For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

6
votes
6answers
2k views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
3
votes
2answers
289 views

Would using rainbow tables to detect weak user passwords feasible?

As I understand in most security breach where the list of hashed password are compromised, attackers do use brute-force to try to find weak password and, invariably, they always find quite some (like ...
24
votes
9answers
2k views

Why not expose a primary key

In my education I have been told that it is a flawed idea to expose actual primary keys (not only DB keys, but all primary accessors) to the user. I always thought it to be a security problem ...
1
vote
2answers
206 views

How do I dissuade users from using the same password with similar systems?

I'm building a web application that connects to other web services (using strictly anonymous binding, so no user passwords are being used). However the web application maintains its own users itself, ...
2
votes
1answer
394 views

Does facebook store multiple password hashes for each user? [closed]

I noticed that Facebook allows multiple variants of my own password : My password as it is. My password with first letter capitalized. My password with all letters capitalized. It is commonly ...
28
votes
5answers
1k views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
1
vote
2answers
91 views

Recommended secure approach to confirming an URL is called by a legitimate caller

I'm using a CRON on AppEngine and the cron calls my web app at a specific app. I only want to execute functionality when called by my AppEngine app. What's is/are recommended approach to confirming ...
0
votes
1answer
271 views

Making Agile and DevOps methodology compatible with PCI requirements [closed]

Would like to hear from those working in a PCI compliance environment and is practicing agile development and devops methodology, how you maintain compliance with PCI requirements. Specifically, what ...
2
votes
1answer
300 views

Approach to Authenticate Clients to TCP Server

I'm writing a Server/Client application where clients will connect to the server. What I want to do, is make sure that the client connecting to the server is actually using my protocol and I can ...
9
votes
5answers
2k views

How do web servers enforce the same-origin policy?

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
2
votes
2answers
173 views

Principles of an extensible data proxy

There is a growing industry now with more than 30 companies playing in the Backend-As-A-Service (BaaS) market. The principle is simple: give companies a secure way of exposing data housed on premises ...
1
vote
1answer
146 views

Creating deterministic key pairs in javascript for use in encrypting/decrypting/signing messages

So I have been searching everywhere and havn't been able to find anything with the sufficient information I need.. so Im a bit stumped on this one at the moment What I am trying to do is create a ...
1
vote
1answer
136 views

What am I risking if I don't update my SDK/JDK and bundled runtime/JRE every time there's a security update?

It seems like there's a new major security hole patched in Java every other week, and I would assume the same goes for other development platforms. After years of frustration trying to get customers ...
3
votes
1answer
138 views

Some hint to program a webservice “by subscription”

I have some web sites programmed, I know to do it with python and PHP basically. Normally they are simple web sites, but now I want to provide REST web services but only for allowed users (allowed by ...
3
votes
1answer
416 views

Using Dynamic LINQ to get a filter for my Web API

We are considering using the Dynamic.CS linq-sample included in the "Samples" directory of visual studio 2008 for our WebAPI project to allow clients to query our data. The interface would be ...
2
votes
1answer
179 views

How to check for vulnerabilities in web application [closed]

I have developed a web application using zend framework, mysql, and other client side technologies like javascript, jquery ajax, kendo grid, and so on. I have completed development and have done ...
6
votes
0answers
84 views

What To Do If I've Found a Vulnerability In a Possible Future Employers Site? [duplicate]

I've been self employed for a long time now and have recently decided that PHP development within a company is the route I'd like to go down. I had an initial interview/meeting yesterday with a ...
-1
votes
2answers
161 views

How to manage your personal ssh keys? [closed]

I understand that ssh keys are a cryptographically secured way of authenticating yourself to a service or to another person, but beyond that I'm frankly at a bit of a loss. What confuses me is that I ...
1
vote
0answers
136 views

How to securely store user credentials from external website

I'm developing an application where I'd like to use credentials from external websites. This will be used to login with the website API and get information for the user. Example: I want to use the ...
3
votes
2answers
861 views

Best practice in application design / SQL authentication

I am currently involved in the implementation/design of an existing application for a large scale customer. The application has a similar model as e.g. vCenter Server whereby a number of components ...
1
vote
2answers
121 views

How can I limit access for automatically generated files to specific users in a MVC setup?

I have a typical MVC based website, and I'd like to give some registered users the abillity to extract data from the database (in a variety of formats). The workflow is very simple: User logs in, ...
2
votes
1answer
355 views

How to audit an Android application (not rooted) without having access to its source?

How can I check if an Android application running on a not rooted device is "secure" without knowing its source? I would look for: Plain text in Web-Requests (wireshark and emulator) SQL-injection ...
0
votes
0answers
1k views

How secure is this way of authenticating an ASP .NET Web API - creating your own tokens?

http://www.codeproject.com/Articles/630986/Cross-Platform-Authentication-With-ASP-NET-Web-API#_rating The above link shows exactly how I want to go about authenticating against an ASP .NET Web API. ...
6
votes
6answers
678 views

What are the cases where keeping source code secret is justified?

When I worked as a freelancer, I encountered lots of cases where customers were protecting their ideas and source code of their projects (such as web applications) as much as possible, no matter how ...
2
votes
1answer
301 views

Checking for cross-site scripting vulnerabilities in Perl web applications

I'm putting together some notes for a dev team on how to write secure Perl code - especially taking into account the current OWASP top 10 web application vulnerabilities. For cross-site scripting I've ...
1
vote
0answers
84 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
3
votes
1answer
228 views

What is the identification procedure that registers a mobile device on a subscriber account and installs purchased content?

