For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

1
vote
1answer
99 views

Implicit OAuth2 endpoint vs. cookies

I currently have an app which basically runs two halves of an API - a restful API for the web app, and a synchronisation API for the native clients (all over SSL). The web app is completely ...
1
vote
1answer
157 views

Is it safe to generate client nonces using random number generator?

I am making HTTP calls on the client side and the server expects me to supply a client nonce. It needs to be 4 bytes long. I am planning to use this combination: base64(parts of the MAC address + ...
0
votes
1answer
140 views

Browser security and payments

I've been finding a lot of blog posts claiming JS encryption is unsafe, here's a couple of detailed ones: http://www.matasano.com/articles/javascript-cryptography/ ...
1
vote
1answer
103 views

How to secure a Django application's source code? [duplicate]

I have developed a Django application for a company. Now I am about to ship it to my customer. After reading through online articles and books, I understood that securing the source code of any web ...
0
votes
1answer
74 views

Encyption for passwords in config file?

I was wondering, if it makes sense to encrypt passwords for external services stored in my config file with an symmetric encryption algorithm? On the one hand I think, if someone gets access to the ...
-4
votes
2answers
238 views

How do remote programmers working on proprietary software go about securing their work/source code? [closed]

I was just wondering what kind of protocols a software engineer would go through if they were working at home for a company developing proprietary closed source software. Would you use a third party ...
3
votes
1answer
395 views

Which automated analysis tools can find the heartbleed bug? [closed]

After reading this description of the infamous heartbleed bug, and how the OpenSSL team is relatively small and lightly funded, I'm wondering: would this bug have been uncovered by coverity, valgrind ...
0
votes
0answers
104 views

Is my application secure enough

first of all, I don't have any code to display in my question here, because I'm still designing the application structure, so i only got design developed. I'm building a phone application that I'm ...
0
votes
1answer
126 views

What are security advantages of Google Caja over using the web worker API? [closed]

I am currently looking into Google Caja to run user-supplied JS code in the browser and in Node. So far, I understand, that, in a browser context, "cajoled code" disallows reading and messing with ...
1
vote
4answers
144 views

Is secretive systems development really possible?

An agency wants to develop a highly secret computer system using public contractors. So they hire different companies to implement different components of the system. When all the components are ...
-2
votes
2answers
213 views

Securing PHP source code from illegal copy [closed]

my IT boss asks what is the best way to secure the PHP source code against illegal copy of the code once it is deployed to clients. Is there a PHP compiler that will make the final codes unreadable? ...
1
vote
2answers
182 views

Is displaying an HTML email a security risk?

I am writing a simple webmail where I want (obviously) to display the emails. I'm wondering if I should take any precaution while displaying HTML emails: is dumping the email content into a ...
10
votes
6answers
1k views

Why do most sites require email activation [closed]

Most popular applications nowadays require account activation by email. I've never done it with apps that I've developed so am I missing some crucial security feature? By email activation I mean when ...
2
votes
2answers
304 views

When is the private key given to the client? [closed]

http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/ I've been reading the article and I haven't really grasped it yet. When is the private key given to the client? ...
0
votes
2answers
107 views

How do I access databases from a mobile device securely?

I have been doing some research on accessing a DB from mobile devices. There are so many different ways of doing it. There are also multiple ways to make it secure. What is a good way to access a ...
2
votes
5answers
258 views

secure photos on server [closed]

I would like to hear advice from the more experienced developers. The project is now in the design stage. It's mobile application and a simple web application. Content is pictures, comments, personal ...
0
votes
1answer
78 views

Is there a design pattern for updating lists?

I want to modify one list (actually info stored in a database). A person doesn't have access to update every part of the list, but can update and delete parts they do have access to and add whatever ...
1
vote
2answers
309 views

How to avoid unauthorized use of an API?

I have to design a "widget", a script that partners will embed in their websites to display some UI and make calls to our API. Basically it will display our data on these sites based on some IDs they ...
2
votes
1answer
59 views

How is same-origin policy implemented?

I was looking at cross-domain requests for a design and stumbled upon something that puzzles me. From a local site I'm firing an Ajax request to another domain (with jQuery and vanilla ...
1
vote
1answer
57 views

Is this mini-DSL for hiding URI passwords compatible with the URI spec?

Passwords exposed in URIs An application stores URIs to be used for file transfers via SFTP, FTP, FTPS and SCP. Many of these URIs contain passwords, for example: ...
0
votes
2answers
242 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
1
vote
4answers
258 views

Is just using an email address for login a good idea?

Many a times I need to log into a website that I used months ago and have forgotten my password. So clicking the reset password link and the site sends me an email with a single use link which allows ...
13
votes
4answers
825 views

What to do when your company doesn't encrypt passwords

Background I'm been contracted to help a company maintain their server. I work on some minor PHP projects but also look over performance issues and recently, scan logs for hackers. These guys have ...
1
vote
2answers
172 views

Fixing a security exploit - but then everyone knows about it

Earlier, I was messaged about a potential security risk in one of my projects. I checked it and found that it allows for "arbitrary code execution". (Quotes because it is running in a VM, but the ...
1
vote
1answer
190 views

How important is an SSL certificate for a internal website?

