For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

0
votes
1answer
25 views

Whats the best way to build a HTML/AJAX site that requires login?

Let's say that hypothetically you wanted to build a website that delivered content to the visitors entirely using HTML and Javascript (AJAX to fetch server side data). The site would require login for ...
0
votes
1answer
40 views

secure offline PC storage accessible through javascript

I'm attempting to build a browser-based HTML5 application that has the ability to store data locally on a PC (not mobile device) when offline. This data is sensitive and must be secure. Of course the ...
0
votes
0answers
52 views

Malicious Code Mitigation/Discussion [on hold]

A couple days ago, while reading the news on various current events from several different news websites, a window popped up and filled my screen. It was one of those malicious websites that ...
0
votes
2answers
187 views

Preventing ip resolvers in a skype-like program

I'm currently in the process of creating a Skype-like program, that uses a hybrid peer to peer system to communicate between users (i.e. server contains all users IPs, a client that wants to connect ...
0
votes
0answers
13 views

Online Shopping password keylogger risk [migrated]

Suppose I do an online shopping they are asking me to enter my card details like four digit number(whatever related to that) and they are asking me to enter the PIN number too. If I enter all this ...
0
votes
0answers
31 views

Zend framework 2 authentication - only storing the user ID in session

I've just put together my first app using Zend_Authenticate. According to some tutorials I've read they store the user's "email" column. Is this recommended? I've read to store the ID only, then on ...
1
vote
1answer
20 views

Privilege (Access/Permission) Control for Hierarchial Structured Resource

Question: Is there any standard model or industry defacto implementation for modeling and implementing Access Control in (i.e.) a Document Management System? Note: I studied a bit the security ...
0
votes
0answers
15 views

Best approach for storing banking information [migrated]

I am currently developing an auction desktop application. At the moment I am storing the buyer and vendor information in 2 separate tables within a MySQL Database. Currently the data for these tables ...
1
vote
2answers
169 views

Best way of storing a small number of user credentials

I'm working on a messaging application, based on a server/client architecture. Now I am thinking about the way how to store the user credentials. It's not a huge number, just about 20 entries with ...
3
votes
4answers
385 views

How to store Role Based Access rights in web application?

Currently working on a web based CRM type system that deals with various Modules such as Companies, Contacts, Projects, Sub Projects, etc. A typical CRM type system (asp.net web form, C#, SQL Server ...
3
votes
4answers
91 views

Can I save & store a user's submission in a way that proves that the data has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
7
votes
1answer
134 views

Securely sending data from shared hosted PHP script to local MSSQL

I'm trying to add data from a webhook (from a web cart) to a local Microsoft SQL Server. It seems like the best route for me is to use a PHP script to listen for new data (POST as json), parse it, ...
1
vote
0answers
41 views

Handling permissions in a MVP application

In a windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as basically its implementation should be ...
0
votes
0answers
38 views

Access Token Verification

I have spent quite a few days reading up on Oauth and token based security measures for REST API's and I am currently looking at implementing an Oauth based authentication approach almost exactly like ...
1
vote
1answer
156 views

Naming in Security Protocols: Alice, Bob and Eve

Among computer scientists and programmers, there's the common habit of naming people in the context of security protocols e.g. Alice, Bob or Eve. Descriptions of more elaborate attack vector sometimes ...
0
votes
1answer
65 views

Securing web services [duplicate]

How to approach securing webservices? I can think of using one of the two approaches below sending a user name password in every request for validation Sending a time based token (GUID or some ...
1
vote
1answer
93 views

Password reset process

So I'm working on my first password reset mechanism. I'm going with what I understand to be a fairly common procedure: User clicks "Forgot Password" User is prompted for email address If the entered ...
1
vote
1answer
121 views

What Kind of Source Control Do High Security Projects Use? [duplicate]

I was just reading this slightly older post on choosing a good source control system when I started thinking about how different projects use source control. Where I work we've essentially moved ...
0
votes
2answers
42 views

Hashing + security as it pertains to a theoretical file sharing site

These days it's possible to hash a file client-side, send the hash to the server, and have the server check whether or not that file is already uploaded. If it is, we can skip the file upload and make ...
0
votes
0answers
34 views

Online error reporting without network access

I have developed an application for android requiring no permissions, but the biggest downside of this is that I don't have error reporting. So, I was playing around for the past week with any ...
0
votes
1answer
121 views

What is the proper way to extract and pass parameters to call javascript functionality from my PHP page?

This is my situation: I have a search results page in PHP where most of the logic resides in a javascript file in order to avoid refreshing the page every time an action is performed. The first thing ...
2
votes
2answers
87 views

What are some best practices for securing AWS credentials (or other secrets) for large team?

I was "that guy" that pushed his aws keys to github. Ugh. Anyway, I'm doing some research on how to prevent this in the future as this is the third time I've seen this done (my first!) and it was just ...
2
votes
1answer
158 views

Standard ways of revoking user access to a site

I'm in the process of building a .NET MVC website where a requirement is that admin users should be able to lock accounts to not only prevent future log-ins but to also immediately revoke access to ...
1
vote
2answers
59 views

Hide admin menu if no admin option is available

If you have a menu "Admin tasks" and different admin tasks (like 10) that you could separately assign to each user, but there are users who don't have any admin tasks, how would you deal with "Hiding ...
0
votes
2answers
148 views

Are random number generators security holes?

