For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

0
votes
1answer
84 views

Personal Digital Signatures in Web Applications [closed]

In order to sign data with personal digital signature in a web application, server side languages like PHP can do the whole job, but that would require that the user uploads his private key, lets say ...
0
votes
2answers
119 views

Security scheme that prevents duplicate message attacks

I am using custom security scheme to verify communication between client and server. Both client and server have same secret hash phrase. Client builds a message, combines it with hash phrase and ...
3
votes
1answer
62 views

Web application security: Need a 2 phase check?

(Is this the best forum for this type of question?) I'm writing a web application which allows approved users to login, and perform various tasks, depending on the security role(s) they have been ...
9
votes
3answers
1k views

How did desktop applications communicate with remote server before webservices?

I don't have lot of expierence with desktop applications, but if I had to create a client server desktop app, the data access would be done through a webservice. I believe data access through a ...
1
vote
2answers
291 views

Is setting “permanent” persistent login cookies a bad practice?

I realized that in Rails there is a built in permanent method for its persistent login cookies (aka. "remember me" cookies) method to give the client a cookie that expires in 20 years: ...
-1
votes
1answer
219 views

Program to look at the first say 5 characters of a word and return a string if that string is actually the first 5 characters of a word?

For example, say I have a string and it has the letters: RDNAL This is not an actual English word or it doesn't start an actual english word, so the program would skip this string and would avoid ...
15
votes
9answers
3k views

Can you “stop” a C program from being reverse engineered? [duplicate]

I'm sure that many of the middle to high level languages can be reverse engineered. But if a C program can be reverse-engineered, and turned back into editable source code, how do I discourage such a ...
22
votes
4answers
2k views

Is it worth even checking to see if Guid.NewGuid() is Guid.Empty?

In one of the projects I'm working on the following pattern is seen on a fairly regular basis: var guid = Guid.NewGuid().ToString(); while (guid == Guid.Empty.ToString()) { guid = ...
0
votes
2answers
111 views

Should a “secret access code” use the same security as a normal password? [closed]

Obviously, when you store a password, you should use something similar to bcrypt before you store it in in the database. But I have a client who wants to add the ability to add a "secret code" to ...
1
vote
1answer
77 views

How to store sensitive information (e.g. clients' credentials) accessibly for everybody inside?

I just discovered that we store sensitive information on our SharePoint. Since it's accessible by a password alone (and we all know that others click for the password/user name to be automatically ...
1
vote
1answer
253 views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
1
vote
1answer
34 views

What's the proper name for type of security where we secure resources by ownerrship

I work on REST API that mixes two types of security: First you have standard role-based security - so we have multiple roles such as admin, read-only user, super user user etc. Then we have also ...
1
vote
0answers
241 views

What is the “correct” way to store functions in a database?

Note: Yes, I know that storing functions in databases should be punishable by law. We are developing a financial web application using PostgreSQL, Sinatra and AngularJS. As you may have guessed, a ...
1
vote
2answers
128 views

Is it a good idea to require passwords in offline applications?

I am developing an application which can install extension modules (plugins, if you will) from APT-style repositories hosted elsewhere. The plugins need not be signed (although the downloads are ...
1
vote
2answers
194 views

Is it possible to avoid SQL injection by not using a Query Language for most tasks? [duplicate]

I'm coming at this from a somewhat beginners viewpoint so if this is an obvious question it's because I didn't know the right terms to search for. Are there DBMS's that provide an alternative ...
0
votes
2answers
87 views

Secure Rest api from authenticated user

Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call: @Post /increasePoints host:https://www.example.com/increasePoints ...
4
votes
1answer
565 views

What are the reasons for sealing a .jar and how would I verify that?

I have created a sealed jar, but I don't see difference compared to using a non-sealed one. What tests I can perform to verify the jar is sealed? What reason we could have to prefer using a sealed ...
1
vote
1answer
195 views

Browser game played in an iframe - security concerns

I'm not sure if this counts as an Information Security or Webmasters question rather than Programmers, however I'll see how we go. I've been prototyping a help website for a particular browser game, ...
3
votes
1answer
379 views

How to hide a honeypot ( excluding external CSS and JS )

I am adding spam protection to my personal php framework and I think honeypots are a great way to block spam. Unfortunately they weren't invented yesterday and probably most bots do fetch CSS and can ...
0
votes
1answer
55 views

Secure Form Submission

This is probably a no brainer, but I've not been able to find an answer that is definitive. I have a Codeigniter site running on Apache with mod_rewrite (to get rid of index.php) and mod_ssl for ...
3
votes
2answers
118 views

Using Facebook to authenticate, how to link to user record in my app? Email?

I'm using Facebook to authenticate users. We also have conventional username/ password login and registration form too. Anyway, when a user chooses to login with Facebook, we use the following ...
1
vote
1answer
12 views

Resource representation can depend on identity?

If some resource on a RESTful api is to be protected, we can do it by using OAuth for example, and then if the there's no token on the headers of the request (i.e. no identity) we return a 401 status ...
11
votes
2answers
680 views

Should I keep email addresses as plaintext in database?

It's clear to everyone (I hope) that storing passwords without at least salting/hashing them is a terrible idea. What about emails? Let's say you keep the subscription email address, if you encrypt ...
1
vote
1answer
65 views

Securing service calls

I have a ServiceCallContext object that must be passed in as the first parameter of any service call. I would like to put a User object on the context object but I know I can't force the caller to ...
27
votes
3answers
2k views

Kernel mode web servers: A clever optimization or a security nightmare?

