For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

3
votes
1answer
345 views

J2EE - Field level Role-based security for a complete web application [closed]

I have a complex website designed using Spring MVC and MyBatis. User Interface is very complex and we have lot of custom made widgets - calenders, lists, graphs etc. If we were to implement field ...
2
votes
2answers
203 views

help for choosing an encryption method for a database column

I'm storing some phone numbers in the database which should kept totally secret (they're supposed to access via web). BTW, because of the position of these people, I need to prevent any chance for ...
0
votes
2answers
862 views

Is using dirname(__FILE__) a good practice?

Looking at the code of Joomla I see that in the first line of the index, it defines the base path of installation with dirname(__FILE__). Is this a possible risk for the site? If a non controlled ...
10
votes
5answers
372 views

What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability?

At my local university, there is a small student computing club of about 20 students. The club has several small teams with specific areas of focus, such as mobile development, robotics, game ...
4
votes
4answers
168 views

System that splits passwords across two servers

I stumbled upon this news article on BBC, RSA splits passwords in two to foil hackers' attacks tl;dr - a (randomized) password is split in half and is stored across two separate servers, to foil ...
-2
votes
3answers
268 views

What is the Best Practice for creating a secure login in a client - server appllication?

It's been a while I have been thinking on what could be the best scenario for creating a secure login in a client-server application running on internet or any other networks ! So I became with the ...
3
votes
2answers
75 views

Resources on securing domain models? [closed]

I'm have good resources on both security, domain modelling, and architecture patterns. I've noticed a distinct lack of any suggestion of how and where to integrate security into the systems I build. I ...
2
votes
2answers
247 views

Drop in service for account management, authentication, identity?

I'm building an Android app and associated set of web services for uploading/downloading data. I need a basic (no frills) solution for account management (register, login, logout, verify ...
4
votes
1answer
157 views

How secure (or insecure) is it to install Node packages globally?

Should I be concerned with security when installing Node packages globally? Why or why not?
6
votes
2answers
371 views

Would I be able to use code hosting services to host malware code?

Let me start by saying that I am a computer security researcher. Part of my job is to create malware to deploy on a controlled environment in order to study or evaluate several aspects of computer ...
8
votes
4answers
257 views

Avoiding “double” subscriptions

I am working on a website that requires a bit of marketing; let me explain. This website is offering a single, say, iTunes 50$ voucher to a lucky winner. To be entered in the draw, you need to ...
6
votes
3answers
321 views

What is the best policy for allowing clients to change email?

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
2
votes
1answer
279 views

Why is iOS “jailbreaking” CPU specific?

Recently, iOS 6 was "jailbroken" but only on the Apple A4 CPU. Why is the "jailbreaking" process specific to a CPU? From Wikipedia: ... "iOS jailbreaking is the process of removing the ...
5
votes
3answers
583 views

Learning about security and finding exploits [closed]

First things first: I have absolutely no interest in learning how to crack systems for personal enrichment, hurting other people or doing anything remotely malicious. I understand the basis of many ...
5
votes
2answers
525 views

Should I be using a JavaScript SPA designed when security is important

I asked something kind of similar on stackoverflow with a particular piece of code however I want to try to ask this in a broader sense. So I have this web application that I have started to write in ...
5
votes
1answer
151 views

Development-led security vs administration-led security in a software product?

There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level ...
2
votes
1answer
218 views

Does the deprecation of mysql_* functions in PHP carry over to other Databases(MSSQL)?

I'm not talking about MySQL, I'm talking about Microsoft SQL Server I've been aware of PDO for quite some time now, standard mysql functions are dangerous and should be avoided. ...
6
votes
1answer
152 views

How to learn what the industry standards/expectations are, particularly with security?

For instance, I was making my first mobile web-application about a year ago, and half-way through, someone pointed me to jQuery Mobile. Obviously this induced a total revolution in my app. Rewrote ...
0
votes
1answer
533 views

How do PGP and PEM differ?

Email messages are sent in plain text which means that the messages I send to Derpina are visible to anyone who somehow gets access to them while they are in transit. To overcome this, various ...
-1
votes
3answers
149 views

Situations that require protecting files against tampering when stored on a users computer

I'm making a 'Pokémon Storage System' with a Client/Server model and as part of that I was thinking of storing an inventory file on the users computer which I do not wish to be edited except by my ...
1
vote
1answer
622 views

Performing user authentication in a CodeIgniter controller constructor?

In "The Clean Code Talks -- Unit Testing" (http://youtu.be/wEhu57pih5w), Miško Hevery mentions that "as little work as possible should be done in constructors [to make classes more easily testable]'. ...
33
votes
7answers
3k views

Should a stack trace be in the error message presented to the user?

I've got a bit of an argument at my workplace and I'm trying to figure out who is right, and what is the right thing to do. Context: an intranet web application that our customers use for accounting ...
4
votes
1answer
1k views

How can we protect the namespace of an object in Javascript?

Continuing from my previous question: Javascript simple code to understand prototype-based OOP basics Let's say we run into console this two separate objects(even if they are called child and parent ...
7
votes
3answers
270 views

How to explain to my customer that the hosting provider is terrible, security-wise?

