For questions relating to cryptography and computer security.
2
votes
4answers
350 views
What are the downsides of leaving automation tags in production code?
I've been setting up debug tags for automated testing of a GWT-based web application. This involves turning on custom debug id tags/attributes for elements in the source of the app. It's a non-trivial ...
2
votes
5answers
114 views
Is it reasonable to require passwords when users sign into my application through social media accounts?
I've built an application that requires users to authenticate with one or more social media accounts from either Facebook, Twitter, or LinkedIn.
Edit
Once the user has signed in, an 'identity' for ...
0
votes
1answer
196 views
Can HTML injection be a security issue?
I recently came across a website that generates a random adjective, surrounded by a prefix and suffix entered by the user. For example, if the user enters "123" for prefix, and "789" for suffix, it ...
21
votes
5answers
1k views
How to implement a safe password history
Passwords shouldn't be stored in plain text for obvious security reasons: you have to store hashes, and you should also generate the hash carefully to avoid rainbow table attacks.
However, usually ...
3
votes
3answers
213 views
Securing credentials passed to web service
I'm attempting to design a single sign on system for use in a distributed architecture. Specifically, I must provide a way for a client website (that is, a website on a different ...
1
vote
1answer
176 views
Are python's cryptographic modules good enough?
I mean, say you were writing professional grade software that would involve sensitive client information. (Take this in the context of me being an amateur programmer.)
Would you use hlib and hmac? ...
3
votes
5answers
527 views
Security issue about making my code public in GitHub
I'm developing a big community/forum website and I'd like to upload my code to GitHub to have at least some sort of version control over it (because I have nothing other than a .rar file as a backup, ...
2
votes
2answers
97 views
Moving between sites using SAML
I'm tasked with developing an SSO system, and was guided towards using the SAML spec. After some research I think understand the interaction between a Service Provider and an ID Provider and how a ...
1
vote
1answer
237 views
Is the escaping provided by the Google-Gson library enough to ensure a safe JSON payload?
I am currently using the Google-Gson library to convert Java objects into JSON inside a web service.
Once the object has been converted to JSON, it is returned to the client to be converted into a ...
1
vote
3answers
146 views
How do I trust an off site application
I need to implement something similar to a license server. This will have to be installed off site at the customers' location and needs to communicate with other applications at the customers' site ...
1
vote
1answer
102 views
What are the security implications of running untrusted code on my server?
I would like to set up an app that allows users to send their code and execute it on my server. The thought of running untrusted code makes me cringe, so I am trying to set up an exhaustive list of ...
1
vote
1answer
84 views
Why don't smart phones have an auto-forget password feature? [closed]
Storing passwords to external services (e.g. corporate email servers) on smart phones is very insecure, since phones are more easily stolen. Has any vendor implemented a feature to only cache a ...
4
votes
1answer
89 views
How to go about designing an intermediate routing filter program to accept input and forward accordingly?
My predicament:
I designed an app, written in Python, to read my mail and check for messages that contain a certain digital signature. It opens these and looks for keywords. If the message contains ...
4
votes
1answer
214 views
J2EE - Field level Role-based security for a complete web application [closed]
I have a complex website designed using Spring MVC and MyBatis. User Interface is very complex and we have lot of custom made widgets - calenders, lists, graphs etc.
If we were to implement field ...
2
votes
2answers
145 views
help for choosing an encryption method for a database column
I'm storing some phone numbers in the database which should kept totally secret (they're supposed to access via web). BTW, because of the position of these people, I need to prevent any chance for ...
0
votes
2answers
239 views
Is using dirname(__FILE__) a good practice?
Looking at the code of Joomla I see that in the first line of the index, it defines the base path of installation with dirname(__FILE__).
Is this a possible risk for the site? If a non controlled ...
10
votes
5answers
316 views
What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability?
At my local university, there is a small student computing club of about 20 students. The club has several small teams with specific areas of focus, such as mobile development, robotics, game ...
4
votes
4answers
129 views
System that splits passwords across two servers
I stumbled upon this news article on BBC,
RSA splits passwords in two to foil hackers' attacks
tl;dr - a (randomized) password is split in half and is stored across two separate servers, to foil ...
-2
votes
3answers
142 views
What is the Best Practice for creating a secure login in a client - server appllication?
It's been a while I have been thinking on what could be the best scenario for creating a secure login in a client-server application running on internet or any other networks ! So I became with the ...
3
votes
2answers
54 views
Resources on securing domain models? [closed]
I'm have good resources on both security, domain modelling, and architecture patterns. I've noticed a distinct lack of any suggestion of how and where to integrate security into the systems I build. I ...
1
vote
2answers
154 views
Drop in service for account management, authentication, identity?
I'm building an Android app and associated set of web services for uploading/downloading data. I need a basic (no frills) solution for account management (register, login, logout, verify ...
3
votes
1answer
119 views
How secure (or insecure) is it to install Node packages globally?
Should I be concerned with security when installing Node packages globally? Why or why not?
7
votes
2answers
347 views
Would I be able to use code hosting services to host malware code?
Let me start by saying that I am a computer security researcher. Part of my job is to create malware to deploy on a controlled environment in order to study or evaluate several aspects of computer ...
8
votes
4answers
245 views
Avoiding “double” subscriptions
I am working on a website that requires a bit of marketing; let me explain.
This website is offering a single, say, iTunes 50$ voucher to a lucky winner.
To be entered in the draw, you need to ...
5
votes
3answers
277 views
What is the best policy for allowing clients to change email?
