For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

0
votes
0answers
13 views

Best approach for an android local database-based application containing non-sensitive data

What's the best approach to design an android application with the question title specification? The application will show a first list of buttons with an alphabetical classification (like button1: ...
1
vote
2answers
34 views

Eclipse plugins - safe to install?

I've seen a few useful plugins for Eclipse such as jshint-eclipse. However, I'm a bit leery of installing third-party code. Is it generally safe to install Eclipse plugins without worrying about my ...
0
votes
0answers
30 views

Logging private data

In general, I write a debug log whenever one of my functions is entered, including the parameters. For instance: function execute_query($query, $conn_string) { ...
39
votes
13answers
5k views

How safe is it to compile a piece of source code from a random stranger? [closed]

Suppose I'm reviewing code that job applicants send to prove their skills. Clearly I don't want to run executables they send. Not so clearly I'd rather not run the result of compilation of their code ...
3
votes
0answers
103 views

Token or ASP.NET Identity based security in ASP.NET Web API 2

Background I have a Web API 2 project, without any extension of ASP.NET MVC or ASP.NET projects. The API will only be used to communicate between the server and Windows 8, Windows Phone 8.1 and iOS ...
0
votes
2answers
173 views

Binding software to one PC [closed]

I have generated a .exe of a Python script. I wish to give this software as a demo version to few of clients. For the same I want to bind the software to a particular PC. i.e. If I install the ...
2
votes
0answers
56 views

Directly query database vs. Using web service

I'm a junior programmer, am working on a WPF application that will deploy to ~50 users. We basically are streamlining all of his charting/tracking of client data. Each user will probably make about ...
1
vote
1answer
62 views

Crypto hash in 'a href'?

It seems to me that it would be pretty useful to be able to indicate an expected crypto hash value in file downloads especially since so many application and data downloads rely on mirrored hosting. ...
0
votes
2answers
80 views

What is the value of encoders with decoders currently present

Can you tell me the value of using PHP encoder (ioncube, phpshield) with currently present service like decry.pt (http://www.decry.pt/) that can easily decode source codes. I have tried decry.pt's ...
1
vote
2answers
99 views

How much should I concern myself with hiding the IDs of my database in URLs?

I keep coming across questions and articles on the internet suggesting that it's not a good practice to have the IDs of your database records visible to the public. Yet I've never taken it seriously ...
1
vote
1answer
119 views

Resetting vs. re-sending forgotten passwords

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
0
votes
1answer
39 views

API authentication with a single ID

A typical API authentication usually rely on a pair of API ID + SECRET, my question is: if the API ID is unique and randomly generated and is considered strong enough (e.g. SHA512), why a SECRET is ...
2
votes
1answer
56 views

What's the best practise for storing web server credentials for your web app deployment?

I was looking at the Oracle documentation for the weblogic maven plugin. In it, they store the weblogic user name and password for accessing in the pom.xml. Just wondering, isn't this a terrible ...
0
votes
2answers
82 views

How to protect controller endpoint from abuse?

I am building a web app that will first validate a promotion code via AJAX call and then if it is valid, allow the user to fill out the rest of the form, I use KnockoutJS to reveal and hide the ...
2
votes
3answers
129 views

Where to store hashes, salts, keys in Desktop Applications

I am trying to figure out where or how i should store application secrets and keys inside a desktop application. For example a facebook app key or dropbox key and secret. So I've read that i should ...
4
votes
3answers
490 views

How to open a desktop application through browser without a Java applet?

We run a cloud-based medical software, and a very important part of the program is bridging to an imaging software straight from our website, passing information through command line arguments. We ...
3
votes
1answer
104 views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...
0
votes
0answers
41 views

Implement taxometer paywall

I need to add a paywall to my site. According to this article, I want to implement a taxometer system. The easiest and least secure way would be tracking the number of viewed articles using secure ...
5
votes
3answers
179 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
1
vote
1answer
61 views

Securing a Web Api for individual Users

We currently have a web app (.net MVC 5), user's login using their username and password and then we store an encrypted value in a cookie to authenticate them on future requests. We are now in the ...
5
votes
1answer
85 views

Safest way to use and store User's third party credentials

I'm working on an add-in that will integrate git into the VBA IDE. I'm using the LibGit2Sharp library under the hood, which supports User name and password credentials, but not SSH Keys. I would use ...
3
votes
3answers
93 views

Secure DAL Design using Stored Procedures

I normally avoid sProcs as much as possible. I dont like the language be it TSQL or PL/SQL; they seem archaic against Java/Dot-Net which I use. I go for them when a routine needs to fetch a lot of ...
0
votes
1answer
53 views

How Do I Securely Edit a Database Entry Based On ID in an Admin System?

This is more of a conceptual question because the way that I am doing it would be secure enough for my purposes (educational). I created a simple admin panel that displays a stock picks database as ...
1
vote
1answer
91 views

What is a simple, correct and secure way of executing code stored in database?, that is also sandboxed

Webhooks can be a very powerful thing when you try to automate or integrate software, however, handling their deployment in a controlled environment can suck in terms of security and deployment alone. ...
-1
votes
1answer
110 views

Can someone please explain reverse look up tables? [closed]

Im finding it difficult to understand reverse look up tables and how it works, and the concept of hash chains. This is apart of a computer security model i am taking. So i understand that brute force, ...
3
votes
1answer
89 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
0
votes
0answers
19 views

Should I use OAUTH 'scopes' to provide access to specific resources?

