For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

8
votes
6answers
695 views

How to refuse to give an access to passwords to a customer without being unprofessional or rude?

Let's say you're creating a website for a customer. This website has its own registration (either combined with OpenID or not). The customer asks you to be able to see the passwords the users are ...
8
votes
4answers
3k views

What are the security risks/vulnerabilities every C programmer must be aware of? [closed]

There are many security risks coming from having close contact to the hardware as opposed to using well-tested and proved APIs from high level programming languages. It is much easier to cause a ...
8
votes
5answers
911 views

Where to store the private key?

Say I want some parts of my software to be encrypted. For example, the credentials for a database, etc. I need to store those values somewhere, but doing so in cleartext would make it easy for an ...
8
votes
4answers
451 views

How do you go about checking your open source libraries for keystroke loggers?

A random person on the internet told me that a technology was secure(1), safe to use and didn't contain keyloggers because it is open source. While I can trivially detect the key stroke logger in ...
8
votes
3answers
778 views

Is it a security flaw to log the class and method name when an exception occurs?

I have the following : public class doCheck(){ public void performCheck(){ try { perform all checks...... } catch(Exception e){ logger.error("...
8
votes
3answers
1k views

What is the best way to learn how to develop secure applications?

I would like to get into computer security in my career. What are the best ways to learn how to program securely? It seems to me that, besides textbooks and taking classes in the subject, perhaps ...
8
votes
2answers
4k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...
8
votes
1answer
7k views

API Authentication, One time token VS Dynamic tokens

We are working on a new project, we are two lead developers and got on a crossroad on how to use a token to secure the communication between the server and the client. First Suggestion: (The one time ...
8
votes
2answers
296 views

Data encryption/protection - where to find info about high-level best practices [closed]

I feel that no one in the group I work in, myself included, really groks encryption and security, or the reasons behind making certain decisions. For example, we recently had a conversation regarding ...
8
votes
2answers
783 views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
8
votes
1answer
249 views

Securely sending data from shared hosted PHP script to local MSSQL

I'm trying to add data from a webhook (from a web cart) to a local Microsoft SQL Server. It seems like the best route for me is to use a PHP script to listen for new data (POST as json), parse it, ...
7
votes
6answers
1k views

What are the cases where keeping source code secret is justified?

When I worked as a freelancer, I encountered lots of cases where customers were protecting their ideas and source code of their projects (such as web applications) as much as possible, no matter how ...
7
votes
3answers
441 views

Converting a 1,000,000 rows database

If I have a database that stores the login credentials of 1,000,000 users in PLAINTEXT, how much effort will it take me to md5 hash these passwords?
7
votes
10answers
596 views

In what situations would it be technically 'impossible' to release a system as open source?

While there are certainly many economic, social and practical decisions to be made when deciding whether a system should be open source, are there any situations in which it is impossible, purely from ...
7
votes
2answers
5k views

Where can I safely learn about computer security? [closed]

I find it really hard to find resources about computer security. I asked questions on message boards about key loggers and viruses and I got negative assumption from people assuming the the worse. ...
7
votes
3answers
303 views

How to explain to my customer that the hosting provider is terrible, security-wise?

As a freelance developer, I sometimes have to access the administration panels of hosting providers of my customers. It is an astonishingly frightening experience. Below are some points I noticed when ...
7
votes
7answers
1k views

How to make security usable in a web application?

I'm in the planning stages of developing a web application that I want to make as secure as possible. I'm pretty clear about how to do that from a technical point of view, but there is one massive ...
7
votes
2answers
147 views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...
7
votes
3answers
1k views

How to separate sensitive data in database(MySql)

I need to design a database that will contains information about personal disease of users. What can be the approach in order to implement the columns of the DB's tables: encrypt the information, ...
7
votes
1answer
106 views

How does one request / handle personal or financial information?

I would like to create a budget app for Android. Obviously, to be competitive, I would need to allow users to get data from their bank. For [huge] security reasons, this stuff is not just freely given ...
7
votes
3answers
366 views

How will writing the transaction part in Java benefit the security of the application, when all other parts are being written in PHP?

A friend of mine while working on a PHP application asked me to write one part of the application in Java. The part that involved transactions. He said it will be better to write this portion in Java. ...
6
votes
8answers
2k views

Are you obliged to provide old employers with access to protected resources? [closed]

Firstly, a disclaimer. This question is not because I'm a disgruntled employee planning to hide some malicious code which I can later blackmail my employer with. I actually quite like the people I ...
6
votes
5answers
3k views

Security issue about making my code public in GitHub

I'm developing a big community/forum website and I'd like to upload my code to GitHub to have at least some sort of version control over it (because I have nothing other than a .rar file as a backup, ...
6
votes
5answers
3k views

What is the rationale behind entering email twice for registration? [duplicate]

Many web sites ask users to enter their email address twice, sometimes taking the trouble to disable copy-pasting. What is the logic behind this? Is this e.g. a security measure?
6
votes
4answers
3k views

What type of Password Reset/Forgot Password (verification) mechanism would you recommend

I am looking for ways to verify the user in order to reset their passwords. 2 commonly used ones: Email verification Secret question I wonder which will you recommend? I am trying to avoid having ...
6
votes
4answers
539 views

Public-key cryptography security given NSA resources

I was wondering how secure public private key encryption methods are. If two individuals were sending emails back and forth forever, where each person would encrypt the body of the email they were ...
6
votes
3answers
369 views

What is the best policy for allowing clients to change email?

