For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

0
votes
2answers
139 views

How can I solve this potential security exploit (concerning the saving of REST resources)?

I have a File database table with the following columns: Id (PK), Filename And a Document database table with the following columns: Id (PK), Name, Description, FileId (FK) When a user wants to ...
0
votes
1answer
92 views

How to provide data to a web server using a data warehouse?

We have data stored in a data warehouse as follows: Price Date Product Name (varchar(25)) We currently only have seven products. Once every business day, seven new data points are added ...
0
votes
1answer
101 views

Do we have any special design considerations for maintaining anonymity in an application?

This is an open-ended question which I am analysing while doing some fun projects in leisure. Websites like Google, Facebook do store user activities and perhaps sell them or use them for ...
3
votes
1answer
454 views

Is it possible to protect json api scraping using random tokens?

I have built a restful json api for an online store using Laravel. I now wish to create an AngularJS app to run the front-end web application. Product prices for my store need to update every second, ...
23
votes
6answers
2k views

How is major software protected? [duplicate]

I am a new software developer and I wish to sell my software. I recently realized that from C++ code we can not stop the user seeing parts of the code that are related to scripts or system commands. ...
8
votes
5answers
558 views

Where to store the private key?

Say I want some parts of my software to be encrypted. For example, the credentials for a database, etc. I need to store those values somewhere, but doing so in cleartext would make it easy for an ...
1
vote
4answers
283 views

Is securing the credit card data is considered a requirement from the customer

I'm taking an Introduction to Agile Software Development course, The instructor was discussing an example about online store and asked us to write the User Stories and the Conditions of satisfactions ...
2
votes
3answers
195 views

Is it possible to check a client side application identity from server side? [duplicate]

Assume there is a web service which is visible publicly but it must be just responsive to a specific client application. Is there any mechanism to check client side application identity to prevent ...
1
vote
1answer
292 views

Is it an implementation of a stateful mechanism for Rest API authentication?

In many articles about Rest API's best practices, it is recommended to not depend upon sessions on server side since it leads to a stateful mechanism. I currently use Play 2.2 framework, with a ...
0
votes
0answers
47 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
11
votes
7answers
738 views

Why do modern websites still insist on archaic username/password requirements? [duplicate]

I was signing up for a website last night, and once again was greeted with the fact that my username cannot contain certain characters (including spaces), and neither could my password. Is there a ...
5
votes
6answers
1k views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
3
votes
2answers
271 views

Would using rainbow tables to detect weak user passwords feasible?

As I understand in most security breach where the list of hashed password are compromised, attackers do use brute-force to try to find weak password and, invariably, they always find quite some (like ...
24
votes
9answers
2k views

Why not expose a primary key

In my education I have been told that it is a flawed idea to expose actual primary keys (not only DB keys, but all primary accessors) to the user. I always thought it to be a security problem ...
1
vote
2answers
202 views

How do I dissuade users from using the same password with similar systems?

I'm building a web application that connects to other web services (using strictly anonymous binding, so no user passwords are being used). However the web application maintains its own users itself, ...
2
votes
1answer
357 views

Does facebook store multiple password hashes for each user? [closed]

I noticed that Facebook allows multiple variants of my own password : My password as it is. My password with first letter capitalized. My password with all letters capitalized. It is commonly ...
28
votes
5answers
969 views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
1
vote
2answers
90 views

Recommended secure approach to confirming an URL is called by a legitimate caller

I'm using a CRON on AppEngine and the cron calls my web app at a specific app. I only want to execute functionality when called by my AppEngine app. What's is/are recommended approach to confirming ...
0
votes
1answer
167 views

Making Agile and DevOps methodology compatible with PCI requirements [closed]

Would like to hear from those working in a PCI compliance environment and is practicing agile development and devops methodology, how you maintain compliance with PCI requirements. Specifically, what ...
2
votes
1answer
202 views

Approach to Authenticate Clients to TCP Server

I'm writing a Server/Client application where clients will connect to the server. What I want to do, is make sure that the client connecting to the server is actually using my protocol and I can ...
9
votes
5answers
1k views

How do web servers enforce the same-origin policy?

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
2
votes
2answers
160 views

Principles of an extensible data proxy

There is a growing industry now with more than 30 companies playing in the Backend-As-A-Service (BaaS) market. The principle is simple: give companies a secure way of exposing data housed on premises ...
1
vote
1answer
129 views

Creating deterministic key pairs in javascript for use in encrypting/decrypting/signing messages

So I have been searching everywhere and havn't been able to find anything with the sufficient information I need.. so Im a bit stumped on this one at the moment What I am trying to do is create a ...
1
vote
1answer
109 views

What am I risking if I don't update my SDK/JDK and bundled runtime/JRE every time there's a security update?

It seems like there's a new major security hole patched in Java every other week, and I would assume the same goes for other development platforms. After years of frustration trying to get customers ...
3
votes
1answer
133 views

Some hint to program a webservice “by subscription”

I have some web sites programmed, I know to do it with python and PHP basically. Normally they are simple web sites, but now I want to provide REST web services but only for allowed users (allowed by ...
3
votes
1answer
331 views

Using Dynamic LINQ to get a filter for my Web API

We are considering using the Dynamic.CS linq-sample included in the "Samples" directory of visual studio 2008 for our WebAPI project to allow clients to query our data. The interface would be ...
0
votes
0answers
51 views

How to mitigate security risks when deploying a database to the web via automated migrations?

