For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

5
votes
0answers
38 views

Safest way to use and store User's third party credentials

I'm working on an add-in that will integrate git into the VBA IDE. I'm using the LibGit2Sharp library under the hood, which supports User name and password credentials, but not SSH Keys. I would use ...
3
votes
3answers
66 views

Secure DAL Design using Stored Procedures

I normally avoid sProcs as much as possible. I dont like the language be it TSQL or PL/SQL; they seem archaic against Java/Dot-Net which I use. I go for them when a routine needs to fetch a lot of ...
0
votes
1answer
44 views

How Do I Securely Edit a Database Entry Based On ID in an Admin System?

This is more of a conceptual question because the way that I am doing it would be secure enough for my purposes (educational). I created a simple admin panel that displays a stock picks database as ...
-6
votes
1answer
76 views

in c programming i need custom atoi code [closed]

i want to subtract two 64 bit hex numbers(in c programming), 0x0000888888888888 -1st hex value - 0x00000000839DDB7A -2nd hex value = 0x0000888804EAAD0E =(need the above result in hex) The 1st ...
1
vote
1answer
60 views

What is a simple, correct and secure way of executing code stored in database?, that is also sandboxed

Webhooks can be a very powerful thing when you try to automate or integrate software, however, handling their deployment in a controlled environment can suck in terms of security and deployment alone. ...
-5
votes
0answers
57 views

Is there any free way to get the password of a rar file [closed]

Is there any way I can do that? I want to get the password of two rar files, how can I do that? I know there is a technique called brute force but how to implement it?
-1
votes
1answer
87 views

Can someone please explain reverse look up tables? [closed]

Im finding it difficult to understand reverse look up tables and how it works, and the concept of hash chains. This is apart of a computer security model i am taking. So i understand that brute force, ...
0
votes
0answers
29 views

Securing a WCF Service [closed]

We have been researching using message level security for our WCF Services, but have run into a lot of issues dealing with client certificates and getting them to work correctly. My concern is that we ...
3
votes
0answers
50 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
0
votes
0answers
11 views

Should I use OAUTH 'scopes' to provide access to specific resources?

I am researching & and learning about OAUTH, so please forgive me if this is a very stupid question.. It seems that scopes are typically used to define actions that I can take on behalf of a ...
0
votes
1answer
54 views

Personal Digital Signatures in Web Applications [closed]

In order to sign data with personal digital signature in a web application, server side languages like PHP can do the whole job, but that would require that the user uploads his private key, lets say ...
0
votes
2answers
102 views

Security scheme that prevents duplicate message attacks

I am using custom security scheme to verify communication between client and server. Both client and server have same secret hash phrase. Client builds a message, combines it with hash phrase and ...
3
votes
1answer
47 views

Web application security: Need a 2 phase check?

(Is this the best forum for this type of question?) I'm writing a web application which allows approved users to login, and perform various tasks, depending on the security role(s) they have been ...
9
votes
3answers
951 views

How did desktop applications communicate with remote server before webservices?

I don't have lot of expierence with desktop applications, but if I had to create a client server desktop app, the data access would be done through a webservice. I believe data access through a ...
-1
votes
0answers
32 views

How to control master sound volume through VB.NET? [migrated]

Is there any way where i can prevent the master volume to be reduced or just fix it at a particular level through VB.NET? I'm using Visual Studio 2013. Any help would be appreciated. Thanks in ...
0
votes
0answers
3 views

How to disable 'sound muting' option through VB.NET? [migrated]

I'm developing a security based VB.NET project where an alarm is sounded when the user attempts wrong passwords. But as of now, simply muting the speakers through the Sound Control option has been an ...
1
vote
2answers
123 views

Is setting “permanent” persistent login cookies a bad practice?

I realized that in Rails there is a built in permanent method for its persistent login cookies (aka. "remember me" cookies) method to give the client a cookie that expires in 20 years: ...
0
votes
1answer
139 views

Program to look at the first say 5 characters of a word and return a string if that string is actually the first 5 characters of a word?