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
6
votes
4answers
4k views

Storing sort code / account number on website. Security?

People in the UK will probably better understand what a sort code is and how sort code & account numbers are used for transfers etc, but the question is relevant to anyone I'm sure. Just to ...
6
votes
2answers
231 views

Do you apply a code of conduct on accepting jobs, projects or requirements?

When writing software for yourself, your company or third parties, do you always consider certain principles, values, standards, or rules of behavior that guide the decisions, procedures and systems ...
6
votes
2answers
4k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
6
votes
2answers
386 views

Would I be able to use code hosting services to host malware code?

Let me start by saying that I am a computer security researcher. Part of my job is to create malware to deploy on a controlled environment in order to study or evaluate several aspects of computer ...
6
votes
1answer
2k views

How do you protect your WCF service?

sometimes a programmer comes up with a brilliant idea to protect his/her webservice created with Windows Communication Foundation. I would like to hear from you guys, which techniques do you use to ...
6
votes
3answers
1k views

How to securely implement roles in a Windows Form application?

As an ISV, what is considered best practice for implementing application role based security? In other words, only allow users to access certain features in the application based on what roles they ...
6
votes
1answer
161 views

Development-led security vs administration-led security in a software product?

There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level (...
6
votes
3answers
539 views

Are two database trips reasonable for a login system?

I am designing a login system for a project, and have an issue about it requiring two trips to the database when a user logs in. User types in username and password Database is polled and password ...
6
votes
1answer
2k views

Token or ASP.NET Identity based security in ASP.NET Web API 2

Background I have a Web API 2 project, without any extension of ASP.NET MVC or ASP.NET projects. The API will only be used to communicate between the server and Windows 8, Windows Phone 8.1 and iOS ...
6
votes
1answer
1k views

Implementing Digitally signed data in a Web Application

I understand PKI well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of Transactions or ...
6
votes
0answers
86 views

What To Do If I've Found a Vulnerability In a Possible Future Employers Site? [duplicate]

I've been self employed for a long time now and have recently decided that PHP development within a company is the route I'd like to go down. I had an initial interview/meeting yesterday with a ...
5
votes
6answers
2k views

How can I prevent users from creating multiple accounts on a web site?

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
5
votes
6answers
448 views

What would you define as sensitive user data?

A recent previous question of mine had an answer that sparked a different and unrelated question in my mind: Customer wants to modify the .properties files packaged in our WAR file The question that ...
5
votes
4answers
233 views

Are there languages that make it easier to understand secure coding principles?

I'm interested in expanding my knowledge of security issues: things like buffer overflows, format string vulnerabilities, etc. I'd like to be able to go through a language and understand its security ...
5
votes
4answers
489 views

Steps after SQL Injection detected

I've come across SQL injection vulnerabilities on my companies ecommerce page. It was fairly poorly put together. I believe I have prevented future attempts however we are getting calls about ...
5
votes
3answers
409 views

How to store / not to store passwords

I am building an web site which will allow users to aggregate the information stored in their online profiles ("data feeds") in one place. I am wondering - what is the accepted (from a secureness ...
5
votes
3answers
191 views

Name for sanitizing at the right time?

Recently we had an issue on our site where someone attempted SQL injection via a cookie (we'll call it lastID). NOC was in a frenzy and angry about how the cookie as an attack vector could be ignored....
5
votes
2answers
290 views

Why applications don't have constraint-based security?

In almost any security system I've ever seen, what is controlled is that which person has access to which part. However, in real life, in many situations, security systems also consider when and ...
5
votes
3answers
1k views

Learning about security and finding exploits [closed]

First things first: I have absolutely no interest in learning how to crack systems for personal enrichment, hurting other people or doing anything remotely malicious. I understand the basis of many ...
5
votes
3answers
773 views

Are buffer overflows no longer a threat these days?

After following buffer overflow examples and reading on them in various books/websites it seems there are lots of preventative measures in place to protect against them these days. ASLR, /GS flag ...
5
votes
2answers
310 views

Is there any risk of web browsers spying away localhost applications on an Internet-connected PC?

Despite what it might look like this is a serious question. After that story with Android OS and Chrome browser submitting to Google the details of the WiFi access points they see in the neighborhood ...
5
votes
4answers
330 views

Keeping a connection string secure when working with others

Say you've started an open source project and are posting it on a public repository. (like I have, using Codeplex.) One of the key files just makes the connection to the database, contains the login/...
5
votes
6answers
3k views

How do you handle database security from a desktop application?

For about 10 years I've worked on various in-house desktop client applications with SQL Server data stores. Rarely did I start these projects - most are takeover work. One thing that seemed constant ...