For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

8
votes
3answers
763 views

Is it a security flaw to log the class and method name when an exception occurs?

I have the following : public class doCheck(){ public void performCheck(){ try { perform all checks...... } catch(Exception e){ ...
8
votes
3answers
1k views

What is the best way to learn how to develop secure applications?

I would like to get into computer security in my career. What are the best ways to learn how to program securely? It seems to me that, besides textbooks and taking classes in the subject, perhaps ...
8
votes
1answer
6k views

API Authentication, One time token VS Dynamic tokens

We are working on a new project, we are two lead developers and got on a crossroad on how to use a token to secure the communication between the server and the client. First Suggestion: (The one time ...
8
votes
2answers
293 views

Data encryption/protection - where to find info about high-level best practices [closed]

I feel that no one in the group I work in, myself included, really groks encryption and security, or the reasons behind making certain decisions. For example, we recently had a conversation regarding ...
8
votes
1answer
5k views

Permissions/right model/pattern for .NET application

I need to implement flexible AND simple (if such thing exist) and at the same time utilize built-on means if possible So far I have MembershipProvider and RoleProviders implemented. This is cool but ...
8
votes
2answers
766 views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
8
votes
1answer
247 views

Securely sending data from shared hosted PHP script to local MSSQL

I'm trying to add data from a webhook (from a web cart) to a local Microsoft SQL Server. It seems like the best route for me is to use a PHP script to listen for new data (POST as json), parse it, ...
7
votes
6answers
1k views

What are the cases where keeping source code secret is justified?

When I worked as a freelancer, I encountered lots of cases where customers were protecting their ideas and source code of their projects (such as web applications) as much as possible, no matter how ...
7
votes
3answers
437 views

Converting a 1,000,000 rows database

If I have a database that stores the login credentials of 1,000,000 users in PLAINTEXT, how much effort will it take me to md5 hash these passwords?
7
votes
10answers
593 views

In what situations would it be technically 'impossible' to release a system as open source?

While there are certainly many economic, social and practical decisions to be made when deciding whether a system should be open source, are there any situations in which it is impossible, purely from ...
7
votes
2answers
5k views

Where can I safely learn about computer security? [closed]

I find it really hard to find resources about computer security. I asked questions on message boards about key loggers and viruses and I got negative assumption from people assuming the the worse. ...
7
votes
3answers
298 views

How to explain to my customer that the hosting provider is terrible, security-wise?

As a freelance developer, I sometimes have to access the administration panels of hosting providers of my customers. It is an astonishingly frightening experience. Below are some points I noticed when ...
7
votes
7answers
1k views

How to make security usable in a web application?

I'm in the planning stages of developing a web application that I want to make as secure as possible. I'm pretty clear about how to do that from a technical point of view, but there is one massive ...
7
votes
2answers
4k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...
7
votes
3answers
1k views

How to separate sensitive data in database(MySql)

I need to design a database that will contains information about personal disease of users. What can be the approach in order to implement the columns of the DB's tables: encrypt the information, ...
7
votes
1answer
106 views

How does one request / handle personal or financial information?

I would like to create a budget app for Android. Obviously, to be competitive, I would need to allow users to get data from their bank. For [huge] security reasons, this stuff is not just freely given ...
7
votes
1answer
797 views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...
7
votes
3answers
352 views

How will writing the transaction part in Java benefit the security of the application, when all other parts are being written in PHP?

A friend of mine while working on a PHP application asked me to write one part of the application in Java. The part that involved transactions. He said it will be better to write this portion in Java. ...
6
votes
8answers
1k views

Are you obliged to provide old employers with access to protected resources? [closed]

Firstly, a disclaimer. This question is not because I'm a disgruntled employee planning to hide some malicious code which I can later blackmail my employer with. I actually quite like the people I ...
6
votes
5answers
3k views

Security issue about making my code public in GitHub

I'm developing a big community/forum website and I'd like to upload my code to GitHub to have at least some sort of version control over it (because I have nothing other than a .rar file as a backup, ...
6
votes
5answers
3k views

What is the rationale behind entering email twice for registration? [duplicate]

Many web sites ask users to enter their email address twice, sometimes taking the trouble to disable copy-pasting. What is the logic behind this? Is this e.g. a security measure?
6
votes
4answers
3k views

What type of Password Reset/Forgot Password (verification) mechanism would you recommend

I am looking for ways to verify the user in order to reset their passwords. 2 commonly used ones: Email verification Secret question I wonder which will you recommend? I am trying to avoid having ...
6
votes
4answers
528 views

Public-key cryptography security given NSA resources

I was wondering how secure public private key encryption methods are. If two individuals were sending emails back and forth forever, where each person would encrypt the body of the email they were ...
6
votes
3answers
363 views

What is the best policy for allowing clients to change email?

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
6
votes
4answers
4k views

Storing sort code / account number on website. Security?

People in the UK will probably better understand what a sort code is and how sort code & account numbers are used for transfers etc, but the question is relevant to anyone I'm sure. Just to ...
6
votes
2answers
230 views

Do you apply a code of conduct on accepting jobs, projects or requirements?

