For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

2
votes
1answer
718 views

Any ASN.1 parsers written completely in managed code & safe from buffer overflows

ASN.1 is a data format used on HTTPS certificates, and various other critical pieces of infrastructure. I need to analyze some potentially hostile ASN.1 data, and want to ensure my code is safe from ...
5
votes
1answer
970 views

API Authentication, One time token VS Dynamic tokens

We are working on a new project, we are two lead developers and got on a cross road on how to use a token to secure the communication between the server and the client : First Suggestion : (The one ...
1
vote
2answers
281 views

How your team manage shared password/key [duplicate]

It maybe a shared SSH private key, it maybe be a online password to some web site. In term of security & convenient, and support fine grained permission settings, e.g. developers role, testers ...
1
vote
1answer
218 views

User Authentication & Session Management

One of the fundamental ways of handling user login authentication & session management is by storing variables in Session space plus setting some data in cookies on client computer while sometimes ...
1
vote
5answers
1k views

Building a web app with encrypted MySQL database entries?

I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be ...
4
votes
2answers
401 views

Where to Perform Authentication in REST API Server?

I am working on a set of REST APIs that needs to be secured so that only authenticated calls will be performed. There will be multiple web apps to service these APIs. Is there a best-practice approach ...
1
vote
3answers
382 views

Avoid malicious code while dynamically loading classes with ClassLoader

Background One of the advantages of decoupled components in systems is that you can extend the system without having to touch the existing code. Sometimes you don't even have to recompile the old ...
1
vote
3answers
223 views

What is the best way to store configurations of shell/script code to execute later?

I am working on a tool (Python, may or may not be important) that will allow a user to maintain a configuration file containing arbitrary shell and/or language code to be executed on particular events ...
0
votes
3answers
155 views

How can I secure a request handler so I only respond to the correct clients?

Here's the scenario... I have a web site that has a generic handler written in asp.net (.ashx file) that accepts http requests, gets relevant data, converts the result into xml and then passes that ...
1
vote
3answers
163 views

Protect Images in a Webpage

I want to build a website that will contain a lot of images. I don't want users who visit the website to be able to save the images. I have blocked the right click option, but is there any other ...
0
votes
2answers
75 views

How ensure secure two cloud services can only talk to each other?

Question Given two cloud services, Sender A & Receiver B, communicating over HTTPS, what options do I have to ensure that Receiver B only response to Sender A? For the purposes of Background ...
4
votes
1answer
151 views

Is there an industry standard for systems registered user permissions in terms of database model?

I developed many applications with registered user access for my enterprise clients. In many years I have changed my way of doing it, specially because I used many programming languages and database ...
4
votes
2answers
206 views

Secure an Application/Software by expiration with Date?

I have been working on some software application and I update them every 6 months. Currently, the way I track the date is by extracting the date from the system when the user installs the application, ...
2
votes
1answer
328 views

Security Risks of Unsigned ClickOnce Manifests

Using signed manifests in ClickOnce deployments, it is not possible to modify files after the deployment package has been published - installation will fail as hash information in the manifest won't ...
5
votes
3answers
354 views

How to store / not to store passwords

I am building an web site which will allow users to aggregate the information stored in their online profiles ("data feeds") in one place. I am wondering - what is the accepted (from a secureness ...
6
votes
4answers
393 views

Public-key cryptography security given NSA resources

I was wondering how secure public private key encryption methods are. If two individuals were sending emails back and forth forever, where each person would encrypt the body of the email they were ...
1
vote
1answer
282 views

Is there a setting to enable anti forgery globally in ASP.NET MVC, and if not, why?

The tutorials I've read tell you to use [ValidateAntiForgeryToken] attributes and <%= Html.AntiForgeryToken() %> in your code. I was wondering why this isn't a built-in automatic setting or at ...
0
votes
0answers
23 views

Login to a Web App using PKI Certs [duplicate]

I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
6
votes
1answer
526 views

Implementing Digitally signed data in a Web Application

I understand PKI well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of Transactions or ...
31
votes
5answers
6k views

How easy is it to hack JavaScript (in a browser)?

My question has to do with JavaScript security. Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a ...
12
votes
4answers
623 views

How to securely implement auto-login

I've read many, many, many posts on how "you're probably storing passwords wrong". They are always referring to storing passwords on a server into which a user is logging; they basically rehash (pun ...
2
votes
2answers
426 views

How can I keep a production Python environment secure?

Most of my work is creating websites in Django (a Python web framework) and deploying them to my own or clients' servers. I work from a virtualenv to separate site from system packages and have ...
0
votes
1answer
76 views

How does signing headers and/or body provide security

I'm securing a WCF webservice with TransportWithMessageCredential security that uses certificates. So I'll have to choosee between signing headers & body or signing and encrypting. Now my ...
0
votes
1answer
234 views

Asp.Net MVC Windows authentication - vulnerabilities of http vs https?

I am developing an ASP.Net MVC 3 intranet site that will use Integrated Windows Authentication exclusively. What are the vulnerabilities of the challenge/response authentication traffic being sent in ...
6
votes
3answers
230 views

How will writing the transaction part in Java benefit the security of the application, when all other parts are being written in PHP?