We know there are several moving parts to a system like the apple store or google play. At the very least; The device has a unique hardware id or sim card The user has a login/pass The "store" site ...
2
votes
3answers
454 views

Shared hosting for a PHP application

I was reading Essential PHP Security and chapter 8 talks about problems with hosting your PHP app in a shared hosting environment. Some of the problems he mentions are: - Exposed source code and ...
14
votes
6answers
945 views

How to assure users that website and passwords are secure

On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All ...
0
votes
3answers
263 views

VB stand alone application or ASP web application

I have experience developing software and web applications and I have decided to do some freelance work on the side. Well, I met with my first client and they are requesting a relatively simple, ...
0
votes
1answer
104 views

Possible holes in a spam-registration prevention approach?

I was thinking of creating some login code (probably to work with BrowserID so users don't need to store their passwords with my site while also ensuring the supplied email account belongs to them) ...
2
votes
1answer
155 views

How much should we spend on improving software security?

Is there a "scientific" method to determine how much resources/money should be spent on improving the security of a piece of software? I work in a team where our work is prioritized by a product ...
3
votes
1answer
305 views

Are there security implications to using dynamically-assigned TCP port numbers?

I'm getting pushback from operations for having a server process listen on a dynamically-assigned port number (i.e. it binds a socket to a port number of 0, triggering a dynamic assignment by the OS, ...
4
votes
1answer
443 views

Is a PHP file secure enough on a GoDaddy Server to hard code an AES salt into the file?

So I am creating a web api for an app I am making. The data is sanitized before it is sent to my web api and then encrypted before it is stored in my MySql server. The phone app sanitizes then ...
2
votes
4answers
277 views

Preventing password hashing algorithm from overloading CPU

These days password hashing algorithms are designed to be slow. While it prevents black hats from guessing the password (at least partially), it also gives additional work for the server. I can ...
1
vote
1answer
62 views

Information protection when registering on web sites

Up until now it seems that when you register on a random web site you do so with blind trust. You assume that the site isn't harvesting information and passwords. You assume the site is reasonably ...
1
vote
1answer
85 views

Is there any reason not to include issue numbers in debug logs?

I was going through the answers to this question: What information must never appear in logs? And noticed that nobody mentioned this particular attribute. It's something I find useful- whenever any ...
28
votes
1answer
925 views

If the spec is flawed, should it still be followed?

I have been assigned to develop an integration to one of my employer's applications to an external system developed by our client. Our client's specification for the integration that has some blatant ...
3
votes
1answer
1k views

Any ASN.1 parsers written completely in managed code & safe from buffer overflows

ASN.1 is a data format used on HTTPS certificates, and various other critical pieces of infrastructure. I need to analyze some potentially hostile ASN.1 data, and want to ensure my code is safe from ...
5
votes
1answer
2k views

API Authentication, One time token VS Dynamic tokens

We are working on a new project, we are two lead developers and got on a cross road on how to use a token to secure the communication between the server and the client : First Suggestion : (The one ...
0
votes
2answers
376 views

How your team manage shared password/key [duplicate]

It maybe a shared SSH private key, it maybe be a online password to some web site. In term of security & convenient, and support fine grained permission settings, e.g. developers role, testers ...
1
vote
1answer
297 views

User Authentication & Session Management

One of the fundamental ways of handling user login authentication & session management is by storing variables in Session space plus setting some data in cookies on client computer while sometimes ...
1
vote
5answers
2k views

Building a web app with encrypted MySQL database entries?

I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be ...
4
votes
2answers
537 views

Where to Perform Authentication in REST API Server?

I am working on a set of REST APIs that needs to be secured so that only authenticated calls will be performed. There will be multiple web apps to service these APIs. Is there a best-practice approach ...
1
vote
3answers
531 views

Avoid malicious code while dynamically loading classes with ClassLoader

Background One of the advantages of decoupled components in systems is that you can extend the system without having to touch the existing code. Sometimes you don't even have to recompile the old ...
1
vote
3answers
265 views

What is the best way to store configurations of shell/script code to execute later?

I am working on a tool (Python, may or may not be important) that will allow a user to maintain a configuration file containing arbitrary shell and/or language code to be executed on particular events ...
0
votes
3answers
212 views

How can I secure a request handler so I only respond to the correct clients?

Here's the scenario... I have a web site that has a generic handler written in asp.net (.ashx file) that accepts http requests, gets relevant data, converts the result into xml and then passes that ...
1
vote
3answers
167 views

Protect Images in a Webpage

I want to build a website that will contain a lot of images. I don't want users who visit the website to be able to save the images. I have blocked the right click option, but is there any other ...
0
votes
2answers
76 views

How ensure secure two cloud services can only talk to each other?

Question Given two cloud services, Sender A & Receiver B, communicating over HTTPS, what options do I have to ensure that Receiver B only response to Sender A? For the purposes of Background ...
4
votes
1answer
168 views

Is there an industry standard for systems registered user permissions in terms of database model?

I developed many applications with registered user access for my enterprise clients. In many years I have changed my way of doing it, specially because I used many programming languages and database ...