For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

2
votes
2answers
118 views

Where should you store/how should you control access to application secrets?

There are these relevant questions questions: Strategy for keeping secret info such as API keys out of source control? How do you deal with configuration files in source control? How to version ...
-3
votes
1answer
81 views

Manage lock of a software feature [closed]

I've wrote a standalone java SE software which executes, for example, the features A, B and C. Now, i want to that, if a lock is enabled (and this lock is a command sent remotely by my backend), the ...
1
vote
1answer
57 views

Is opening a templating engine to users a bad idea?

My site allows users to create custom HTML templates for their profiles (very much like Tumblr and the theme system), and I picked the Twig template engine for the site. However, I'm not sure if it'...
0
votes
0answers
63 views

Web service security token storage

I have two operations in my JAX-WS web service: First takes username and password as parameters and generates random alphanumeric token, second takes this token and username as parameters, verifies ...
2
votes
2answers
49 views

Customer Authentication in a website

Just to be clear, by authentication I don't mean user-authentication, but I want to make sure that my app is running on the customer's server and in a defined time-span. Some of our customers use our ...
0
votes
0answers
33 views

Client application and secure data exchange without ssl/tls

I have my own home server and port 80/443 is blocked from my ISP provider. I want to create a Qt gui application that saves my data on my server using REST (using port 8080 or something) using nginx/...
1
vote
0answers
74 views

Generate a fixed length number hash from a number

Let say I've a fixed length number, e.g. 6 digit: 837493, I want to apply some process (with a salt), and generate a new number of another 6 digits, e.g. number = 837493 another = hash(number + ...
12
votes
2answers
3k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
14
votes
2answers
954 views

Should UDP data payloads include a CRC?

For a company I used to work for, I had to implement a socket receiver that mostly took data in UDP form over a local connection from some specialized sensor hardware. The data in question was a well-...
0
votes
0answers
62 views

Client blocks fonts in browser => font-awesome is not being displayed

I am working on a web platform for which we have different clients. In this platform we make a strong use of font-awesome. I have always thought this was a safe and elegant choice with which I had ...
3
votes
2answers
195 views

Making a security on webapi for browser usage [closed]

I have a webapi project working in production for few months now. The entire webapi is server to server. There is a need now to have the same functionality in a browser, meaning the customers ...
23
votes
3answers
8k views

REST API security Stored token vs JWT vs OAuth

I am still trying to find the best security solution for protecting REST API, because the amount of mobile applications and API is increasing every day. I have tried different ways of authentication,...
3
votes
1answer
94 views

How to be sure that a certain code does not call interrupts?

Imagine that you have an object code file from an untrusted source. You want to run this code to know the result of its computation, and you want the code to perform fast, so setting up a whole ...
1
vote
0answers
54 views

'HMAC style' design example for a shared secret

I'm looking to secure an API based on a shared key and a given username and datetime. The API gives access to trusted third parties and does not require the input from a user in order to access their ...
-1
votes
2answers
196 views

Do people modify open source code to hack? [duplicate]

I am trying to create an authentication client and server for my project, and I am trying to think of ways on how a potential hacker could modify my code and use it to hack the servers. Do people ...
2
votes
1answer
64 views

Identity propagation using Azure service bus

We currently have a platform with a SOA architecture in which the user's identity is propagated from the web application via middle tier services (REST and SOAP) until we actually query our data ...
5
votes
1answer
2k views

REST API security: HMAC/key hashing vs JWT

I just read this article that is a few years old but describes a clever way of securing your REST APIs. Essentially: Each client has a unique public/private key pair Only the client and the server ...
5
votes
1answer
42 views

OAuthv2 authorization grants

I just read this excellent tutorial on OAuthv2 but am still missing some important concepts regarding authorization grants. I'm fundamentally not understanding the necessity for the two request/...
2
votes
1answer
246 views

How to *detect* if open source software is used in a commercial product? [closed]

The established procedure regarding releasing code out in the open is to accompany it with a license. Out of the many flavors that exist (BSD, MIT, GPL, LGPL, Boost ...) there are some that prohibit ...
2
votes
2answers
301 views

Restful User/Password Authentication

I'm currently designing a REST-API with the following properties: Backend for a single page application (Later Apps) Integrated user database for each instance HTTPS/TLS only Authentication with ...
1
vote
1answer
121 views

Porting security from Java/.NET to PHP

This probably a rather naive question given my limited knowledge in the code I've been looking at, but I want to get my head around it before I start diving into writing actual code myself. I'm ...
1
vote
0answers
121 views

How safe is returning a password from a function? [duplicate]

Is returning sensitive data like a password from a function safe, and what attack vectors exist? (Personally, it is regarding PHP, but is a general question.) function returnDBPass(){ $pass="...
21
votes
4answers
3k views

Why not just make non-parameterized queries return an error?

SQL injection is a very serious security issue, in large part because it's so easy to get it wrong: the obvious, intuitive way to build a query incorporating user input leaves you vulnerable, and the ...
0
votes
0answers
144 views

Should a SPA have a route URL visible in address bar?

I am developing a Angular SPA using angular-ui-route. We are in a confusion of should we have the route visible for User in the address bar or just have index.html (or home page) always ? Is there a ...
1
vote
2answers
227 views

Why are Strings in StringPool considered insecure?

