For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

4
votes
1answer
399 views

Is a PHP file secure enough on a GoDaddy Server to hard code an AES salt into the file?

So I am creating a web api for an app I am making. The data is sanitized before it is sent to my web api and then encrypted before it is stored in my MySql server. The phone app sanitizes then ...
2
votes
4answers
274 views

Preventing password hashing algorithm from overloading CPU

These days password hashing algorithms are designed to be slow. While it prevents black hats from guessing the password (at least partially), it also gives additional work for the server. I can ...
1
vote
1answer
62 views

Information protection when registering on web sites

Up until now it seems that when you register on a random web site you do so with blind trust. You assume that the site isn't harvesting information and passwords. You assume the site is reasonably ...
1
vote
1answer
84 views

Is there any reason not to include issue numbers in debug logs?

I was going through the answers to this question: What information must never appear in logs? And noticed that nobody mentioned this particular attribute. It's something I find useful- whenever any ...
28
votes
1answer
914 views

If the spec is flawed, should it still be followed?

I have been assigned to develop an integration to one of my employer's applications to an external system developed by our client. Our client's specification for the integration that has some blatant ...
2
votes
1answer
757 views

Any ASN.1 parsers written completely in managed code & safe from buffer overflows

ASN.1 is a data format used on HTTPS certificates, and various other critical pieces of infrastructure. I need to analyze some potentially hostile ASN.1 data, and want to ensure my code is safe from ...
5
votes
1answer
1k views

API Authentication, One time token VS Dynamic tokens

We are working on a new project, we are two lead developers and got on a cross road on how to use a token to secure the communication between the server and the client : First Suggestion : (The one ...
1
vote
2answers
286 views

How your team manage shared password/key [duplicate]

It maybe a shared SSH private key, it maybe be a online password to some web site. In term of security & convenient, and support fine grained permission settings, e.g. developers role, testers ...
1
vote
1answer
224 views

User Authentication & Session Management

One of the fundamental ways of handling user login authentication & session management is by storing variables in Session space plus setting some data in cookies on client computer while sometimes ...
1
vote
5answers
1k views

Building a web app with encrypted MySQL database entries?

I have some experience in building PHP based websites with MySQL access, storing encrypted user details, but all other fields being plain text. My most recent project will require sensitive data to be ...
4
votes
2answers
415 views

Where to Perform Authentication in REST API Server?

I am working on a set of REST APIs that needs to be secured so that only authenticated calls will be performed. There will be multiple web apps to service these APIs. Is there a best-practice approach ...
1
vote
3answers
387 views

Avoid malicious code while dynamically loading classes with ClassLoader

Background One of the advantages of decoupled components in systems is that you can extend the system without having to touch the existing code. Sometimes you don't even have to recompile the old ...
1
vote
3answers
227 views

What is the best way to store configurations of shell/script code to execute later?

I am working on a tool (Python, may or may not be important) that will allow a user to maintain a configuration file containing arbitrary shell and/or language code to be executed on particular events ...
0
votes
3answers
158 views

How can I secure a request handler so I only respond to the correct clients?

Here's the scenario... I have a web site that has a generic handler written in asp.net (.ashx file) that accepts http requests, gets relevant data, converts the result into xml and then passes that ...
1
vote
3answers
163 views

Protect Images in a Webpage

I want to build a website that will contain a lot of images. I don't want users who visit the website to be able to save the images. I have blocked the right click option, but is there any other ...
0
votes
2answers
76 views

How ensure secure two cloud services can only talk to each other?

Question Given two cloud services, Sender A & Receiver B, communicating over HTTPS, what options do I have to ensure that Receiver B only response to Sender A? For the purposes of Background ...
4
votes
1answer
152 views

Is there an industry standard for systems registered user permissions in terms of database model?

I developed many applications with registered user access for my enterprise clients. In many years I have changed my way of doing it, specially because I used many programming languages and database ...
4
votes
2answers
209 views

Secure an Application/Software by expiration with Date?

I have been working on some software application and I update them every 6 months. Currently, the way I track the date is by extracting the date from the system when the user installs the application, ...
2
votes
1answer
344 views

Security Risks of Unsigned ClickOnce Manifests

Using signed manifests in ClickOnce deployments, it is not possible to modify files after the deployment package has been published - installation will fail as hash information in the manifest won't ...
5
votes
3answers
355 views

How to store / not to store passwords

I am building an web site which will allow users to aggregate the information stored in their online profiles ("data feeds") in one place. I am wondering - what is the accepted (from a secureness ...
6
votes
4answers
396 views

Public-key cryptography security given NSA resources

I was wondering how secure public private key encryption methods are. If two individuals were sending emails back and forth forever, where each person would encrypt the body of the email they were ...
1
vote
1answer
283 views

Is there a setting to enable anti forgery globally in ASP.NET MVC, and if not, why?

The tutorials I've read tell you to use [ValidateAntiForgeryToken] attributes and <%= Html.AntiForgeryToken() %> in your code. I was wondering why this isn't a built-in automatic setting or at ...
0
votes
0answers
23 views

Login to a Web App using PKI Certs [duplicate]

I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
6
votes
1answer
538 views

Implementing Digitally signed data in a Web Application

I understand PKI well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of Transactions or ...
31
votes
5answers
6k views

How easy is it to hack JavaScript (in a browser)?