I was reading a Hacker News thread where one user posts a link from 2011 explaining that IIS is much faster than most other (*nix) web servers. Another user replies, explaining that IIS gets that ...
3
votes
2answers
1k views

One of my team members committed SQL injection-vulnerable code; should I report it to the manager? [closed]

One of my team members committed a huge mistake; a clear SQL injection-vulnerability. It obviously didn't pass my peer review and I made very clear that this is unacceptable. I never saw this ...
3
votes
3answers
142 views

Why should I purchase an SSL certificate for custom domain?

After reading Heroku articles, Stack Overflow questions, and the Stripe payments integration guides, the general advice is that I should should purchase an SSL certificate for my custom domain that ...
0
votes
1answer
86 views

How to let users share custom code content under the mobile app store restrictions?

Situation Mobile application store owners are known to explicitly forbid some application extensibility scenarios. Apple: 2.7 Apps that download code in any way or form will be rejected 2.8 ...
2
votes
1answer
178 views

How to access secure web services from a desktop application?

I'm writing a Java desktop application that will be available to the public. It will contact backend APIs via HTTPS using Jersey client. I don't know anything about using certificates in desktop apps ...
0
votes
1answer
80 views

Developer account in OSX, admin or managed user with our without sudo access?

The tutorials I find to setup OS-X for web developer programming (installing x-code ruby js cocoapods sql c asm etc) leave out if it should be done from an admin account, or standard (managed) user. ...
3
votes
1answer
99 views

How do you implement an active sessions system like LinkedIn? [closed]

With some platforms, like LinkedIn, you can see a list of all sessions where you are logged in, and you can even log them out on a distance. How would you implement something like that? I'm not ...
3
votes
3answers
425 views

What kind of user info is ok to be stored as plain text in SQL Database?

I'm practicing around building e-commerce asp.net applications that allows for users to register to the site and their user credentials are stored in a MySQL database. In my sample project the ...
0
votes
1answer
79 views

Sending Out Functions To Return Or To Die

Which is preferable for both solid technique and secure coding? Example #1: function_one() blah; function_two() blah; print blah; exit; ... Example #2: ...
1
vote
2answers
196 views

Periodically polling an API, are there alternatives?

I'm currently working on a service that is supposed to aggregate data from a number of APIs, unify the data, and offer it through another API to the users. I had a couple of ideas for solving this, ...
3
votes
2answers
169 views

Are there any widely accepted sets of standards/practices for secure coding? [closed]

The title should be fairly self-explanatory. We need to update our coding standards, and as part of this process we've been asked to try and follow an industry standard from a ...
1
vote
2answers
116 views

How to send data between HTTP requests without user modifying it?

I'm currently developing a web application (using laravel) where I have a form that edit a resource. Something like this: <!-- URL: /editResource/3 --> <form action="/editResource/3" ...
1
vote
1answer
66 views

Is this type of data insertion safe and can stop sql injection in Python?

I am learning Database connection from MySQL Connector/Python Developer Guide. This is the code I am using to insert data: conn = mysql.connector.connect(user="user", password="password", ...
1
vote
1answer
208 views

Safe serial numbers generation

I want to generate a 6 digits serial number, ranged from A-Z (only uppercase allow), e.g. serial = "ABCDEF" the problem is, some letters are considered confusing to others letters/numbers, e.g. U ...
2
votes
1answer
350 views

NodeJs website webapp architecture

I would like some advice on how best to architect a website comprising the following: tool a landing page, open to the public, main marketing tool the main website/app, that people can access only ...
0
votes
1answer
38 views

How to create work for a client on login

I have a log-in service that runs a CPU-intensive hash multiple times when a user logs in. In order to reduce the effect of a login DDOS, is there any sort of function that I can "ask" that the client ...
1
vote
1answer
342 views

Should I hide certain HTTP status codes?

So I have different seniors taking different positions on this. Some saying hide nothing, those codes are there for a reason. Others saying to hide most status codes, reducing the number to a much ...
4
votes
2answers
575 views

How to prevent third party misuse of what is intended to be a private api (avoiding what happened to Snapchat)?

I have never used Snapchat and do not intend to but I have been reading up about what happened to them with respect to the recent media coverage about pictures being leaked especially because I am ...
0
votes
0answers
291 views

Row and Field level Security Management through Code First EF, WebApi2

I could not find such question specific to asp.net webapi row level security on SO. I am building an API through .NET Webapi2 with Entity Framework. I am trying to assess various options that are ...
0
votes
2answers
80 views

How do I handle a spam server invalidating my tokens?

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
0
votes
2answers
99 views

How does Google manage their Google Images SSL certificate?

When an SSL certificate is installed on a website, but the page also calls content from another website without an SSL certificate, the SSL certificate icon will turn grey instead of green: instead ...
-2
votes
2answers
186 views

Protecting application against piracy [closed]

Can I somehow protect a source available (you can see the source, but you don't have rights to use it) application against piracy? Is it even theoretically possible? Not all of the application has to ...
4
votes
3answers
759 views

How to securely implement Roles in a Windows Form application?

As an ISV, what is considered best practice for implementing Application Role based security? In other words, only allow users to access certain features in the application based on what Roles they ...
0
votes
1answer
285 views

Anonymous access to api REST, protection

I have a public website that does not require authentication. It's a lighting calculator for indoor cultivation. Anyone can enter and complete the process and ultimately save your settings for future ...
1
vote
3answers
508 views

How do you make sure a .net client application is not being hacked to bypass authorization claims?

We wrote a simple .NET (C#) desktop application in Wpf. We also used WIF (Windows Identity Framework) to get a list of claims for the authenticated user. Some examples are: CanOverrideSalesAmount ...
2
votes
0answers
76 views

How to limit users of a service to a specific program

I have built an android game - I would like to add a "high score" leaderboard to it, such that people can show off how high they managed to score. How should I design it so that people can't "hack" it ...