For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

4
votes
0answers
80 views

Forgot password and revealing whether account exists [migrated]

So when you hit that forgot password link and enter your email address, it seems that sites (and other programmers I've spoken to) are one of either two mindsets; Notify the user whether or not the ...
2
votes
1answer
167 views

How to *detect* if open source software is used in a commercial product? [on hold]

The established procedure regarding releasing code out in the open is to accompany it with a license. Out of the many flavors that exist (BSD, MIT, GPL, LGPL, Boost ...) there are some that prohibit ...
0
votes
0answers
40 views

Securing HTML/JavaScript only web app / JAX-RS Backend [closed]

I am prototyping a small web app where the frontend will be a pure HTML+JavaScript+JQuery which consumes services from a JAX-RS backend. The application has started to have a shape now but I find ...
2
votes
2answers
109 views

Restful User/Password Authentication

I'm currently designing a REST-API with the following properties: Backend for a single page application (Later Apps) Integrated user database for each instance HTTPS/TLS only Authentication with ...
1
vote
1answer
99 views

Porting security from Java/.NET to PHP

This probably a rather naive question given my limited knowledge in the code I've been looking at, but I want to get my head around it before I start diving into writing actual code myself. I'm ...
1
vote
0answers
121 views

How safe is returning a password from a function? [duplicate]

Is returning sensitive data like a password from a function safe, and what attack vectors exist? (Personally, it is regarding PHP, but is a general question.) function returnDBPass(){ ...
20
votes
4answers
3k views

Why not just make non-parameterized queries return an error?

SQL injection is a very serious security issue, in large part because it's so easy to get it wrong: the obvious, intuitive way to build a query incorporating user input leaves you vulnerable, and the ...
0
votes
0answers
11 views

Checking sftp fingerprint in SSH.Net [migrated]

I'm currently creating an SSIS package where I need to connect to a secure server to copy some files and I would like to validate the connection via the public key fingerprint the server sends. I'm ...
0
votes
0answers
17 views

Should a SPA have a route URL visible in address bar?

I am developing a Angular SPA using angular-ui-route. We are in a confusion of should we have the route visible for User in the address bar or just have index.html (or home page) always ? Is there a ...
0
votes
1answer
149 views

Why are Strings in StringPool considered insecure?

Passwords are recommended to be stored in char[] instead of String, as Strings are stored in StringPool. Read more here As per this question Strings in StringPool are not available directly. To ...
2
votes
2answers
111 views

Javascript Password Security

I'm extremely new to javascript (so I know there's already a thread here), but I couldn't understand how to implement it. My code is pretty much identical: <script language="javascript"> ...
1
vote
2answers
87 views

Avoid data manipulation by user

I have a C# program (could be any programming language) that saves data to a file on a memory (hard disk, USB drive, etc.). The program uses this data for monitoring its operation time, but it could ...
1
vote
0answers
46 views

Securing a private API used by an iOS App

I have an app that uses an API server and I do not want to have anything other than it to be able to use that API. I know this isn't totally possible, but I want to do what I can. I don't think my ...
0
votes
0answers
28 views

Detecting web proxy security

Various online resources offer proxy lists claiming that they offer various levels of anonymity. I'm trying to find out how this can be programmatically tested. I suspect the answer lies in headers. ...
0
votes
1answer
42 views

File sharing web application - folder PIN code entry best practice

I'm developing a web app for internal file sharing and one of the requirements is to have PIN code protected folders. What I came up now is a folder like structure with the following: Folder ...
1
vote
1answer
98 views

How to generate Generate Hash incorporating time stamp so it can be unhashed to get the timestamp when it was generated?

I want to create hash based on random id, That hash has to be valid for only 15 minutes. Is there a way to do that? I'm using this for form submission. If some unknown submitted form or some one ...
1
vote
2answers
151 views

Convert this abstract class to an interface

I have a security method I would like to be able to sprinkle into other classes throughout my program. It is currently an abstract class but I feel it would be more appropriate as an interface. Can ...
0
votes
0answers
66 views

Passing Data Between Tiers in 3-Tier Architecture

Assuming we are talking physical tiers, my understanding is that in order to pass data from say the data tier to the business logic tier the JSON format is used (or XML), so say I have an ORM ...
0
votes
1answer
74 views

Algorithm to maintain a blog sign up page

I have a functional sign up page for a blog that updates a database with a users name, email, profile picture and a short bio. The General information page and the profile picture upload/bio page are ...
-1
votes
1answer
41 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
1
vote
2answers
44 views

Security and sanitizing user-input with limited control over 'output' targets

I have recently joined a team working on an application with an integrated chat system. It is a standard chat system that allows clients to communicate, with messages routed through a central server. ...
0
votes
0answers
90 views

Best approach for an android local database-based application containing non-sensitive data

What's the best approach to design an android application with the question title specification? The application will show a first list of buttons with an alphabetical classification (like button1: ...
1
vote
1answer
51 views

Eclipse plugins - safe to install?

