For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

7
votes
1answer
102 views

How does one request / handle personal or financial information?

I would like to create a budget app for Android. Obviously, to be competitive, I would need to allow users to get data from their bank. For [huge] security reasons, this stuff is not just freely given ...
7
votes
1answer
209 views

Securely sending data from shared hosted PHP script to local MSSQL

I'm trying to add data from a webhook (from a web cart) to a local Microsoft SQL Server. It seems like the best route for me is to use a PHP script to listen for new data (POST as json), parse it, ...
6
votes
6answers
803 views

What are the cases where keeping source code secret is justified?

When I worked as a freelancer, I encountered lots of cases where customers were protecting their ideas and source code of their projects (such as web applications) as much as possible, no matter how ...
6
votes
5answers
2k views

What is the rationale behind entering email twice for registration? [duplicate]

Many web sites ask users to enter their email address twice, sometimes taking the trouble to disable copy-pasting. What is the logic behind this? Is this e.g. a security measure?
6
votes
3answers
431 views

Converting a 1,000,000 rows database

If I have a database that stores the login credentials of 1,000,000 users in PLAINTEXT, how much effort will it take me to md5 hash these passwords?
6
votes
4answers
462 views

Public-key cryptography security given NSA resources

I was wondering how secure public private key encryption methods are. If two individuals were sending emails back and forth forever, where each person would encrypt the body of the email they were ...
6
votes
3answers
333 views

What is the best policy for allowing clients to change email?

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
6
votes
4answers
4k views

Storing sort code / account number on website. Security?

People in the UK will probably better understand what a sort code is and how sort code & account numbers are used for transfers etc, but the question is relevant to anyone I'm sure. Just to ...
6
votes
2answers
3k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
6
votes
2answers
378 views

Would I be able to use code hosting services to host malware code?

Let me start by saying that I am a computer security researcher. Part of my job is to create malware to deploy on a controlled environment in order to study or evaluate several aspects of computer ...
6
votes
1answer
4k views

Permissions/right model/pattern for .NET application

I need to implement flexible AND simple (if such thing exist) and at the same time utilize built-on means if possible So far I have MembershipProvider and RoleProviders implemented. This is cool but ...
6
votes
3answers
458 views

Are two database trips reasonable for a login system?

I am designing a login system for a project, and have an issue about it requiring two trips to the database when a user logs in. User types in username and password Database is polled and password ...
6
votes
1answer
844 views

Implementing Digitally signed data in a Web Application

I understand PKI well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of Transactions or ...
6
votes
0answers
86 views

What To Do If I've Found a Vulnerability In a Possible Future Employers Site? [duplicate]

I've been self employed for a long time now and have recently decided that PHP development within a company is the route I'd like to go down. I had an initial interview/meeting yesterday with a ...
6
votes
3answers
279 views

How will writing the transaction part in Java benefit the security of the application, when all other parts are being written in PHP?

A friend of mine while working on a PHP application asked me to write one part of the application in Java. The part that involved transactions. He said it will be better to write this portion in Java. ...
5
votes
6answers
2k views

How can I prevent users from creating multiple accounts on a web site?

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
5
votes
5answers
2k views

Security issue about making my code public in GitHub

I'm developing a big community/forum website and I'd like to upload my code to GitHub to have at least some sort of version control over it (because I have nothing other than a .rar file as a backup, ...
5
votes
4answers
2k views

What type of Password Reset/Forgot Password (verification) mechanism would you recommend

I am looking for ways to verify the user in order to reset their passwords. 2 commonly used ones: Email verification Secret question I wonder which will you recommend? I am trying to avoid having ...
5
votes
6answers
371 views

What would you define as sensitive user data?

A recent previous question of mine had an answer that sparked a different and unrelated question in my mind: Customer wants to modify the .properties files packaged in our WAR file The question that ...
5
votes
4answers
230 views

Are there languages that make it easier to understand secure coding principles?

I'm interested in expanding my knowledge of security issues: things like buffer overflows, format string vulnerabilities, etc. I'd like to be able to go through a language and understand its security ...
5
votes
4answers
484 views

Steps after SQL Injection detected

I've come across SQL injection vulnerabilities on my companies ecommerce page. It was fairly poorly put together. I believe I have prevented future attempts however we are getting calls about ...
5
votes
3answers
384 views

How to store / not to store passwords

I am building an web site which will allow users to aggregate the information stored in their online profiles ("data feeds") in one place. I am wondering - what is the accepted (from a secureness ...
5
votes
5answers
4k views

Allow Administrator users to login as other users

Do you think it's a good practice to implement a possibilty to allow an administrator user to login in as another user, by-passing password? This could by implemented by a master password or a ...
5
votes
2answers
281 views

Why applications don't have constraint-based security?

In almost any security system I've ever seen, what is controlled is that which person has access to which part. However, in real life, in many situations, security systems also consider when and ...
5
votes
3answers
2k views

What are the security risks/vulnerabilities every C programmer must be aware of?

