For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

1
vote
4answers
277 views

Is just using an email address for login a good idea?

Many a times I need to log into a website that I used months ago and have forgotten my password. So clicking the reset password link and the site sends me an email with a single use link which allows ...
13
votes
4answers
867 views

What to do when your company doesn't encrypt passwords

Background I'm been contracted to help a company maintain their server. I work on some minor PHP projects but also look over performance issues and recently, scan logs for hackers. These guys have ...
1
vote
2answers
186 views

Fixing a security exploit - but then everyone knows about it

Earlier, I was messaged about a potential security risk in one of my projects. I checked it and found that it allows for "arbitrary code execution". (Quotes because it is running in a VM, but the ...
1
vote
1answer
265 views

How important is an SSL certificate for a internal website?

I know many people have asked the same question but I think it really depends on the type of the website. So that's why I am asking the question about my website. I am developing a PHP web ...
2
votes
1answer
464 views

Is masking really necessary when sending from Websocket client

The current Websocket RFC requires that websocket clients mask all data within frames when sending (but server is not required to). The reason the protocol was designed this way is to prevent frame ...
2
votes
2answers
141 views

Security concern regarding web service

I'm currently working on a pet project with two of my buddies. This web service will provide basic functionality such as Login/Password Modification/Registration etc. All of us are comfortable with ...
0
votes
2answers
163 views

How can I solve this potential security exploit (concerning the saving of REST resources)?

I have a File database table with the following columns: Id (PK), Filename And a Document database table with the following columns: Id (PK), Name, Description, FileId (FK) When a user wants to ...
0
votes
1answer
158 views

How to provide data to a web server using a data warehouse?

We have data stored in a data warehouse as follows: Price Date Product Name (varchar(25)) We currently only have seven products. Once every business day, seven new data points are added ...
0
votes
1answer
105 views

Do we have any special design considerations for maintaining anonymity in an application?

This is an open-ended question which I am analysing while doing some fun projects in leisure. Websites like Google, Facebook do store user activities and perhaps sell them or use them for ...
3
votes
1answer
2k views

Is it possible to protect json api scraping using random tokens?

I have built a restful json api for an online store using Laravel. I now wish to create an AngularJS app to run the front-end web application. Product prices for my store need to update every second, ...
1
vote
1answer
218 views

How do I verify if 3rd party payment succeeded?

I'm working on a payment processing website that will function like PayPal does on many e-commerce websites. The idea is for the customer to fill their shopping cart and click checkout, then be ...
24
votes
6answers
2k views

How is major software protected? [duplicate]

I am a new software developer and I wish to sell my software. I recently realized that from C++ code we can not stop the user seeing parts of the code that are related to scripts or system commands. ...
8
votes
5answers
679 views

Where to store the private key?

Say I want some parts of my software to be encrypted. For example, the credentials for a database, etc. I need to store those values somewhere, but doing so in cleartext would make it easy for an ...
1
vote
4answers
308 views

Is securing the credit card data is considered a requirement from the customer

I'm taking an Introduction to Agile Software Development course, The instructor was discussing an example about online store and asked us to write the User Stories and the Conditions of satisfactions ...
2
votes
3answers
639 views

Is it possible to check a client side application identity from server side? [duplicate]

Assume there is a web service which is visible publicly but it must be just responsive to a specific client application. Is there any mechanism to check client side application identity to prevent ...
1
vote
1answer
623 views

Is it an implementation of a stateful mechanism for Rest API authentication?

In many articles about Rest API's best practices, it is recommended to not depend upon sessions on server side since it leads to a stateful mechanism. I currently use Play 2.2 framework, with a ...
0
votes
0answers
57 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
11
votes
7answers
1k views

Why do modern websites still insist on archaic username/password requirements? [duplicate]

I was signing up for a website last night, and once again was greeted with the fact that my username cannot contain certain characters (including spaces), and neither could my password. Is there a ...
10
votes
6answers
7k views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
3
votes
2answers
314 views

Would using rainbow tables to detect weak user passwords feasible?

As I understand in most security breach where the list of hashed password are compromised, attackers do use brute-force to try to find weak password and, invariably, they always find quite some (like ...
25
votes
9answers
4k views

Why not expose a primary key

In my education I have been told that it is a flawed idea to expose actual primary keys (not only DB keys, but all primary accessors) to the user. I always thought it to be a security problem ...
1
vote
3answers
259 views

How do I dissuade users from using the same password with similar systems?

I'm building a web application that connects to other web services (using strictly anonymous binding, so no user passwords are being used). However the web application maintains its own users itself, ...
27
votes
5answers
1k views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
1
vote
2answers
92 views

Recommended secure approach to confirming an URL is called by a legitimate caller

I'm using a CRON on AppEngine and the cron calls my web app at a specific app. I only want to execute functionality when called by my AppEngine app. What's is/are recommended approach to confirming ...
0
votes
1answer
505 views

Making Agile and DevOps methodology compatible with PCI requirements [closed]

Would like to hear from those working in a PCI compliance environment and is practicing agile development and devops methodology, how you maintain compliance with PCI requirements. Specifically, what ...
2
votes
1answer
570 views

Approach to Authenticate Clients to TCP Server

I'm writing a Server/Client application where clients will connect to the server. What I want to do, is make sure that the client connecting to the server is actually using my protocol and I can ...
10
votes
5answers
3k views

How do web servers enforce the same-origin policy?

