For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

0
votes
0answers
39 views

Online error reporting without network access

I have developed an application for android requiring no permissions, but the biggest downside of this is that I don't have error reporting. So, I was playing around for the past week with any ...
0
votes
1answer
191 views

What is the proper way to extract and pass parameters to call javascript functionality from my PHP page?

This is my situation: I have a search results page in PHP where most of the logic resides in a javascript file in order to avoid refreshing the page every time an action is performed. The first thing ...
3
votes
2answers
148 views

What are some best practices for securing AWS credentials (or other secrets) for large team? [closed]

I was "that guy" that pushed his aws keys to github. Ugh. Anyway, I'm doing some research on how to prevent this in the future as this is the third time I've seen this done (my first!) and it was just ...
2
votes
1answer
169 views

Standard ways of revoking user access to a site

I'm in the process of building a .NET MVC website where a requirement is that admin users should be able to lock accounts to not only prevent future log-ins but to also immediately revoke access to ...
1
vote
2answers
151 views

Hide admin menu if no admin option is available

If you have a menu "Admin tasks" and different admin tasks (like 10) that you could separately assign to each user, but there are users who don't have any admin tasks, how would you deal with "Hiding ...
0
votes
2answers
238 views

Are random number generators security holes?

If I retrieve a random number from a database (e.g. RAND() in SQL Server) or using a programming language and send this in some form back to a client machine, is there an economic chance I will be ...
0
votes
0answers
29 views

Domain security involving domain logic

Together with my application's domain logic I am trying to outline the security model. I am stuck with a requirement that prevents me from considering security just a cross-cutting concern over my ...
-1
votes
1answer
147 views

Prevent 3D model from being copied [closed]

So I have been messing around with thingiview since I wanted to have a 3D viewer for the models on my site. It works great and everything except one problem. It's nothing wrong with thingiview, it is ...
1
vote
1answer
157 views

Implicit OAuth2 endpoint vs. cookies

I currently have an app which basically runs two halves of an API - a restful API for the web app, and a synchronisation API for the native clients (all over SSL). The web app is completely ...
1
vote
1answer
217 views

Is it safe to generate client nonces using random number generator?

I am making HTTP calls on the client side and the server expects me to supply a client nonce. It needs to be 4 bytes long. I am planning to use this combination: base64(parts of the MAC address + ...
0
votes
1answer
143 views

Browser security and payments

I've been finding a lot of blog posts claiming JS encryption is unsafe, here's a couple of detailed ones: http://www.matasano.com/articles/javascript-cryptography/ ...
1
vote
1answer
133 views

How to secure a Django application's source code? [duplicate]

I have developed a Django application for a company. Now I am about to ship it to my customer. After reading through online articles and books, I understood that securing the source code of any web ...
0
votes
1answer
74 views

Encyption for passwords in config file?

I was wondering, if it makes sense to encrypt passwords for external services stored in my config file with an symmetric encryption algorithm? On the one hand I think, if someone gets access to the ...
-4
votes
2answers
252 views

How do remote programmers working on proprietary software go about securing their work/source code? [closed]

I was just wondering what kind of protocols a software engineer would go through if they were working at home for a company developing proprietary closed source software. Would you use a third party ...
3
votes
1answer
400 views

Which automated analysis tools can find the heartbleed bug? [closed]

After reading this description of the infamous heartbleed bug, and how the OpenSSL team is relatively small and lightly funded, I'm wondering: would this bug have been uncovered by coverity, valgrind ...
0
votes
0answers
110 views

Is my application secure enough

first of all, I don't have any code to display in my question here, because I'm still designing the application structure, so i only got design developed. I'm building a phone application that I'm ...
0
votes
1answer
134 views

What are security advantages of Google Caja over using the web worker API? [closed]

I am currently looking into Google Caja to run user-supplied JS code in the browser and in Node. So far, I understand, that, in a browser context, "cajoled code" disallows reading and messing with ...
1
vote
4answers
145 views

Is secretive systems development really possible?

An agency wants to develop a highly secret computer system using public contractors. So they hire different companies to implement different components of the system. When all the components are ...
-2
votes
2answers
235 views

Securing PHP source code from illegal copy [closed]

my IT boss asks what is the best way to secure the PHP source code against illegal copy of the code once it is deployed to clients. Is there a PHP compiler that will make the final codes unreadable? ...
1
vote
2answers
220 views

Is displaying an HTML email a security risk?

I am writing a simple webmail where I want (obviously) to display the emails. I'm wondering if I should take any precaution while displaying HTML emails: is dumping the email content into a ...
10
votes
6answers
1k views

Why do most sites require email activation [closed]

Most popular applications nowadays require account activation by email. I've never done it with apps that I've developed so am I missing some crucial security feature? By email activation I mean when ...
2
votes
2answers
356 views

When is the private key given to the client? [closed]

http://www.thebuzzmedia.com/designing-a-secure-rest-api-without-oauth-authentication/ I've been reading the article and I haven't really grasped it yet. When is the private key given to the client? ...
0
votes
2answers
122 views

How do I access databases from a mobile device securely?

I have been doing some research on accessing a DB from mobile devices. There are so many different ways of doing it. There are also multiple ways to make it secure. What is a good way to access a ...
2
votes
5answers
268 views

secure photos on server [closed]

I would like to hear advice from the more experienced developers. The project is now in the design stage. It's mobile application and a simple web application. Content is pictures, comments, personal ...
0
votes
1answer
78 views

Is there a design pattern for updating lists?