My question has to do with JavaScript security. Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a ...
12
votes
4answers
648 views

How to securely implement auto-login

I've read many, many, many posts on how "you're probably storing passwords wrong". They are always referring to storing passwords on a server into which a user is logging; they basically rehash (pun ...
2
votes
2answers
427 views

How can I keep a production Python environment secure?

Most of my work is creating websites in Django (a Python web framework) and deploying them to my own or clients' servers. I work from a virtualenv to separate site from system packages and have ...
0
votes
1answer
77 views

How does signing headers and/or body provide security

I'm securing a WCF webservice with TransportWithMessageCredential security that uses certificates. So I'll have to choosee between signing headers & body or signing and encrypting. Now my ...
0
votes
1answer
240 views

Asp.Net MVC Windows authentication - vulnerabilities of http vs https?

I am developing an ASP.Net MVC 3 intranet site that will use Integrated Windows Authentication exclusively. What are the vulnerabilities of the challenge/response authentication traffic being sent in ...
6
votes
3answers
232 views

How will writing the transaction part in Java benefit the security of the application, when all other parts are being written in PHP?

A friend of mine while working on a PHP application asked me to write one part of the application in Java. The part that involved transactions. He said it will be better to write this portion in Java. ...
0
votes
1answer
123 views

Storing escaped mysqli characters in database but outputting them correctly with htmlspecialchars()

I have a database sanitizing function that I use when the user enters some data into my website. I escaping the mysqli characters with mysqli_real_escape_string(), but I wish to also output the ...
2
votes
3answers
513 views

Is there a better way of handling access control logic instead of it being in the UI?

Through most of my dev experience, I've never had to deal with much variety of access control architectures. They've all been pretty straight forward: Group [Create, Update, Delete] - User 1 ...
1
vote
3answers
312 views

Security through obscurity and storing unencrypted passwords

What exactly does "Security through obscurity" means in the context of stroing unencrypted passwords? I'm using a small program (I won't name it, to not enlarge enough large shame on its author) that ...
6
votes
1answer
4k views

What are the best practices to secure a web API?

I need to build a web service API for our mobile app to interact with our server & database (in ASP.Net MVC 4, but that's hardly relevant). Wile most actions do not need users to be registered ...
8
votes
2answers
538 views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
5
votes
4answers
193 views

How can we track how well we're preventing and avoiding security vulnerabilities?

It's pretty easy to track when we fix security vulnerabilities in existing code. But to make sure the whole team is staying on their toes about writing secure code, I'd like to also track how well we ...
0
votes
2answers
395 views

How does Facebook strip html/apostrophes for XSS but also display it?

I'm not quite sure if this is a question for programmers.se rather than stackoverflow, but here goes. So Facebook [or any other large company] when given something like an apostrophe or html, can ...
36
votes
6answers
2k views

Logging failed login attempts exposes passwords

I started logging failed logins attempts on my website with a message like Failed login attempt by qntmfred I've noticed some of these logs look like Failed login attempt by qntmfredmypassword I'm ...
4
votes
3answers
395 views

How to implement better security in Linux?

I'm just investigating the security and control of the Linux platform in comparison to Android. In Android there seems to be a huge development around security - Applications are required to ask for ...
0
votes
1answer
645 views

Security comparison between xmlHttpRequest and HttpRequest

Is there a difference between HttpRequest and xmlHttpRequest in terms of security? Is one more secure than the other? Is it more secure to send important data such as passwords via HttpRequest than ...
0
votes
1answer
174 views

MVP Pattern - Ways to restrict the user action based on security privilleges

In an MVP application, what should be the most appropriate way to implement restriction to some UI actions based on the current user's privileges? For example, in a role-based security, different ...
4
votes
2answers
2k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
3
votes
3answers
2k views

Securely storing secret data in a client-side web application

I have this web application that is going to be all client-side technology (HTML, CSS, JavaScript/AngularJS, etc...). This web application is going to be interacting with REST API in order to access ...
1
vote
1answer
109 views

Creating an account to receive sensitive information on a mobile device

I am developing an Android application for my final year project which allows the holder of a mobile device to receive a text notification containing potentially sensitive information from a server. ...
7
votes
4answers
2k views

Best practices for execution of untrusted code

I have a project where I need to allow users to run arbitrary, untrusted python code (a bit like this) against my server. I'm fairly new to python and I'd like to avoid making any mistakes that ...
0
votes
1answer
1k views

Why are Wordpress sites so easily hacked? [closed]

I have found that hacker can easily hack wordpress site. I have found this posts related to wordpress site hacking. 1) http://wordpress.org/support/topic/website-hacked-3 2) ...
3
votes
3answers
106 views

Is a predefined key enough security when performing HTTP requests between two secure servers?

I have an AdWords script that regularly transfers sensitive data to my server using a POST HTTP request. For security I have a predefined 32 character randomized string that is verified by my server ...
3
votes
1answer
371 views

Using a public username as a login username

It has just dawned on me, that a system I am developing exposes a users username in the URI. This is a problem, since some of the users pages are public. Therefore people will know their username. I ...
70
votes
7answers
11k views

How can robots beat CAPTCHAs?

I have a website e-mail form. I use a custom CAPTCHA to prevent spam from robots. Despite this, I still get spam. Why? How do robots beat the CAPTCHA? Do they use some kind of advanced OCR or just ...
106
votes
7answers
8k views

You're hired to fix a small bug for a security-intensive site. Looking at the code, it's filled with security holes. What do you do?

I've been hired by someone to do some small work on a site. It's a site for a large company. It contains very sensitive data, so security is very important. Upon analyzing the code, I've noticed it's ...