Passwords are recommended to be stored in char[] instead of String, as Strings are stored in StringPool. Read more here As per this question Strings in StringPool are not available directly. To ...
1
vote
3answers
311 views

Javascript Password Security [closed]

I am having difficulty with the answer provided here, but I couldn't understand how to implement it. My code is pretty much identical: <script language="javascript"> function check(form) { ...
1
vote
2answers
235 views

Avoid data manipulation by user

I have a C# program (could be any programming language) that saves data to a file on a memory (hard disk, USB drive, etc.). The program uses this data for monitoring its operation time, but it could ...
1
vote
0answers
157 views

Securing a private API used by an iOS App

I have an app that uses an API server and I do not want to have anything other than it to be able to use that API. I know this isn't totally possible, but I want to do what I can. I don't think my ...
0
votes
0answers
35 views

Detecting web proxy security

Various online resources offer proxy lists claiming that they offer various levels of anonymity. I'm trying to find out how this can be programmatically tested. I suspect the answer lies in headers. ...
0
votes
1answer
128 views

File sharing web application - folder PIN code entry best practice

I'm developing a web app for internal file sharing and one of the requirements is to have PIN code protected folders. What I came up now is a folder like structure with the following: Folder ...
1
vote
1answer
337 views

How to generate Generate Hash incorporating time stamp so it can be unhashed to get the timestamp when it was generated?

I want to create hash based on random id, That hash has to be valid for only 15 minutes. Is there a way to do that? I'm using this for form submission. If some unknown submitted form or some one ...
1
vote
2answers
243 views

Convert this abstract class to an interface

I have a security method I would like to be able to sprinkle into other classes throughout my program. It is currently an abstract class but I feel it would be more appropriate as an interface. Can ...
0
votes
0answers
160 views

Passing Data Between Tiers in 3-Tier Architecture

Assuming we are talking physical tiers, my understanding is that in order to pass data from say the data tier to the business logic tier the JSON format is used (or XML), so say I have an ORM (...
0
votes
1answer
152 views

Algorithm to maintain a blog sign up page

I have a functional sign up page for a blog that updates a database with a users name, email, profile picture and a short bio. The General information page and the profile picture upload/bio page are ...
-1
votes
1answer
56 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
1
vote
2answers
73 views

Security and sanitizing user-input with limited control over 'output' targets

I have recently joined a team working on an application with an integrated chat system. It is a standard chat system that allows clients to communicate, with messages routed through a central server. ...
0
votes
0answers
306 views

Best approach for an android local database-based application containing non-sensitive data

What's the best approach to design an android application with the question title specification? The application will show a first list of buttons with an alphabetical classification (like button1: A-...
-1
votes
1answer
107 views

Eclipse plugins - safe to install? [closed]

I've seen a few useful plugins for Eclipse such as jshint-eclipse. However, I'm a bit leery of installing third-party code. Is it generally safe to install Eclipse plugins without worrying about my ...
0
votes
1answer
57 views

Logging private data

In general, I write a debug log whenever one of my functions is entered, including the parameters. For instance: function execute_query($query, $conn_string) { $this->log->...
39
votes
13answers
6k views

How safe is it to compile a piece of source code from a random stranger? [closed]

Suppose I'm reviewing code that job applicants send to prove their skills. Clearly I don't want to run executables they send. Not so clearly I'd rather not run the result of compilation of their code (...
6
votes
1answer
2k views

Token or ASP.NET Identity based security in ASP.NET Web API 2

Background I have a Web API 2 project, without any extension of ASP.NET MVC or ASP.NET projects. The API will only be used to communicate between the server and Windows 8, Windows Phone 8.1 and iOS ...
0
votes
2answers
193 views

Binding software to one PC [closed]

I have generated a .exe of a Python script. I wish to give this software as a demo version to few of clients. For the same I want to bind the software to a particular PC. i.e. If I install the ...
4
votes
1answer
174 views

Directly query database vs. Using web service

I'm a junior programmer, am working on a WPF application that will deploy to ~50 users. We basically are streamlining all of his charting/tracking of client data. Each user will probably make about ...
2
votes
2answers
123 views

Crypto hash in 'a href'?

It seems to me that it would be pretty useful to be able to indicate an expected crypto hash value in file downloads especially since so many application and data downloads rely on mirrored hosting. ...
4
votes
1answer
133 views

Why does SOP permit cross-origin form submissions?

Same Origin Policy does not prevent origin foo.bar from creating a form with action attribute set to another origin baz.duh and even allows to programmatically submit this form without the user ...
0
votes
2answers
185 views

What is the value of encoders with decoders currently present

Can you tell me the value of using PHP encoder (ioncube, phpshield) with currently present service like decry.pt (http://www.decry.pt/) that can easily decode source codes. I have tried decry.pt's ...
1
vote
2answers
128 views

How much should I concern myself with hiding the IDs of my database in URLs?

I keep coming across questions and articles on the internet suggesting that it's not a good practice to have the IDs of your database records visible to the public. Yet I've never taken it seriously ...
1
vote
1answer
130 views

Resetting vs. re-sending forgotten passwords

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
1
vote
1answer
50 views

API authentication with a single ID

A typical API authentication usually rely on a pair of API ID + SECRET, my question is: if the API ID is unique and randomly generated and is considered strong enough (e.g. SHA512), why a SECRET is ...
2
votes
1answer
185 views

What's the best practise for storing web server credentials for your web app deployment?

I was looking at the Oracle documentation for the weblogic maven plugin. In it, they store the weblogic user name and password for accessing in the pom.xml. Just wondering, isn't this a terrible ...