For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

1
vote
1answer
206 views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
1
vote
1answer
34 views

What's the proper name for type of security where we secure resources by ownerrship

I work on REST API that mixes two types of security: First you have standard role-based security - so we have multiple roles such as admin, read-only user, super user user etc. Then we have also ...
1
vote
0answers
227 views

What is the “correct” way to store functions in a database?

Note: Yes, I know that storing functions in databases should be punishable by law. We are developing a financial web application using PostgreSQL, Sinatra and AngularJS. As you may have guessed, a ...
1
vote
2answers
127 views

Is it a good idea to require passwords in offline applications?

I am developing an application which can install extension modules (plugins, if you will) from APT-style repositories hosted elsewhere. The plugins need not be signed (although the downloads are ...
1
vote
2answers
184 views

Is it possible to avoid SQL injection by not using a Query Language for most tasks? [duplicate]

I'm coming at this from a somewhat beginners viewpoint so if this is an obvious question it's because I didn't know the right terms to search for. Are there DBMS's that provide an alternative ...
0
votes
2answers
86 views

Secure Rest api from authenticated user

Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call: @Post /increasePoints host:https://www.example.com/increasePoints ...
4
votes
1answer
463 views

What are the reasons for sealing a .jar and how would I verify that?

I have created a sealed jar, but I don't see difference compared to using a non-sealed one. What tests I can perform to verify the jar is sealed? What reason we could have to prefer using a sealed ...
1
vote
1answer
185 views

Browser game played in an iframe - security concerns

I'm not sure if this counts as an Information Security or Webmasters question rather than Programmers, however I'll see how we go. I've been prototyping a help website for a particular browser game, ...
3
votes
1answer
347 views

How to hide a honeypot ( excluding external CSS and JS )

I am adding spam protection to my personal php framework and I think honeypots are a great way to block spam. Unfortunately they weren't invented yesterday and probably most bots do fetch CSS and can ...
0
votes
1answer
53 views

Secure Form Submission

This is probably a no brainer, but I've not been able to find an answer that is definitive. I have a Codeigniter site running on Apache with mod_rewrite (to get rid of index.php) and mod_ssl for ...
3
votes
2answers
110 views

Using Facebook to authenticate, how to link to user record in my app? Email?

I'm using Facebook to authenticate users. We also have conventional username/ password login and registration form too. Anyway, when a user chooses to login with Facebook, we use the following ...
1
vote
1answer
12 views

Resource representation can depend on identity?

If some resource on a RESTful api is to be protected, we can do it by using OAuth for example, and then if the there's no token on the headers of the request (i.e. no identity) we return a 401 status ...
11
votes
2answers
665 views

Should I keep email addresses as plaintext in database?

It's clear to everyone (I hope) that storing passwords without at least salting/hashing them is a terrible idea. What about emails? Let's say you keep the subscription email address, if you encrypt ...
1
vote
1answer
53 views

Securing service calls

I have a ServiceCallContext object that must be passed in as the first parameter of any service call. I would like to put a User object on the context object but I know I can't force the caller to ...
27
votes
3answers
2k views

Kernel mode web servers: A clever optimization or a security nightmare?

I was reading a Hacker News thread where one user posts a link from 2011 explaining that IIS is much faster than most other (*nix) web servers. Another user replies, explaining that IIS gets that ...
3
votes
2answers
1k views

One of my team members committed SQL injection-vulnerable code; should I report it to the manager? [closed]

One of my team members committed a huge mistake; a clear SQL injection-vulnerability. It obviously didn't pass my peer review and I made very clear that this is unacceptable. I never saw this ...
3
votes
3answers
140 views

Why should I purchase an SSL certificate for custom domain?

After reading Heroku articles, Stack Overflow questions, and the Stripe payments integration guides, the general advice is that I should should purchase an SSL certificate for my custom domain that ...
0
votes
1answer
80 views

How to let users share custom code content under the mobile app store restrictions?

Situation Mobile application store owners are known to explicitly forbid some application extensibility scenarios. Apple: 2.7 Apps that download code in any way or form will be rejected 2.8 ...
2
votes
1answer
159 views

How to access secure web services from a desktop application?

I'm writing a Java desktop application that will be available to the public. It will contact backend APIs via HTTPS using Jersey client. I don't know anything about using certificates in desktop apps ...
0
votes
1answer
78 views

Developer account in OSX, admin or managed user with our without sudo access?

The tutorials I find to setup OS-X for web developer programming (installing x-code ruby js cocoapods sql c asm etc) leave out if it should be done from an admin account, or standard (managed) user. ...
3
votes
1answer
96 views

How do you implement an active sessions system like LinkedIn? [closed]

With some platforms, like LinkedIn, you can see a list of all sessions where you are logged in, and you can even log them out on a distance. How would you implement something like that? I'm not ...
3
votes
3answers
416 views

What kind of user info is ok to be stored as plain text in SQL Database?

I'm practicing around building e-commerce asp.net applications that allows for users to register to the site and their user credentials are stored in a MySQL database. In my sample project the ...
0
votes
1answer
79 views

Sending Out Functions To Return Or To Die

Which is preferable for both solid technique and secure coding? Example #1: function_one() blah; function_two() blah; print blah; exit; ... Example #2: ...
0
votes
2answers
172 views

Periodically polling an API, are there alternatives?

I'm currently working on a service that is supposed to aggregate data from a number of APIs, unify the data, and offer it through another API to the users. I had a couple of ideas for solving this, ...
3
votes
2answers
168 views

Are there any widely accepted sets of standards/practices for secure coding? [closed]

The title should be fairly self-explanatory. We need to update our coding standards, and as part of this process we've been asked to try and follow an industry standard from a ...
1
vote
2answers
115 views

How to send data between HTTP requests without user modifying it?