I am researching & and learning about OAUTH, so please forgive me if this is a very stupid question.. It seems that scopes are typically used to define actions that I can take on behalf of a ...
0
votes
1answer
78 views

Personal Digital Signatures in Web Applications [closed]

In order to sign data with personal digital signature in a web application, server side languages like PHP can do the whole job, but that would require that the user uploads his private key, lets say ...
0
votes
2answers
113 views

Security scheme that prevents duplicate message attacks

I am using custom security scheme to verify communication between client and server. Both client and server have same secret hash phrase. Client builds a message, combines it with hash phrase and ...
3
votes
1answer
59 views

Web application security: Need a 2 phase check?

(Is this the best forum for this type of question?) I'm writing a web application which allows approved users to login, and perform various tasks, depending on the security role(s) they have been ...
9
votes
3answers
1k views

How did desktop applications communicate with remote server before webservices?

I don't have lot of expierence with desktop applications, but if I had to create a client server desktop app, the data access would be done through a webservice. I believe data access through a ...
1
vote
2answers
207 views

Is setting “permanent” persistent login cookies a bad practice?

I realized that in Rails there is a built in permanent method for its persistent login cookies (aka. "remember me" cookies) method to give the client a cookie that expires in 20 years: ...
-1
votes
1answer
203 views

Program to look at the first say 5 characters of a word and return a string if that string is actually the first 5 characters of a word?

For example, say I have a string and it has the letters: RDNAL This is not an actual English word or it doesn't start an actual english word, so the program would skip this string and would avoid ...
15
votes
9answers
3k views

Can you “stop” a C program from being reverse engineered? [duplicate]

I'm sure that many of the middle to high level languages can be reverse engineered. But if a C program can be reverse-engineered, and turned back into editable source code, how do I discourage such a ...
21
votes
4answers
2k views

Is it worth even checking to see if Guid.NewGuid() is Guid.Empty?

In one of the projects I'm working on the following pattern is seen on a fairly regular basis: var guid = Guid.NewGuid().ToString(); while (guid == Guid.Empty.ToString()) { guid = ...
0
votes
2answers
111 views

Should a “secret access code” use the same security as a normal password? [closed]

Obviously, when you store a password, you should use something similar to bcrypt before you store it in in the database. But I have a client who wants to add the ability to add a "secret code" to ...
1
vote
1answer
75 views

How to store sensitive information (e.g. clients' credentials) accessibly for everybody inside?

I just discovered that we store sensitive information on our SharePoint. Since it's accessible by a password alone (and we all know that others click for the password/user name to be automatically ...
1
vote
1answer
174 views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
1
vote
1answer
34 views

What's the proper name for type of security where we secure resources by ownerrship

I work on REST API that mixes two types of security: First you have standard role-based security - so we have multiple roles such as admin, read-only user, super user user etc. Then we have also ...
1
vote
0answers
204 views

What is the “correct” way to store functions in a database?

Note: Yes, I know that storing functions in databases should be punishable by law. We are developing a financial web application using PostgreSQL, Sinatra and AngularJS. As you may have guessed, a ...
1
vote
2answers
127 views

Is it a good idea to require passwords in offline applications?

I am developing an application which can install extension modules (plugins, if you will) from APT-style repositories hosted elsewhere. The plugins need not be signed (although the downloads are ...
1
vote
2answers
184 views

Is it possible to avoid SQL injection by not using a Query Language for most tasks? [duplicate]

I'm coming at this from a somewhat beginners viewpoint so if this is an obvious question it's because I didn't know the right terms to search for. Are there DBMS's that provide an alternative ...
0
votes
2answers
84 views

Secure Rest api from authenticated user

Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call: @Post /increasePoints host:https://www.example.com/increasePoints ...
4
votes
1answer
339 views

What are the reasons for sealing a .jar and how would I verify that?

I have created a sealed jar, but I don't see difference compared to using a non-sealed one. What tests I can perform to verify the jar is sealed? What reason we could have to prefer using a sealed ...
1
vote
1answer
171 views

Browser game played in an iframe - security concerns

I'm not sure if this counts as an Information Security or Webmasters question rather than Programmers, however I'll see how we go. I've been prototyping a help website for a particular browser game, ...
3
votes
1answer
318 views

How to hide a honeypot ( excluding external CSS and JS )

I am adding spam protection to my personal php framework and I think honeypots are a great way to block spam. Unfortunately they weren't invented yesterday and probably most bots do fetch CSS and can ...
0
votes
1answer
51 views

Secure Form Submission

This is probably a no brainer, but I've not been able to find an answer that is definitive. I have a Codeigniter site running on Apache with mod_rewrite (to get rid of index.php) and mod_ssl for ...
3
votes
2answers
102 views

Using Facebook to authenticate, how to link to user record in my app? Email?

I'm using Facebook to authenticate users. We also have conventional username/ password login and registration form too. Anyway, when a user chooses to login with Facebook, we use the following ...
1
vote
1answer
12 views

Resource representation can depend on identity?

If some resource on a RESTful api is to be protected, we can do it by using OAuth for example, and then if the there's no token on the headers of the request (i.e. no identity) we return a 401 status ...
9
votes
2answers
652 views

Should I keep email addresses as plaintext in database?

It's clear to everyone (I hope) that storing passwords without at least salting/hashing them is a terrible idea. What about emails? Let's say you keep the subscription email address, if you encrypt ...