If I retrieve a random number from a database (e.g. RAND() in SQL Server) or using a programming language and send this in some form back to a client machine, is there an economic chance I will be ...
0
votes
0answers
26 views

Domain security involving domain logic

Together with my application's domain logic I am trying to outline the security model. I am stuck with a requirement that prevents me from considering security just a cross-cutting concern over my ...
-1
votes
1answer
110 views

Prevent 3D model from being copied [closed]

So I have been messing around with thingiview since I wanted to have a 3D viewer for the models on my site. It works great and everything except one problem. It's nothing wrong with thingiview, it is ...
1
vote
1answer
62 views

Implicit OAuth2 endpoint vs. cookies

I currently have an app which basically runs two halves of an API - a restful API for the web app, and a synchronisation API for the native clients (all over SSL). The web app is completely ...
1
vote
1answer
103 views

Is it safe to generate client nonces using random number generator?

I am making HTTP calls on the client side and the server expects me to supply a client nonce. It needs to be 4 bytes long. I am planning to use this combination: base64(parts of the MAC address + ...
0
votes
1answer
136 views

Browser security and payments

I've been finding a lot of blog posts claiming JS encryption is unsafe, here's a couple of detailed ones: http://www.matasano.com/articles/javascript-cryptography/ ...
1
vote
1answer
72 views

How to secure a Django application's source code? [duplicate]

I have developed a Django application for a company. Now I am about to ship it to my customer. After reading through online articles and books, I understood that securing the source code of any web ...
0
votes
1answer
71 views

Encyption for passwords in config file?

I was wondering, if it makes sense to encrypt passwords for external services stored in my config file with an symmetric encryption algorithm? On the one hand I think, if someone gets access to the ...
-4
votes
2answers
219 views

How do remote programmers working on proprietary software go about securing their work/source code? [closed]

I was just wondering what kind of protocols a software engineer would go through if they were working at home for a company developing proprietary closed source software. Would you use a third party ...
3
votes
1answer
375 views

Which automated analysis tools can find the heartbleed bug? [closed]

After reading this description of the infamous heartbleed bug, and how the OpenSSL team is relatively small and lightly funded, I'm wondering: would this bug have been uncovered by coverity, valgrind ...
0
votes
0answers
90 views

Is my application secure enough

first of all, I don't have any code to display in my question here, because I'm still designing the application structure, so i only got design developed. I'm building a phone application that I'm ...
0
votes
1answer
106 views

What are security advantages of Google Caja over using the web worker API? [closed]

I am currently looking into Google Caja to run user-supplied JS code in the browser and in Node. So far, I understand, that, in a browser context, "cajoled code" disallows reading and messing with ...
1
vote
4answers
139 views

Is secretive systems development really possible?

An agency wants to develop a highly secret computer system using public contractors. So they hire different companies to implement different components of the system. When all the components are ...
-2
votes
2answers
189 views

Securing PHP source code from illegal copy [closed]

my IT boss asks what is the best way to secure the PHP source code against illegal copy of the code once it is deployed to clients. Is there a PHP compiler that will make the final codes unreadable? ...
1
vote
2answers
141 views

Is displaying an HTML email a security risk?

I am writing a simple webmail where I want (obviously) to display the emails. I'm wondering if I should take any precaution while displaying HTML emails: is dumping the email content into a ...
10
votes
6answers
1k views

Why do most sites require email activation [closed]

Most popular applications nowadays require account activation by email. I've never done it with apps that I've developed so am I missing some crucial security feature? By email activation I mean when ...
2
votes
2answers
199 views

When is the private key given to the client? [closed]

http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/ I've been reading the article and I haven't really grasped it yet. When is the private key given to the client? ...
0
votes
2answers
98 views

How do I access databases from a mobile device securely?

I have been doing some research on accessing a DB from mobile devices. There are so many different ways of doing it. There are also multiple ways to make it secure. What is a good way to access a ...
2
votes
5answers
248 views

secure photos on server [closed]

I would like to hear advice from the more experienced developers. The project is now in the design stage. It's mobile application and a simple web application. Content is pictures, comments, personal ...
0
votes
1answer
74 views

Is there a design pattern for updating lists?

I want to modify one list (actually info stored in a database). A person doesn't have access to update every part of the list, but can update and delete parts they do have access to and add whatever ...
1
vote
2answers
234 views

How to avoid unauthorized use of an API?

I have to design a "widget", a script that partners will embed in their websites to display some UI and make calls to our API. Basically it will display our data on these sites based on some IDs they ...
1
vote
1answer
54 views

How is same-origin policy implemented?

I was looking at cross-domain requests for a design and stumbled upon something that puzzles me. From a local site I'm firing an Ajax request to another domain (with jQuery and vanilla ...
1
vote
1answer
57 views

Is this mini-DSL for hiding URI passwords compatible with the URI spec?

Passwords exposed in URIs An application stores URIs to be used for file transfers via SFTP, FTP, FTPS and SCP. Many of these URIs contain passwords, for example: ...
0
votes
2answers
169 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
1
vote
4answers
253 views

Is just using an email address for login a good idea?

Many a times I need to log into a website that I used months ago and have forgotten my password. So clicking the reset password link and the site sends me an email with a single use link which allows ...
13
votes
4answers
815 views

What to do when your company doesn't encrypt passwords

Background I'm been contracted to help a company maintain their server. I work on some minor PHP projects but also look over performance issues and recently, scan logs for hackers. These guys have ...