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
2
votes
2answers
183 views

Principles of an extensible data proxy

There is a growing industry now with more than 30 companies playing in the Backend-As-A-Service (BaaS) market. The principle is simple: give companies a secure way of exposing data housed on premises ...
1
vote
1answer
163 views

Creating deterministic key pairs in javascript for use in encrypting/decrypting/signing messages

So I have been searching everywhere and havn't been able to find anything with the sufficient information I need.. so Im a bit stumped on this one at the moment What I am trying to do is create a ...
1
vote
1answer
208 views

What am I risking if I don't update my SDK/JDK and bundled runtime/JRE every time there's a security update?

It seems like there's a new major security hole patched in Java every other week, and I would assume the same goes for other development platforms. After years of frustration trying to get customers ...
3
votes
1answer
139 views

Some hint to program a webservice “by subscription”

I have some web sites programmed, I know to do it with python and PHP basically. Normally they are simple web sites, but now I want to provide REST web services but only for allowed users (allowed by ...
3
votes
1answer
563 views

Using Dynamic LINQ to get a filter for my Web API

We are considering using the Dynamic.CS linq-sample included in the "Samples" directory of visual studio 2008 for our WebAPI project to allow clients to query our data. The interface would be ...
2
votes
1answer
213 views

How to check for vulnerabilities in web application [closed]

I have developed a web application using zend framework, mysql, and other client side technologies like javascript, jquery ajax, kendo grid, and so on. I have completed development and have done ...
6
votes
0answers
86 views

What To Do If I've Found a Vulnerability In a Possible Future Employers Site? [duplicate]

I've been self employed for a long time now and have recently decided that PHP development within a company is the route I'd like to go down. I had an initial interview/meeting yesterday with a ...
-1
votes
2answers
187 views

How to manage your personal ssh keys? [closed]

I understand that ssh keys are a cryptographically secured way of authenticating yourself to a service or to another person, but beyond that I'm frankly at a bit of a loss. What confuses me is that I ...
1
vote
1answer
165 views

How to securely store user credentials from external website

I'm developing an application where I'd like to use credentials from external websites. This will be used to login with the website API and get information for the user. Example: I want to use the ...
4
votes
2answers
1k views

Best practice in application design / SQL authentication

I am currently involved in the implementation/design of an existing application for a large scale customer. The application has a similar model as e.g. vCenter Server whereby a number of components ...
1
vote
2answers
156 views

How can I limit access for automatically generated files to specific users in a MVC setup?

I have a typical MVC based website, and I'd like to give some registered users the abillity to extract data from the database (in a variety of formats). The workflow is very simple: User logs in, ...
2
votes
1answer
590 views

How to audit an Android application (not rooted) without having access to its source?

How can I check if an Android application running on a not rooted device is "secure" without knowing its source? I would look for: Plain text in Web-Requests (wireshark and emulator) SQL-injection ...
0
votes
0answers
1k views

How secure is this way of authenticating an ASP .NET Web API - creating your own tokens?

http://www.codeproject.com/Articles/630986/Cross-Platform-Authentication-With-ASP-NET-Web-API#_rating The above link shows exactly how I want to go about authenticating against an ASP .NET Web API. ...
6
votes
6answers
851 views

What are the cases where keeping source code secret is justified?

When I worked as a freelancer, I encountered lots of cases where customers were protecting their ideas and source code of their projects (such as web applications) as much as possible, no matter how ...
2
votes
1answer
416 views

Checking for cross-site scripting vulnerabilities in Perl web applications

I'm putting together some notes for a dev team on how to write secure Perl code - especially taking into account the current OWASP top 10 web application vulnerabilities. For cross-site scripting I've ...
1
vote
0answers
105 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
3
votes
1answer
229 views

What is the identification procedure that registers a mobile device on a subscriber account and installs purchased content?

We know there are several moving parts to a system like the apple store or google play. At the very least; The device has a unique hardware id or sim card The user has a login/pass The "store" site ...
2
votes
3answers
605 views

Shared hosting for a PHP application

I was reading Essential PHP Security and chapter 8 talks about problems with hosting your PHP app in a shared hosting environment. Some of the problems he mentions are: - Exposed source code and ...
14
votes
6answers
970 views

How to assure users that website and passwords are secure [closed]

On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All ...
0
votes
3answers
368 views

VB stand alone application or ASP web application

I have experience developing software and web applications and I have decided to do some freelance work on the side. Well, I met with my first client and they are requesting a relatively simple, ...
0
votes
1answer
105 views

Possible holes in a spam-registration prevention approach?

I was thinking of creating some login code (probably to work with BrowserID so users don't need to store their passwords with my site while also ensuring the supplied email account belongs to them) ...
2
votes
1answer
156 views

How much should we spend on improving software security?

Is there a "scientific" method to determine how much resources/money should be spent on improving the security of a piece of software? I work in a team where our work is prioritized by a product ...
3
votes
1answer
376 views

Are there security implications to using dynamically-assigned TCP port numbers?

I'm getting pushback from operations for having a server process listen on a dynamically-assigned port number (i.e. it binds a socket to a port number of 0, triggering a dynamic assignment by the OS, ...