There are many security risks coming from having close contact to the hardware as opposed to using well-tested and proved APIs from high level programming languages. It is much easier to cause a ...
5
votes
3answers
711 views

Learning about security and finding exploits [closed]

First things first: I have absolutely no interest in learning how to crack systems for personal enrichment, hurting other people or doing anything remotely malicious. I understand the basis of many ...
5
votes
3answers
605 views

Are buffer overflows no longer a threat these days?

After following buffer overflow examples and reading on them in various books/websites it seems there are lots of preventative measures in place to protect against them these days. ASLR, /GS flag ...
5
votes
3answers
290 views

Possible hack aftermath [closed]

After being hacked companies often give numbers and details on how much of their data was compromised e.g "13K user and passwords". After a possible intrusion how do you know what the hacker did in ...
5
votes
9answers
485 views

In what situations would it be technically 'impossible' to release a system as open source?

While there are certainly many economic, social and practical decisions to be made when deciding whether a system should be open source, are there any situations in which it is impossible, purely from ...
5
votes
4answers
202 views

How can we track how well we're preventing and avoiding security vulnerabilities?

It's pretty easy to track when we fix security vulnerabilities in existing code. But to make sure the whole team is staying on their toes about writing secure code, I'd like to also track how well we ...
5
votes
5answers
934 views

Is it safe to display information about old passwords on login failure?

When I changed my Facebook password yesterday, by mistake I entered the old one and got this: Am I missing something here or this is a big potencial risk for users. In my opinion this is a problem ...
5
votes
1answer
121 views

Hardware key removal on a test system

One of my company's applications still requires a hardware key to run, but we're currently in the process of removing that requirement and replacing it with an online check. The issue we are having ...
5
votes
1answer
2k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...
5
votes
4answers
176 views

How do I report software vulnerabilities found in an open source library that are widely used but have a dilapidated team structure?

For most open source project, there is a well-founded project team and corporate sponsorship, and a lot of active contributors. The procedure for filing bug reports are clearly documented. However, ...
5
votes
2answers
223 views

Do you apply a code of conduct on accepting jobs, projects or requirements?

When writing software for yourself, your company or third parties, do you always consider certain principles, values, standards, or rules of behavior that guide the decisions, procedures and systems ...
5
votes
1answer
3k views

API Authentication, One time token VS Dynamic tokens

We are working on a new project, we are two lead developers and got on a cross road on how to use a token to secure the communication between the server and the client : First Suggestion : (The one ...
5
votes
4answers
2k views

Development of a bot/web crawler detection system

I am trying to build a system for my company which wants to check for unusual/abusive pattern of users (mainly web scrapers). Currently the logic I have implemented parses the http access logs and ...
5
votes
3answers
1k views

Is blocking java applets a necessary security measure?

Chrome 11 is now asking user permission to run both signed and unsigned Applets (yes, for signed applets the user is asked twice). Chromium team decided that this measure is needed even when the user ...
5
votes
3answers
180 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
5
votes
2answers
670 views

Should I be using a JavaScript SPA designed when security is important

I asked something kind of similar on stackoverflow with a particular piece of code however I want to try to ask this in a broader sense. So I have this web application that I have started to write in ...
5
votes
2answers
404 views

Web application development security best practices [closed]

I am looking for the current, state of the art, coding standards for web development (mostly PHP). Since I do not want to reinvent the wheel I would like to reuse libraries written by people much ...
5
votes
1answer
157 views

Development-led security vs administration-led security in a software product?

There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level ...
5
votes
1answer
1k views

Means for (legit) cross-site scripting

Are there good means for allowing scripts from two or more domains to collaborate in the same browser page? I want to create an extensible platform, where I provide the model and some views, but also ...
5
votes
3answers
169 views

VPN or TLSv1 for securing a programs protocol from field device to mainframe

I am working on a product that requires devices to exists anywhere in the world hooked up to the internet though cell modems or on WLAN lines which communicates to a server(s) that exists elsewhere in ...
5
votes
1answer
2k views

How do you protect your WCF service?

sometimes a programmer comes up with a brilliant idea to protect his/her webservice created with Windows Communication Foundation. I would like to hear from you guys, which techniques do you use to ...
5
votes
1answer
86 views

Safest way to use and store User's third party credentials

I'm working on an add-in that will integrate git into the VBA IDE. I'm using the LibGit2Sharp library under the hood, which supports User name and password credentials, but not SSH Keys. I would use ...
4
votes
4answers
312 views

Develop secureness first or as a later step?

The question Do you actively think about security when coding? asks about security mindset while programming. Obviously, a developer does need to think about security while coding — SQL ...
4
votes
4answers
3k views

Storing credit card information: Looking for a creative solution

I recently found the need to do recurrent billing. I am extremely averse to storing people's credit card information and I refuse to take risks in that area. I am stuck between a rock and a hard ...
4
votes
3answers
190 views

Name for sanitizing at the right time?

Recently we had an issue on our site where someone attempted SQL injection via a cookie (we'll call it lastID). NOC was in a frenzy and angry about how the cookie as an attack vector could be ...
4
votes
3answers
415 views

How to implement better security in Linux?

I'm just investigating the security and control of the Linux platform in comparison to Android. In Android there seems to be a huge development around security - Applications are required to ask for ...