I want to modify one list (actually info stored in a database). A person doesn't have access to update every part of the list, but can update and delete parts they do have access to and add whatever ...
1
vote
2answers
437 views

How to avoid unauthorized use of an API?

I have to design a "widget", a script that partners will embed in their websites to display some UI and make calls to our API. Basically it will display our data on these sites based on some IDs they ...
2
votes
1answer
63 views

How is same-origin policy implemented?

I was looking at cross-domain requests for a design and stumbled upon something that puzzles me. From a local site I'm firing an Ajax request to another domain (with jQuery and vanilla ...
1
vote
1answer
57 views

Is this mini-DSL for hiding URI passwords compatible with the URI spec?

Passwords exposed in URIs An application stores URIs to be used for file transfers via SFTP, FTP, FTPS and SCP. Many of these URIs contain passwords, for example: ...
0
votes
2answers
257 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
1
vote
4answers
260 views

Is just using an email address for login a good idea?

Many a times I need to log into a website that I used months ago and have forgotten my password. So clicking the reset password link and the site sends me an email with a single use link which allows ...
13
votes
4answers
837 views

What to do when your company doesn't encrypt passwords

Background I'm been contracted to help a company maintain their server. I work on some minor PHP projects but also look over performance issues and recently, scan logs for hackers. These guys have ...
1
vote
2answers
179 views

Fixing a security exploit - but then everyone knows about it

Earlier, I was messaged about a potential security risk in one of my projects. I checked it and found that it allows for "arbitrary code execution". (Quotes because it is running in a VM, but the ...
1
vote
1answer
200 views

How important is an SSL certificate for a internal website?

I know many people have asked the same question but I think it really depends on the type of the website. So that's why I am asking the question about my website. I am developing a PHP web ...
1
vote
1answer
168 views

Is masking really necessary when sending from Websocket client

The current Websocket RFC requires that websocket clients mask all data within frames when sending (but server is not required to). The reason the protocol was designed this way is to prevent frame ...
2
votes
2answers
133 views

Security concern regarding web service

I'm currently working on a pet project with two of my buddies. This web service will provide basic functionality such as Login/Password Modification/Registration etc. All of us are comfortable with ...
0
votes
2answers
143 views

How can I solve this potential security exploit (concerning the saving of REST resources)?

I have a File database table with the following columns: Id (PK), Filename And a Document database table with the following columns: Id (PK), Name, Description, FileId (FK) When a user wants to ...
0
votes
1answer
127 views

How to provide data to a web server using a data warehouse?

We have data stored in a data warehouse as follows: Price Date Product Name (varchar(25)) We currently only have seven products. Once every business day, seven new data points are added ...
0
votes
1answer
103 views

Do we have any special design considerations for maintaining anonymity in an application?

This is an open-ended question which I am analysing while doing some fun projects in leisure. Websites like Google, Facebook do store user activities and perhaps sell them or use them for ...
3
votes
1answer
912 views

Is it possible to protect json api scraping using random tokens?

I have built a restful json api for an online store using Laravel. I now wish to create an AngularJS app to run the front-end web application. Product prices for my store need to update every second, ...
24
votes
6answers
2k views

How is major software protected? [duplicate]

I am a new software developer and I wish to sell my software. I recently realized that from C++ code we can not stop the user seeing parts of the code that are related to scripts or system commands. ...
8
votes
5answers
604 views

Where to store the private key?

Say I want some parts of my software to be encrypted. For example, the credentials for a database, etc. I need to store those values somewhere, but doing so in cleartext would make it easy for an ...
1
vote
4answers
294 views

Is securing the credit card data is considered a requirement from the customer

I'm taking an Introduction to Agile Software Development course, The instructor was discussing an example about online store and asked us to write the User Stories and the Conditions of satisfactions ...
2
votes
3answers
285 views

Is it possible to check a client side application identity from server side? [duplicate]

Assume there is a web service which is visible publicly but it must be just responsive to a specific client application. Is there any mechanism to check client side application identity to prevent ...
1
vote
1answer
421 views

Is it an implementation of a stateful mechanism for Rest API authentication?

In many articles about Rest API's best practices, it is recommended to not depend upon sessions on server side since it leads to a stateful mechanism. I currently use Play 2.2 framework, with a ...
0
votes
0answers
52 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
11
votes
7answers
863 views

Why do modern websites still insist on archaic username/password requirements? [duplicate]

I was signing up for a website last night, and once again was greeted with the fact that my username cannot contain certain characters (including spaces), and neither could my password. Is there a ...
6
votes
6answers
2k views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
3
votes
2answers
288 views

Would using rainbow tables to detect weak user passwords feasible?

As I understand in most security breach where the list of hashed password are compromised, attackers do use brute-force to try to find weak password and, invariably, they always find quite some (like ...
24
votes
9answers
2k views

Why not expose a primary key

In my education I have been told that it is a flawed idea to expose actual primary keys (not only DB keys, but all primary accessors) to the user. I always thought it to be a security problem ...
1
vote
2answers
206 views

How do I dissuade users from using the same password with similar systems?

I'm building a web application that connects to other web services (using strictly anonymous binding, so no user passwords are being used). However the web application maintains its own users itself, ...