When writing software for yourself, your company or third parties, do you always consider certain principles, values, standards, or rules of behavior that guide the decisions, procedures and systems ...
6
votes
2answers
4k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
6
votes
2answers
384 views

Would I be able to use code hosting services to host malware code?

Let me start by saying that I am a computer security researcher. Part of my job is to create malware to deploy on a controlled environment in order to study or evaluate several aspects of computer ...
6
votes
1answer
2k views

How do you protect your WCF service?

sometimes a programmer comes up with a brilliant idea to protect his/her webservice created with Windows Communication Foundation. I would like to hear from you guys, which techniques do you use to ...
6
votes
1answer
161 views

Development-led security vs administration-led security in a software product?

There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level ...
6
votes
2answers
63 views

prevent abuse to rest api endpoint

Question 1 I have a login api endpoint http://127.0.0.1:8080/api/account/login it checks if phone number has been validated. If not it'll call POST http://127.0.0.1:8080/api/account/sendsms ...
6
votes
3answers
529 views

Are two database trips reasonable for a login system?

I am designing a login system for a project, and have an issue about it requiring two trips to the database when a user logs in. User types in username and password Database is polled and password ...
6
votes
1answer
2k views

Token or ASP.NET Identity based security in ASP.NET Web API 2

Background I have a Web API 2 project, without any extension of ASP.NET MVC or ASP.NET projects. The API will only be used to communicate between the server and Windows 8, Windows Phone 8.1 and iOS ...
6
votes
1answer
1k views

Implementing Digitally signed data in a Web Application

I understand PKI well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of Transactions or ...
6
votes
0answers
86 views

What To Do If I've Found a Vulnerability In a Possible Future Employers Site? [duplicate]

I've been self employed for a long time now and have recently decided that PHP development within a company is the route I'd like to go down. I had an initial interview/meeting yesterday with a ...
5
votes
6answers
2k views

How can I prevent users from creating multiple accounts on a web site?

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
5
votes
6answers
431 views

What would you define as sensitive user data?

A recent previous question of mine had an answer that sparked a different and unrelated question in my mind: Customer wants to modify the .properties files packaged in our WAR file The question that ...
5
votes
4answers
233 views

Are there languages that make it easier to understand secure coding principles?

I'm interested in expanding my knowledge of security issues: things like buffer overflows, format string vulnerabilities, etc. I'd like to be able to go through a language and understand its security ...
5
votes
4answers
488 views

Steps after SQL Injection detected

I've come across SQL injection vulnerabilities on my companies ecommerce page. It was fairly poorly put together. I believe I have prevented future attempts however we are getting calls about ...
5
votes
3answers
406 views

How to store / not to store passwords

I am building an web site which will allow users to aggregate the information stored in their online profiles ("data feeds") in one place. I am wondering - what is the accepted (from a secureness ...
5
votes
3answers
191 views

Name for sanitizing at the right time?

Recently we had an issue on our site where someone attempted SQL injection via a cookie (we'll call it lastID). NOC was in a frenzy and angry about how the cookie as an attack vector could be ...
5
votes
2answers
290 views

Why applications don't have constraint-based security?

In almost any security system I've ever seen, what is controlled is that which person has access to which part. However, in real life, in many situations, security systems also consider when and ...
5
votes
3answers
947 views

Learning about security and finding exploits [closed]

First things first: I have absolutely no interest in learning how to crack systems for personal enrichment, hurting other people or doing anything remotely malicious. I understand the basis of many ...
5
votes
3answers
748 views

Are buffer overflows no longer a threat these days?

After following buffer overflow examples and reading on them in various books/websites it seems there are lots of preventative measures in place to protect against them these days. ASLR, /GS flag ...
5
votes
4answers
328 views

Keeping a connection string secure when working with others

Say you've started an open source project and are posting it on a public repository. (like I have, using Codeplex.) One of the key files just makes the connection to the database, contains the ...
5
votes
3answers
294 views

Possible hack aftermath [closed]

After being hacked companies often give numbers and details on how much of their data was compromised e.g "13K user and passwords". After a possible intrusion how do you know what the hacker did in ...
5
votes
4answers
216 views

How can we track how well we're preventing and avoiding security vulnerabilities?

It's pretty easy to track when we fix security vulnerabilities in existing code. But to make sure the whole team is staying on their toes about writing secure code, I'd like to also track how well we ...
5
votes
5answers
954 views

Is it safe to display information about old passwords on login failure?

When I changed my Facebook password yesterday, by mistake I entered the old one and got this: Am I missing something here or this is a big potencial risk for users. In my opinion this is a problem ...
5
votes
1answer
3k views

Any ASN.1 parsers written completely in managed code & safe from buffer overflows

ASN.1 is a data format used on HTTPS certificates, and various other critical pieces of infrastructure. I need to analyze some potentially hostile ASN.1 data, and want to ensure my code is safe from ...
5
votes
1answer
125 views

Hardware key removal on a test system

One of my company's applications still requires a hardware key to run, but we're currently in the process of removing that requirement and replacing it with an online check. The issue we are having ...