I'm looking at using built in database migrations frameworks (such as the migration framework included in EF Code First or migratordotnet) but I have concerns about the implications of allowing a ...
2
votes
1answer
157 views

How to check for vulnerabilities in web application [closed]

I have developed a web application using zend framework, mysql, and other client side technologies like javascript, jquery ajax, kendo grid, and so on. I have completed development and have done ...
6
votes
0answers
83 views

What To Do If I've Found a Vulnerability In a Possible Future Employers Site? [duplicate]

I've been self employed for a long time now and have recently decided that PHP development within a company is the route I'd like to go down. I had an initial interview/meeting yesterday with a ...
-1
votes
2answers
142 views

How to manage your personal ssh keys? [closed]

I understand that ssh keys are a cryptographically secured way of authenticating yourself to a service or to another person, but beyond that I'm frankly at a bit of a loss. What confuses me is that I ...
1
vote
0answers
133 views

How to securely store user credentials from external website

I'm developing an application where I'd like to use credentials from external websites. This will be used to login with the website API and get information for the user. Example: I want to use the ...
3
votes
2answers
661 views

Best practice in application design / SQL authentication

I am currently involved in the implementation/design of an existing application for a large scale customer. The application has a similar model as e.g. vCenter Server whereby a number of components ...
1
vote
2answers
99 views

How can I limit access for automatically generated files to specific users in a MVC setup?

I have a typical MVC based website, and I'd like to give some registered users the abillity to extract data from the database (in a variety of formats). The workflow is very simple: User logs in, ...
2
votes
1answer
236 views

How to audit an Android application (not rooted) without having access to its source?

How can I check if an Android application running on a not rooted device is "secure" without knowing its source? I would look for: Plain text in Web-Requests (wireshark and emulator) SQL-injection ...
0
votes
0answers
997 views

How secure is this way of authenticating an ASP .NET Web API - creating your own tokens?

http://www.codeproject.com/Articles/630986/Cross-Platform-Authentication-With-ASP-NET-Web-API#_rating The above link shows exactly how I want to go about authenticating against an ASP .NET Web API. ...
6
votes
6answers
603 views

What are the cases where keeping source code secret is justified?

When I worked as a freelancer, I encountered lots of cases where customers were protecting their ideas and source code of their projects (such as web applications) as much as possible, no matter how ...
2
votes
1answer
222 views

Checking for cross-site scripting vulnerabilities in Perl web applications

I'm putting together some notes for a dev team on how to write secure Perl code - especially taking into account the current OWASP top 10 web application vulnerabilities. For cross-site scripting I've ...
1
vote
0answers
78 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
3
votes
1answer
228 views

What is the identification procedure that registers a mobile device on a subscriber account and installs purchased content?

We know there are several moving parts to a system like the apple store or google play. At the very least; The device has a unique hardware id or sim card The user has a login/pass The "store" site ...
3
votes
3answers
377 views

Shared hosting for a PHP application

I was reading Essential PHP Security and chapter 8 talks about problems with hosting your PHP app in a shared hosting environment. Some of the problems he mentions are: - Exposed source code and ...
14
votes
6answers
924 views

How to assure users that website and passwords are secure

On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All ...
0
votes
3answers
190 views

VB stand alone application or ASP web application

I have experience developing software and web applications and I have decided to do some freelance work on the side. Well, I met with my first client and they are requesting a relatively simple, ...
0
votes
1answer
102 views

Possible holes in a spam-registration prevention approach?

I was thinking of creating some login code (probably to work with BrowserID so users don't need to store their passwords with my site while also ensuring the supplied email account belongs to them) ...
2
votes
1answer
151 views

How much should we spend on improving software security?

Is there a "scientific" method to determine how much resources/money should be spent on improving the security of a piece of software? I work in a team where our work is prioritized by a product ...
3
votes
1answer
264 views

Are there security implications to using dynamically-assigned TCP port numbers?

I'm getting pushback from operations for having a server process listen on a dynamically-assigned port number (i.e. it binds a socket to a port number of 0, triggering a dynamic assignment by the OS, ...
4
votes
1answer
396 views

Is a PHP file secure enough on a GoDaddy Server to hard code an AES salt into the file?

So I am creating a web api for an app I am making. The data is sanitized before it is sent to my web api and then encrypted before it is stored in my MySql server. The phone app sanitizes then ...
2
votes
4answers
273 views

Preventing password hashing algorithm from overloading CPU

These days password hashing algorithms are designed to be slow. While it prevents black hats from guessing the password (at least partially), it also gives additional work for the server. I can ...
1
vote
1answer
62 views

Information protection when registering on web sites

Up until now it seems that when you register on a random web site you do so with blind trust. You assume that the site isn't harvesting information and passwords. You assume the site is reasonably ...
1
vote
1answer
83 views

Is there any reason not to include issue numbers in debug logs?

I was going through the answers to this question: What information must never appear in logs? And noticed that nobody mentioned this particular attribute. It's something I find useful- whenever any ...
28
votes
1answer
912 views

If the spec is flawed, should it still be followed?

I have been assigned to develop an integration to one of my employer's applications to an external system developed by our client. Our client's specification for the integration that has some blatant ...