I know many people have asked the same question but I think it really depends on the type of the website. So that's why I am asking the question about my website. I am developing a PHP web ...
1
vote
1answer
133 views

Is masking really necessary when sending from Websocket client

The current Websocket RFC requires that websocket clients mask all data within frames when sending (but server is not required to). The reason the protocol was designed this way is to prevent frame ...
2
votes
2answers
130 views

Security concern regarding web service

I'm currently working on a pet project with two of my buddies. This web service will provide basic functionality such as Login/Password Modification/Registration etc. All of us are comfortable with ...
0
votes
2answers
140 views

How can I solve this potential security exploit (concerning the saving of REST resources)?

I have a File database table with the following columns: Id (PK), Filename And a Document database table with the following columns: Id (PK), Name, Description, FileId (FK) When a user wants to ...
0
votes
1answer
120 views

How to provide data to a web server using a data warehouse?

We have data stored in a data warehouse as follows: Price Date Product Name (varchar(25)) We currently only have seven products. Once every business day, seven new data points are added ...
0
votes
1answer
103 views

Do we have any special design considerations for maintaining anonymity in an application?

This is an open-ended question which I am analysing while doing some fun projects in leisure. Websites like Google, Facebook do store user activities and perhaps sell them or use them for ...
3
votes
1answer
689 views

Is it possible to protect json api scraping using random tokens?

I have built a restful json api for an online store using Laravel. I now wish to create an AngularJS app to run the front-end web application. Product prices for my store need to update every second, ...
23
votes
6answers
2k views

How is major software protected? [duplicate]

I am a new software developer and I wish to sell my software. I recently realized that from C++ code we can not stop the user seeing parts of the code that are related to scripts or system commands. ...
8
votes
5answers
582 views

Where to store the private key?

Say I want some parts of my software to be encrypted. For example, the credentials for a database, etc. I need to store those values somewhere, but doing so in cleartext would make it easy for an ...
1
vote
4answers
289 views

Is securing the credit card data is considered a requirement from the customer

I'm taking an Introduction to Agile Software Development course, The instructor was discussing an example about online store and asked us to write the User Stories and the Conditions of satisfactions ...
2
votes
3answers
232 views

Is it possible to check a client side application identity from server side? [duplicate]

Assume there is a web service which is visible publicly but it must be just responsive to a specific client application. Is there any mechanism to check client side application identity to prevent ...
1
vote
1answer
363 views

Is it an implementation of a stateful mechanism for Rest API authentication?

In many articles about Rest API's best practices, it is recommended to not depend upon sessions on server side since it leads to a stateful mechanism. I currently use Play 2.2 framework, with a ...
0
votes
0answers
52 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
11
votes
7answers
803 views

Why do modern websites still insist on archaic username/password requirements? [duplicate]

I was signing up for a website last night, and once again was greeted with the fact that my username cannot contain certain characters (including spaces), and neither could my password. Is there a ...
5
votes
6answers
2k views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
3
votes
2answers
278 views

Would using rainbow tables to detect weak user passwords feasible?

As I understand in most security breach where the list of hashed password are compromised, attackers do use brute-force to try to find weak password and, invariably, they always find quite some (like ...
24
votes
9answers
2k views

Why not expose a primary key

In my education I have been told that it is a flawed idea to expose actual primary keys (not only DB keys, but all primary accessors) to the user. I always thought it to be a security problem ...
1
vote
2answers
206 views

How do I dissuade users from using the same password with similar systems?

I'm building a web application that connects to other web services (using strictly anonymous binding, so no user passwords are being used). However the web application maintains its own users itself, ...
2
votes
1answer
370 views

Does facebook store multiple password hashes for each user? [closed]

I noticed that Facebook allows multiple variants of my own password : My password as it is. My password with first letter capitalized. My password with all letters capitalized. It is commonly ...
28
votes
5answers
998 views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
1
vote
2answers
91 views

Recommended secure approach to confirming an URL is called by a legitimate caller

I'm using a CRON on AppEngine and the cron calls my web app at a specific app. I only want to execute functionality when called by my AppEngine app. What's is/are recommended approach to confirming ...
0
votes
1answer
218 views

Making Agile and DevOps methodology compatible with PCI requirements [closed]

Would like to hear from those working in a PCI compliance environment and is practicing agile development and devops methodology, how you maintain compliance with PCI requirements. Specifically, what ...
2
votes
1answer
264 views

Approach to Authenticate Clients to TCP Server

I'm writing a Server/Client application where clients will connect to the server. What I want to do, is make sure that the client connecting to the server is actually using my protocol and I can ...
9
votes
5answers
1k views

How do web servers enforce the same-origin policy?

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
2
votes
2answers
169 views

Principles of an extensible data proxy

There is a growing industry now with more than 30 companies playing in the Backend-As-A-Service (BaaS) market. The principle is simple: give companies a secure way of exposing data housed on premises ...
1
vote
1answer
136 views

Creating deterministic key pairs in javascript for use in encrypting/decrypting/signing messages

So I have been searching everywhere and havn't been able to find anything with the sufficient information I need.. so Im a bit stumped on this one at the moment What I am trying to do is create a ...