I'm currently developing a web application (using laravel) where I have a form that edit a resource. Something like this: <!-- URL: /editResource/3 --> <form action="/editResource/3" ...
1
vote
1answer
61 views

Is this type of data insertion safe and can stop sql injection in Python?

I am learning Database connection from MySQL Connector/Python Developer Guide. This is the code I am using to insert data: conn = mysql.connector.connect(user="user", password="password", ...
1
vote
1answer
194 views

Safe serial numbers generation

I want to generate a 6 digits serial number, ranged from A-Z (only uppercase allow), e.g. serial = "ABCDEF" the problem is, some letters are considered confusing to others letters/numbers, e.g. U ...
2
votes
1answer
337 views

NodeJs website webapp architecture

I would like some advice on how best to architect a website comprising the following: tool a landing page, open to the public, main marketing tool the main website/app, that people can access only ...
0
votes
1answer
38 views

How to create work for a client on login

I have a log-in service that runs a CPU-intensive hash multiple times when a user logs in. In order to reduce the effect of a login DDOS, is there any sort of function that I can "ask" that the client ...
1
vote
1answer
338 views

Should I hide certain HTTP status codes?

So I have different seniors taking different positions on this. Some saying hide nothing, those codes are there for a reason. Others saying to hide most status codes, reducing the number to a much ...
4
votes
2answers
517 views

How to prevent third party misuse of what is intended to be a private api (avoiding what happened to Snapchat)?

I have never used Snapchat and do not intend to but I have been reading up about what happened to them with respect to the recent media coverage about pictures being leaked especially because I am ...
0
votes
0answers
270 views

Row and Field level Security Management through Code First EF, WebApi2

I could not find such question specific to asp.net webapi row level security on SO. I am building an API through .NET Webapi2 with Entity Framework. I am trying to assess various options that are ...
0
votes
2answers
80 views

How do I handle a spam server invalidating my tokens?

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
0
votes
2answers
99 views

How does Google manage their Google Images SSL certificate?

When an SSL certificate is installed on a website, but the page also calls content from another website without an SSL certificate, the SSL certificate icon will turn grey instead of green: instead ...
-3
votes
2answers
185 views

Protecting application against piracy [closed]

Can I somehow protect a source available (you can see the source, but you don't have rights to use it) application against piracy? Is it even theoretically possible? Not all of the application has to ...
4
votes
3answers
722 views

How to securely implement Roles in a Windows Form application?

As an ISV, what is considered best practice for implementing Application Role based security? In other words, only allow users to access certain features in the application based on what Roles they ...
0
votes
1answer
271 views

Anonymous access to api REST, protection

I have a public website that does not require authentication. It's a lighting calculator for indoor cultivation. Anyone can enter and complete the process and ultimately save your settings for future ...
1
vote
3answers
483 views

How do you make sure a .net client application is not being hacked to bypass authorization claims?

We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are: CanOverrideSalesAmount ...
2
votes
0answers
76 views

How to limit users of a service to a specific program

I have built an android game - I would like to add a "high score" leaderboard to it, such that people can show off how high they managed to score. How should I design it so that people can't "hack" it ...
0
votes
0answers
46 views

Database conceptual Question [duplicate]

When querying in database through PHP, is it good to open mysql connection before every query and close it as the query completes? or should we open the mysql connection as soon as the first query ...
1
vote
4answers
391 views

Database Handler and SQL injection prevention

I've written a database model class in PHP and have written a controller class that specifically validates the data before sending it to db. I'm getting criticism that I should handle the data in ...
0
votes
2answers
95 views

Making internal search engine return results that adhere to local permissions on an internal web application

I have an ElasticSearch search engine and an internal web application. Prior to applying the security model, search results were very fast. The security model restricts some users from accessing ...
2
votes
1answer
65 views

Security Pattern to store SSH Keys

I am writing a simple flask application to submit scientific tasks to remote HPC resources. My application in background talks to remote machines via SSH (because it is widely available on various HPC ...
1
vote
2answers
384 views

Is hashing of just “username + password” as safe as salted hashing

I want to hash "user + password". [EDIT: prehashing "user" would be an improvement, so my question is also for hashing "hash(user) + password". If cross-site same user is a problem then the hashing ...
0
votes
0answers
21 views

Storing a WCF endpoint in the registry - worried about security

I am storing my wcf endpoint in the registry, and using that whenever my app starts up to instantiate a wcf derived object. The user can change the endpoint location, to another server, and the ...
1
vote
2answers
543 views

How do I / what is the best way to interact with a desktop application from a browser web application?

Situation: We have a desktop application. We also have a web application. We need the two to interact with each other. So when a button is pushed in the web application, the desktop application ...
0
votes
0answers
631 views

Best practice: Secure Android app online authentication

Currently, I develop an Android App needing online authentication for login (and registration). The main focus is on security. I’m amaing for: keeping the users’ passwords safe and preventing MITM ...
1
vote
1answer
90 views

Testing for Authentication loop holes / bugs

We've got a web application which is 99% complete prior to public beta, were currenlty securing the site from security perspective, locking down the server, db etc, one thing I'm concerned about but ...
0
votes
0answers
180 views

Security in Transversal Layer in Domain Driven Design

I'm building a solution based on Domain Driven Design, I'm trying to implement the security system (authentication, authorization, roles, system configuration, connection strings, etc..) in a ...