I've seen a few useful plugins for Eclipse such as jshint-eclipse. However, I'm a bit leery of installing third-party code. Is it generally safe to install Eclipse plugins without worrying about my ...
0
votes
1answer
51 views

Logging private data

In general, I write a debug log whenever one of my functions is entered, including the parameters. For instance: function execute_query($query, $conn_string) { ...
39
votes
13answers
5k views

How safe is it to compile a piece of source code from a random stranger? [closed]

Suppose I'm reviewing code that job applicants send to prove their skills. Clearly I don't want to run executables they send. Not so clearly I'd rather not run the result of compilation of their code ...
5
votes
1answer
336 views

Token or ASP.NET Identity based security in ASP.NET Web API 2

Background I have a Web API 2 project, without any extension of ASP.NET MVC or ASP.NET projects. The API will only be used to communicate between the server and Windows 8, Windows Phone 8.1 and iOS ...
0
votes
2answers
176 views

Binding software to one PC [closed]

I have generated a .exe of a Python script. I wish to give this software as a demo version to few of clients. For the same I want to bind the software to a particular PC. i.e. If I install the ...
2
votes
0answers
69 views

Directly query database vs. Using web service

I'm a junior programmer, am working on a WPF application that will deploy to ~50 users. We basically are streamlining all of his charting/tracking of client data. Each user will probably make about ...
2
votes
2answers
112 views

Crypto hash in 'a href'?

It seems to me that it would be pretty useful to be able to indicate an expected crypto hash value in file downloads especially since so many application and data downloads rely on mirrored hosting. ...
4
votes
1answer
119 views

Why does SOP permit cross-origin form submissions?

Same Origin Policy does not prevent origin foo.bar from creating a form with action attribute set to another origin baz.duh and even allows to programmatically submit this form without the user ...
0
votes
2answers
88 views

What is the value of encoders with decoders currently present

Can you tell me the value of using PHP encoder (ioncube, phpshield) with currently present service like decry.pt (http://www.decry.pt/) that can easily decode source codes. I have tried decry.pt's ...
1
vote
2answers
109 views

How much should I concern myself with hiding the IDs of my database in URLs?

I keep coming across questions and articles on the internet suggesting that it's not a good practice to have the IDs of your database records visible to the public. Yet I've never taken it seriously ...
1
vote
1answer
124 views

Resetting vs. re-sending forgotten passwords

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
0
votes
1answer
43 views

API authentication with a single ID

A typical API authentication usually rely on a pair of API ID + SECRET, my question is: if the API ID is unique and randomly generated and is considered strong enough (e.g. SHA512), why a SECRET is ...
2
votes
1answer
80 views

What's the best practise for storing web server credentials for your web app deployment?

I was looking at the Oracle documentation for the weblogic maven plugin. In it, they store the weblogic user name and password for accessing in the pom.xml. Just wondering, isn't this a terrible ...
0
votes
2answers
83 views

How to protect controller endpoint from abuse?

I am building a web app that will first validate a promotion code via AJAX call and then if it is valid, allow the user to fill out the rest of the form, I use KnockoutJS to reveal and hide the ...
2
votes
3answers
144 views

Where to store hashes, salts, keys in Desktop Applications

I am trying to figure out where or how i should store application secrets and keys inside a desktop application. For example a facebook app key or dropbox key and secret. So I've read that i should ...
4
votes
3answers
1k views

How to open a desktop application through browser without a Java applet?

We run a cloud-based medical software, and a very important part of the program is bridging to an imaging software straight from our website, passing information through command line arguments. We ...
3
votes
1answer
172 views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...
0
votes
0answers
44 views

Implement taxometer paywall

I need to add a paywall to my site. According to this article, I want to implement a taxometer system. The easiest and least secure way would be tracking the number of viewed articles using secure ...
5
votes
3answers
187 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
1
vote
1answer
75 views

Securing a Web Api for individual Users

We currently have a web app (.net MVC 5), user's login using their username and password and then we store an encrypted value in a cookie to authenticate them on future requests. We are now in the ...
5
votes
1answer
103 views

Safest way to use and store User's third party credentials

I'm working on an add-in that will integrate git into the VBA IDE. I'm using the LibGit2Sharp library under the hood, which supports User name and password credentials, but not SSH Keys. I would use ...
3
votes
3answers
102 views

Secure DAL Design using Stored Procedures

I normally avoid sProcs as much as possible. I dont like the language be it TSQL or PL/SQL; they seem archaic against Java/Dot-Net which I use. I go for them when a routine needs to fetch a lot of ...
0
votes
1answer
55 views

How Do I Securely Edit a Database Entry Based On ID in an Admin System?

This is more of a conceptual question because the way that I am doing it would be secure enough for my purposes (educational). I created a simple admin panel that displays a stock picks database as ...
1
vote
1answer
92 views

What is a simple, correct and secure way of executing code stored in database?, that is also sandboxed

Webhooks can be a very powerful thing when you try to automate or integrate software, however, handling their deployment in a controlled environment can suck in terms of security and deployment alone. ...
-1
votes
1answer
123 views

Can someone please explain reverse look up tables? [closed]

Im finding it difficult to understand reverse look up tables and how it works, and the concept of hash chains. This is apart of a computer security model i am taking. So i understand that brute force, ...
3
votes
1answer
92 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
0
votes
0answers
25 views

Should I use OAUTH 'scopes' to provide access to specific resources?

I am researching & and learning about OAUTH, so please forgive me if this is a very stupid question.. It seems that scopes are typically used to define actions that I can take on behalf of a ...
0
votes
1answer
85 views

Personal Digital Signatures in Web Applications [closed]

In order to sign data with personal digital signature in a web application, server side languages like PHP can do the whole job, but that would require that the user uploads his private key, lets say ...