We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
2
votes
1answer
270 views
Why is iOS “jailbreaking” CPU specific?
Recently, iOS 6 was "jailbroken" but only on the Apple A4 CPU.
Why is the "jailbreaking" process specific to a CPU?
From Wikipedia:
... "iOS jailbreaking is the process of removing the ...
5
votes
3answers
307 views
Learning about security and finding exploits [closed]
First things first: I have absolutely no interest in learning how to crack systems for personal enrichment, hurting other people or doing anything remotely malicious.
I understand the basis of many ...
3
votes
2answers
267 views
Should I be using a JavaScript SPA designed when security is important
I asked something kind of similar on stackoverflow with a particular piece of code however I want to try to ask this in a broader sense.
So I have this web application that I have started to write in ...
5
votes
1answer
135 views
Development-led security vs administration-led security in a software product?
There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level ...
2
votes
1answer
179 views
Does the deprecation of mysql_* functions in PHP carry over to other Databases(MSSQL)?
I'm not talking about MySQL, I'm talking about Microsoft SQL Server
I've been aware of PDO for quite some time now, standard mysql functions are dangerous and should be avoided.
...
5
votes
1answer
135 views
How to learn what the industry standards/expectations are, particularly with security?
For instance, I was making my first mobile web-application about a year ago, and half-way through, someone pointed me to jQuery Mobile. Obviously this induced a total revolution in my app. Rewrote ...
0
votes
1answer
172 views
How do PGP and PEM differ?
Email messages are sent in plain text which means that the messages I send to Derpina are visible to anyone who somehow gets access to them while they are in transit.
To overcome this, various ...
-1
votes
3answers
116 views
Situations that require protecting files against tampering when stored on a users computer
I'm making a 'Pokémon Storage System' with a Client/Server model and as part of that I was thinking of storing an inventory file on the users computer which I do not wish to be edited except by my ...
1
vote
1answer
341 views
Performing user authentication in a CodeIgniter controller constructor?
In "The Clean Code Talks -- Unit Testing" (http://youtu.be/wEhu57pih5w), Miško Hevery mentions that "as little work as possible should be done in constructors [to make classes more easily testable]'. ...
29
votes
7answers
2k views
Should a stack trace be in the error message presented to the user?
I've got a bit of an argument at my workplace and I'm trying to figure out who is right, and what is the right thing to do.
Context: an intranet web application that our customers use for accounting ...
1
vote
1answer
198 views
How can we change/protect the namespace of an object in Javascript?
Continuing from my previous question: Javascript simple sample code to understand prototype-based OOP basics
Let's say we run into console this two separate objects(even if they are called child and ...
7
votes
3answers
219 views
How to explain to my customer that the hosting provider is terrible, security-wise?
As a freelance developer, I sometimes have to access the administration panels of hosting providers of my customers. It is an astonishingly frightening experience. Below are some points I noticed when ...
-1
votes
4answers
958 views
Application connecting to database server
I'm working on an application which requires user credentials and so on. So a database is required on the backend.
What is the best practice to connect to a database without hardcoding your password ...
3
votes
4answers
440 views
Public-private key pair handling on a Windows ecosystem
I've been thinking about how to architect an infrastructure for one of our business applications with the following requirement:
Data written by some user can only be read by that user and his ...
3
votes
1answer
144 views
OAuth2 flow - does the server validate with the Auth server?
I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something.
I understand that the client authorises with the OAuth provider (google for example) and ...
-2
votes
3answers
190 views
How to handle security of temporary data on web server?
I'm primarily an ASP.NET developer but this question really applies regardless of language. So obviously it is a good idea to prevent external attacks that arise from session hijacking and csrf ...
0
votes
1answer
233 views
Should OAuth token be shared to implement SSO?
What's a commonly accepted way of implementing SSO using a third party OAuth provider?
I have a server with user resources associated with server's user ID, the user ID also has a Facebook user ID ...
2
votes
4answers
725 views
why control + alt + delete couldn't be intercepted by any application
The secure attention key is designed to make login spoofing impossible, as the kernel will suspend any program, including those masquerading as the computer's login process, before starting a ...
9
votes
2answers
473 views
How do CDNs protect failover sites from DDoS attacks?
I'm in the design process for a Java web app that I will probably end up deploying to Google App Engine (GAE). The nice thing about GAE is that I really don't have to worry about fortifying my app ...
3
votes
3answers
254 views
Saving Passwords To The Local Device
So In my app (iOS), you have to register in order to use the service (a food service). But in order to change details about your account (username, password, and email), you have to reenter your ...
0
votes
3answers
107 views
User management data - the need for a username and password
I would have this asked on StackOverflow if it had code, but it's more on the idea/concept so I asked here.
I am working on the UI of our inventory system when I found out that when registering a ...
0
votes
2answers
177 views
What is the logic behind filtering/sanitizing input?
I have always found it more logic to validate input instead of filtering it. How to appropriately filter data depends on the situation, so IMO it should be done in output or when saving to a database.
...
13
votes
10answers
789 views
How important is an SSL certificate for a website?
I'm bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I'm using subdomains and I need to access them with iframes (it's ...
3
votes
2answers
121 views
Separation of concerns and security
The system I am developing is designed to have multiple organizations, with users and roles for each organization. Some organizations can interact, some can not, and generally organizations are not ...
4
votes
5answers
757 views
What is the rationale behind entering email twice for registration?
Many web sites ask users to enter their email address twice, sometimes taking the trouble to disable copy-pasting.
What is the logic behind this? Is this e.g. a security measure?