For example, say I have a string and it has the letters: RDNAL This is not an actual English word or it doesn't start an actual english word, so the program would skip this string and would avoid ...
16
votes
9answers
3k views

Can you “stop” a C program from being reverse engineered? [duplicate]

I'm sure that many of the middle to high level languages can be reverse engineered. But if a C program can be reverse-engineered, and turned back into editable source code, how do I discourage such a ...
20
votes
4answers
2k views

Is it worth even checking to see if Guid.NewGuid() is Guid.Empty?

In one of the projects I'm working on the following pattern is seen on a fairly regular basis: var guid = Guid.NewGuid().ToString(); while (guid == Guid.Empty.ToString()) { guid = ...
0
votes
2answers
107 views

Should a “secret access code” use the same security as a normal password? [closed]

Obviously, when you store a password, you should use something similar to bcrypt before you store it in in the database. But I have a client who wants to add the ability to add a "secret code" to ...
1
vote
1answer
65 views

How to store sensitive information (e.g. clients' credentials) accessibly for everybody inside?

I just discovered that we store sensitive information on our SharePoint. Since it's accessible by a password alone (and we all know that others click for the password/user name to be automatically ...
1
vote
1answer
66 views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
1
vote
1answer
34 views

What's the proper name for type of security where we secure resources by ownerrship

I work on REST API that mixes two types of security: First you have standard role-based security - so we have multiple roles such as admin, read-only user, super user user etc. Then we have also ...
1
vote
0answers
143 views

What is the “correct” way to store functions in a database?

Note: Yes, I know that storing functions in databases should be punishable by law. We are developing a financial web application using PostgreSQL, Sinatra and AngularJS. As you may have guessed, a ...
1
vote
2answers
121 views

Is it a good idea to require passwords in offline applications?

I am developing an application which can install extension modules (plugins, if you will) from APT-style repositories hosted elsewhere. The plugins need not be signed (although the downloads are ...
1
vote
2answers
178 views

Is it possible to avoid SQL injection by not using a Query Language for most tasks? [duplicate]

I'm coming at this from a somewhat beginners viewpoint so if this is an obvious question it's because I didn't know the right terms to search for. Are there DBMS's that provide an alternative ...
0
votes
1answer
49 views

Secure Rest api from authenticated user

Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call: @Post /increasePoints host:https://www.example.com/increasePoints ...
4
votes
1answer
147 views

What are the reasons for sealing a .jar and how would I verify that?

I have created a sealed jar, but I don't see difference compared to using a non-sealed one. What tests I can perform to verify the jar is sealed? What reason we could have to prefer using a sealed ...
1
vote
1answer
142 views

Browser game played in an iframe - security concerns

I'm not sure if this counts as an Information Security or Webmasters question rather than Programmers, however I'll see how we go. I've been prototyping a help website for a particular browser game, ...
3
votes
1answer
226 views

How to hide a honeypot ( excluding external CSS and JS )

I am adding spam protection to my personal php framework and I think honeypots are a great way to block spam. Unfortunately they weren't invented yesterday and probably most bots do fetch CSS and can ...
0
votes
1answer
39 views

Secure Form Submission

This is probably a no brainer, but I've not been able to find an answer that is definitive. I have a Codeigniter site running on Apache with mod_rewrite (to get rid of index.php) and mod_ssl for ...
3
votes
2answers
62 views

Using Facebook to authenticate, how to link to user record in my app? Email?

I'm using Facebook to authenticate users. We also have conventional username/ password login and registration form too. Anyway, when a user chooses to login with Facebook, we use the following ...
1
vote
1answer
12 views

Resource representation can depend on identity?

If some resource on a RESTful api is to be protected, we can do it by using OAuth for example, and then if the there's no token on the headers of the request (i.e. no identity) we return a 401 status ...
9
votes
2answers
620 views

Should I keep email addresses as plaintext in database?

