password". If cross-site same user is a problem then the hashing ...
0
votes
0answers
15 views

Storing a WCF endpoint in the registry - worried about security

I am storing my wcf endpoint in the registry, and using that whenever my app starts up to instantiate a wcf derived object. The user can change the endpoint location, to another server, and the ...
1
vote
2answers
130 views

How do I / what is the best way to interact with a desktop application from a browser web application?

Situation: We have a desktop application. We also have a web application. We need the two to interact with each other. So when a button is pushed in the web application, the desktop application ...
0
votes
0answers
217 views

Best practice: Secure Android app online authentication

Currently, I develop an Android App needing online authentication for login (and registration). The main focus is on security. I’m amaing for: keeping the users’ passwords safe and preventing MITM ...
1
vote
1answer
73 views

Testing for Authentication loop holes / bugs

We've got a web application which is 99% complete prior to public beta, were currenlty securing the site from security perspective, locking down the server, db etc, one thing I'm concerned about but ...
0
votes
0answers
64 views

Security in Transversal Layer in Domain Driven Design

I'm building a solution based on Domain Driven Design, I'm trying to implement the security system (authentication, authorization, roles, system configuration, connection strings, etc..) in a ...
0
votes
0answers
54 views

How to validate information on server without using database or session

Each user has multiple sites they can access reporting data for in an application I am working on. To prevent having to go to the database on every single request, I validate that they have access to ...
0
votes
0answers
62 views

Token based autorization for a web game

I am lead developer for a multiplayer game in a small startup company. I would like to present here my solution for token based authentication and hear your opinions about possible weak spots. I am ...
0
votes
1answer
41 views

Roles configuration strategy

We're close to start new project using sf2, and, probably, FosUserBundle. Keeping that in mind - what's the best strategy to define roles? App will be used by multiple divisions inside our company ...
-1
votes
2answers
257 views

Whats the best way to build a HTML/AJAX site that requires login? [closed]

Let's say that hypothetically you wanted to build a website that delivered content to the visitors entirely using HTML and Javascript (AJAX to fetch server side data). The site would require login for ...
0
votes
2answers
164 views

secure offline PC storage accessible through javascript

I'm attempting to build a browser-based HTML5 application that has the ability to store data locally on a PC (not mobile device) when offline. This data is sensitive and must be secure. Of course the ...
0
votes
2answers
283 views

Preventing ip resolvers in a skype-like program

I'm currently in the process of creating a Skype-like program, that uses a hybrid peer to peer system to communicate between users (i.e. server contains all users IPs, a client that wants to connect ...
0
votes
1answer
696 views

Zend framework 2 authentication - only storing the user ID in session

I've just put together my first app using Zend_Authenticate. According to some tutorials I've read they store the user's "email" column. Is this recommended? I've read to store the ID only, then on ...
1
vote
1answer
31 views

Privilege (Access/Permission) Control for Hierarchial Structured Resource

Question: Is there any standard model or industry defacto implementation for modeling and implementing Access Control in (i.e.) a Document Management System? Note: I studied a bit the security ...
1
vote
2answers
258 views

Best way of storing a small number of user credentials

I'm working on a messaging application, based on a server/client architecture. Now I am thinking about the way how to store the user credentials. It's not a huge number, just about 20 entries with ...
4
votes
4answers
496 views

How to store Role Based Access rights in web application?

Currently working on a web based CRM type system that deals with various Modules such as Companies, Contacts, Projects, Sub Projects, etc. A typical CRM type system (asp.net web form, C#, SQL Server ...
3
votes
4answers
102 views

Can I save & store a user's submission in a way that proves that the data has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
7
votes
1answer
173 views

Securely sending data from shared hosted PHP script to local MSSQL

I'm trying to add data from a webhook (from a web cart) to a local Microsoft SQL Server. It seems like the best route for me is to use a PHP script to listen for new data (POST as json), parse it, ...
1
vote
0answers
69 views

Handling permissions in a MVP application

In a windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as basically its implementation should be ...
1
vote
1answer
146 views

Access Token Verification

I have spent quite a few days reading up on Oauth and token based security measures for REST API's and I am currently looking at implementing an Oauth based authentication approach almost exactly like ...
1
vote
1answer
308 views

Naming in Security Protocols: Alice, Bob and Eve

Among computer scientists and programmers, there's the common habit of naming people in the context of security protocols e.g. Alice, Bob or Eve. Descriptions of more elaborate attack vector sometimes ...
0
votes
1answer
67 views

Securing web services [duplicate]

How to approach securing webservices? I can think of using one of the two approaches below sending a user name password in every request for validation Sending a time based token (GUID or some ...
1
vote
1answer
111 views

Password reset process

So I'm working on my first password reset mechanism. I'm going with what I understand to be a fairly common procedure: User clicks "Forgot Password" User is prompted for email address If the entered ...
1
vote
1answer
131 views

What Kind of Source Control Do High Security Projects Use? [duplicate]

I was just reading this slightly older post on choosing a good source control system when I started thinking about how different projects use source control. Where I work we've essentially moved ...
0
votes
2answers
47 views

Hashing + security as it pertains to a theoretical file sharing site

These days it's possible to hash a file client-side, send the hash to the server, and have the server check whether or not that file is already uploaded. If it is, we can skip the file upload and make ...
0
votes
0answers
39 views

Online error reporting without network access

I have developed an application for android requiring no permissions, but the biggest downside of this is that I don't have error reporting. So, I was playing around for the past week with any ...