As a freelance developer, I sometimes have to access the administration panels of hosting providers of my customers. It is an astonishingly frightening experience. Below are some points I noticed when ...
-1
votes
4answers
2k views

Application connecting to database server

I'm working on an application which requires user credentials and so on. So a database is required on the backend. What is the best practice to connect to a database without hardcoding your password ...
3
votes
4answers
518 views

Public-private key pair handling on a Windows ecosystem

I've been thinking about how to architect an infrastructure for one of our business applications with the following requirement: Data written by some user can only be read by that user and his ...
4
votes
1answer
818 views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...
-2
votes
3answers
244 views

How to handle security of temporary data on web server?

I'm primarily an ASP.NET developer but this question really applies regardless of language. So obviously it is a good idea to prevent external attacks that arise from session hijacking and csrf ...
0
votes
1answer
589 views

Should OAuth token be shared to implement SSO?

What's a commonly accepted way of implementing SSO using a third party OAuth provider? I have a server with user resources associated with server's user ID, the user ID also has a Facebook user ID ...
2
votes
4answers
1k views

why control + alt + delete couldn't be intercepted by any application

The secure attention key is designed to make login spoofing impossible, as the kernel will suspend any program, including those masquerading as the computer's login process, before starting a ...
9
votes
2answers
812 views

How do CDNs protect failover sites from DDoS attacks?

I'm in the design process for a Java web app that I will probably end up deploying to Google App Engine (GAE). The nice thing about GAE is that I really don't have to worry about fortifying my app ...
3
votes
3answers
374 views

Saving Passwords To The Local Device

So In my app (iOS), you have to register in order to use the service (a food service). But in order to change details about your account (username, password, and email), you have to reenter your ...
0
votes
3answers
122 views

User management data - the need for a username and password

I would have this asked on StackOverflow if it had code, but it's more on the idea/concept so I asked here. I am working on the UI of our inventory system when I found out that when registering a ...
0
votes
2answers
199 views

What is the logic behind filtering/sanitizing input?

I have always found it more logic to validate input instead of filtering it. How to appropriately filter data depends on the situation, so IMO it should be done in output or when saving to a database. ...
14
votes
10answers
1k views

How important is an SSL certificate for a website?

I'm bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I'm using subdomains and I need to access them with iframes (it's ...
3
votes
3answers
169 views

Separation of concerns and security

The system I am developing is designed to have multiple organizations, with users and roles for each organization. Some organizations can interact, some can not, and generally organizations are not ...
5
votes
5answers
2k views

What is the rationale behind entering email twice for registration? [duplicate]

Many web sites ask users to enter their email address twice, sometimes taking the trouble to disable copy-pasting. What is the logic behind this? Is this e.g. a security measure?
2
votes
2answers
183 views

Authentication Systems - Separate for Management?

Edit: I admit to being unclear when I first wrote the question. I suppose I wasn't sure of the issue myself, the comments and answers provided up to now helped me focus on the issue, thank you to all ...
4
votes
1answer
321 views

CSRF Protection with codeigniter

I have very little knowledge in application security. I have often seen to protect your application from csrf attacks developers use tokens and pass these tokens with request to validate. I want to ...
0
votes
1answer
118 views

Multiplayer Game Listen Servers: Ensuring Integrity

I'm making a simple multiplayer game of Tic Tac Toe in Python using Bridge (its an RPC service built over a message queue - RabbitMQ) and I'd like to structure it so that the client and the server are ...
8
votes
3answers
552 views

Is it a security flaw to log the class and method name when an exception occurs?

I have the following : public class doCheck(){ public void performCheck(){ try { perform all checks...... } catch(Exception e){ ...
0
votes
5answers
657 views

Standards & compliances for secure web application development?

I am working with developers right now that write code the way they want and when i tell them to do it other way they respond that its just matter of preference how to do it and they have their way ...
1
vote
1answer
4k views

HTML5 localStorage and encrypted sensitive data

I'm looking for a way to have a website remember sensitive data, but without actually storing it server side. And I was looking at HTML5 localStorage to do it. Here's the plan as I see it. User ...
3
votes
1answer
133 views

File Upload Forms: Security

SO I'm building an application for uploading files. We're paying scientists to contribute information on pests, diseases and bugs (for Plants). We need the ability to drag and drop a file to upload ...
0
votes
1answer
163 views

Security aspects of an ASP.NET that can be pointed out to the client

I need to write several passages of text in an offer to the client about the security layer in ASP.NET MVC web solution. I am aware of security that comes along with MVC 3 and an improvements in MVC ...
7
votes
2answers
3k views

Where can I safely learn about computer security? [closed]

I find it really hard to find resources about computer security. I asked questions on message boards about key loggers and viruses and I got negative assumption from people assuming the the worse. ...
8
votes
6answers
647 views

How to refuse to give an access to passwords to a customer without being unprofessional or rude?

Let's say you're creating a website for a customer. This website has its own registration (either combined with OpenID or not). The customer asks you to be able to see the passwords the users are ...
1
vote
1answer
332 views

Javascript: Safely upload a client data file

I'm (still) working on a template-based XML editing program. It's a GUI-based XML editor that only allows users to add certain tags and attributes based off the requirements. You can see the current ...
1
vote
5answers
1k views

How do you handle database security from a desktop application?

For about 10 years I've worked on various in-house desktop client applications with SQL Server data stores. Rarely did I start these projects - most are takeover work. One thing that seemed constant ...
2
votes
2answers
110 views

Security of logging people in automatically from another app?

I have 2 apps. They both have accounts, and each account has users. These apps are going to share the same users and accounts and they will always be in sync. I want to be able to login ...