It's clear to everyone (I hope) that storing passwords without at least salting/hashing them is a terrible idea. What about emails? Let's say you keep the subscription email address, if you encrypt ...
0
votes
1answer
21 views

Securing service calls

I have a ServiceCallContext object that must be passed in as the first parameter of any service call. I would like to put a User object on the context object but I know I can't force the caller to ...
27
votes
3answers
2k views

Kernel mode web servers: A clever optimization or a security nightmare?

I was reading a Hacker News thread where one user posts a link from 2011 explaining that IIS is much faster than most other (*nix) web servers. Another user replies, explaining that IIS gets that ...
3
votes
2answers
1k views

One of my team members committed SQL injection-vulnerable code; should I report it to the manager? [closed]

One of my team members committed a huge mistake; a clear SQL injection-vulnerability. It obviously didn't pass my peer review and I made very clear that this is unacceptable. I never saw this ...
3
votes
3answers
120 views

Why should I purchase an SSL certificate for custom domain?

After reading Heroku articles, Stack Overflow questions, and the Stripe payments integration guides, the general advice is that I should should purchase an SSL certificate for my custom domain that ...
0
votes
1answer
44 views

How to let users share custom code content under the mobile app store restrictions?

Situation Mobile application store owners are known to explicitly forbid some application extensibility scenarios. Apple: 2.7 Apps that download code in any way or form will be rejected 2.8 ...
2
votes
1answer
133 views

How to access secure web services from a desktop application?

I'm writing a Java desktop application that will be available to the public. It will contact backend APIs via HTTPS using Jersey client. I don't know anything about using certificates in desktop apps ...
0
votes
1answer
54 views

Developer account in OSX, admin or managed user with our without sudo access?

The tutorials I find to setup OS-X for web developer programming (installing x-code ruby js cocoapods sql c asm etc) leave out if it should be done from an admin account, or standard (managed) user. ...
3
votes
1answer
79 views

How do you implement an active sessions system like LinkedIn? [closed]

With some platforms, like LinkedIn, you can see a list of all sessions where you are logged in, and you can even log them out on a distance. How would you implement something like that? I'm not ...
3
votes
3answers
375 views

What kind of user info is ok to be stored as plain text in SQL Database?

I'm practicing around building e-commerce asp.net applications that allows for users to register to the site and their user credentials are stored in a MySQL database. In my sample project the ...
0
votes
1answer
78 views

Sending Out Functions To Return Or To Die

Which is preferable for both solid technique and secure coding? Example #1: function_one() blah; function_two() blah; print blah; exit; ... Example #2: ...
0
votes
2answers
112 views

Periodically polling an API, are there alternatives?

I'm currently working on a service that is supposed to aggregate data from a number of APIs, unify the data, and offer it through another API to the users. I had a couple of ideas for solving this, ...
3
votes
2answers
159 views

Are there any widely accepted sets of standards/practices for secure coding? [closed]

The title should be fairly self-explanatory. We need to update our coding standards, and as part of this process we've been asked to try and follow an industry standard from a ...
0
votes
2answers
96 views

What is the best way to present a portfolio of practice/training security research? [closed]

I keep a security research blog as a hobby, and finding out about all the ways one shouldn't code has helped me a lot in my career as a software developer. I would like to attribute my blog to a ...
1
vote
2answers
109 views

How to send data between HTTP requests without user modifying it?

I'm currently developing a web application (using laravel) where I have a form that edit a resource. Something like this: <!-- URL: /editResource/3 --> <form action="/editResource/3" ...
1
vote
1answer
49 views

Is this type of data insertion safe and can stop sql injection in Python?

I am learning Database connection from MySQL Connector/Python Developer Guide. This is the code I am using to insert data: conn = mysql.connector.connect(user="user", password="password", ...