A friend of mine while working on a PHP application asked me to write one part of the application in Java. The part that involved transactions. He said it will be better to write this portion in Java. ...
0
votes
1answer
115 views

Storing escaped mysqli characters in database but outputting them correctly with htmlspecialchars()

I have a database sanitizing function that I use when the user enters some data into my website. I escaping the mysqli characters with mysqli_real_escape_string(), but I wish to also output the ...
2
votes
3answers
490 views

Is there a better way of handling access control logic instead of it being in the UI?

Through most of my dev experience, I've never had to deal with much variety of access control architectures. They've all been pretty straight forward: Group [Create, Update, Delete] - User 1 ...
1
vote
3answers
307 views

Security through obscurity and storing unencrypted passwords

What exactly does "Security through obscurity" means in the context of stroing unencrypted passwords? I'm using a small program (I won't name it, to not enlarge enough large shame on its author) that ...
6
votes
1answer
4k views

What are the best practices to secure a web API?

I need to build a web service API for our mobile app to interact with our server & database (in ASP.Net MVC 4, but that's hardly relevant). Wile most actions do not need users to be registered ...
8
votes
2answers
537 views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
5
votes
4answers
193 views

How can we track how well we're preventing and avoiding security vulnerabilities?

It's pretty easy to track when we fix security vulnerabilities in existing code. But to make sure the whole team is staying on their toes about writing secure code, I'd like to also track how well we ...
0
votes
2answers
391 views

How does Facebook strip html/apostrophes for XSS but also display it?

I'm not quite sure if this is a question for programmers.se rather than stackoverflow, but here goes. So Facebook [or any other large company] when given something like an apostrophe or html, can ...
36
votes
6answers
2k views

Logging failed login attempts exposes passwords

I started logging failed logins attempts on my website with a message like Failed login attempt by qntmfred I've noticed some of these logs look like Failed login attempt by qntmfredmypassword I'm ...
4
votes
3answers
395 views

How to implement better security in Linux?

I'm just investigating the security and control of the Linux platform in comparison to Android. In Android there seems to be a huge development around security - Applications are required to ask for ...
0
votes
1answer
619 views

Security comparison between xmlHttpRequest and HttpRequest

Is there a difference between HttpRequest and xmlHttpRequest in terms of security? Is one more secure than the other? Is it more secure to send important data such as passwords via HttpRequest than ...
0
votes
1answer
171 views

MVP Pattern - Ways to restrict the user action based on security privilleges

In an MVP application, what should be the most appropriate way to implement restriction to some UI actions based on the current user's privileges? For example, in a role-based security, different ...
4
votes
2answers
2k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
3
votes
3answers
2k views

Securely storing secret data in a client-side web application

I have this web application that is going to be all client-side technology (HTML, CSS, JavaScript/AngularJS, etc...). This web application is going to be interacting with REST API in order to access ...
1
vote
1answer
109 views

Creating an account to receive sensitive information on a mobile device

I am developing an Android application for my final year project which allows the holder of a mobile device to receive a text notification containing potentially sensitive information from a server. ...
7
votes
4answers
2k views

Best practices for execution of untrusted code

I have a project where I need to allow users to run arbitrary, untrusted python code (a bit like this) against my server. I'm fairly new to python and I'd like to avoid making any mistakes that ...
0
votes
1answer
1k views

Why are Wordpress sites so easily hacked? [closed]

I have found that hacker can easily hack wordpress site. I have found this posts related to wordpress site hacking. 1) http://wordpress.org/support/topic/website-hacked-3 2) ...
3
votes
3answers
106 views

Is a predefined key enough security when performing HTTP requests between two secure servers?

I have an AdWords script that regularly transfers sensitive data to my server using a POST HTTP request. For security I have a predefined 32 character randomized string that is verified by my server ...
3
votes
1answer
361 views

Using a public username as a login username

It has just dawned on me, that a system I am developing exposes a users username in the URI. This is a problem, since some of the users pages are public. Therefore people will know their username. I ...
70
votes
7answers
10k views

How can robots beat CAPTCHAs?

I have a website e-mail form. I use a custom CAPTCHA to prevent spam from robots. Despite this, I still get spam. Why? How do robots beat the CAPTCHA? Do they use some kind of advanced OCR or just ...
106
votes
7answers
8k views

You're hired to fix a small bug for a security-intensive site. Looking at the code, it's filled with security holes. What do you do?

I've been hired by someone to do some small work on a site. It's a site for a large company. It contains very sensitive data, so security is very important. Upon analyzing the code, I've noticed it's ...
1
vote
4answers
287 views

Why do web sites require certain characters in their credentials? [closed]

It seems like when web site lists requirements as to what characters MUST be in the password they're only providing a password map for someone who wants to hack their system. For instance, fsd.gov ...
-5
votes
3answers
461 views

Is sending password to user email secure? [closed]

How secure is sending passwords through email to a user, since email isn't secured by HTTPS. What is the best way to secure it? Should I use encryption?
3
votes
2answers
942 views

I need advice developing a sensitive data transfer/storage/encryption system

I got closed on SO and told to post this here as it's about general application design as opposed to specific code. Intro I'm currently working on a project which involves the daily extraction of ...
1
vote
0answers
550 views

Connecting with OAuth, dealing with logout and browser sessions

I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services. Primarily we ...
0
votes
1answer
156 views

Ria service security

I have a silverlight app that connects to a entity framework over WCF ria service. These calls have to be secure. What can I do so only valid users can call the ria service, and to make the call ...