For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

2
votes
2answers
303 views

Is having sensitive data in a PHP script secure?

I've heard that PHP is somewhat secure because Apache won't allow the download of raw PHP. Is this reliable, though? For example, if you wanted to password protect something, but didn't want to create ...
2
votes
4answers
404 views

What are the downsides of leaving automation tags in production code?

I've been setting up debug tags for automated testing of a GWT-based web application. This involves turning on custom debug id tags/attributes for elements in the source of the app. It's a non-trivial ...
2
votes
5answers
135 views

Is it reasonable to require passwords when users sign into my application through social media accounts?

I've built an application that requires users to authenticate with one or more social media accounts from either Facebook, Twitter, or LinkedIn. Edit Once the user has signed in, an 'identity' for ...
0
votes
1answer
292 views

Can HTML injection be a security issue?

I recently came across a website that generates a random adjective, surrounded by a prefix and suffix entered by the user. For example, if the user enters "123" for prefix, and "789" for suffix, it ...
21
votes
5answers
2k views

How to implement a safe password history

Passwords shouldn't be stored in plain text for obvious security reasons: you have to store hashes, and you should also generate the hash carefully to avoid rainbow table attacks. However, usually ...
3
votes
3answers
682 views

Securing credentials passed to web service

I'm attempting to design a single sign on system for use in a distributed architecture. Specifically, I must provide a way for a client website (that is, a website on a different ...
1
vote
1answer
353 views

Are python's cryptographic modules good enough?

I mean, say you were writing professional grade software that would involve sensitive client information. (Take this in the context of me being an amateur programmer.) Would you use hlib and hmac? ...
4
votes
5answers
1k views

Security issue about making my code public in GitHub

I'm developing a big community/forum website and I'd like to upload my code to GitHub to have at least some sort of version control over it (because I have nothing other than a .rar file as a backup, ...
2
votes
2answers
407 views

Moving between sites using SAML

I'm tasked with developing an SSO system, and was guided towards using the SAML spec. After some research I think understand the interaction between a Service Provider and an ID Provider and how a ...
1
vote
1answer
996 views

Is the escaping provided by the Google-Gson library enough to ensure a safe JSON payload?

I am currently using the Google-Gson library to convert Java objects into JSON inside a web service. Once the object has been converted to JSON, it is returned to the client to be converted into a ...
1
vote
3answers
152 views

How do I trust an off site application

I need to implement something similar to a license server. This will have to be installed off site at the customers' location and needs to communicate with other applications at the customers' site ...
2
votes
1answer
142 views

What are the security implications of running untrusted code on my server?

I would like to set up an app that allows users to send their code and execute it on my server. The thought of running untrusted code makes me cringe, so I am trying to set up an exhaustive list of ...
4
votes
1answer
164 views

How to go about designing an intermediate routing filter program to accept input and forward accordingly?

My predicament: I designed an app, written in Python, to read my mail and check for messages that contain a certain digital signature. It opens these and looks for keywords. If the message contains ...
3
votes
1answer
377 views

J2EE - Field level Role-based security for a complete web application [closed]

I have a complex website designed using Spring MVC and MyBatis. User Interface is very complex and we have lot of custom made widgets - calenders, lists, graphs etc. If we were to implement field ...
2
votes
2answers
218 views

help for choosing an encryption method for a database column

I'm storing some phone numbers in the database which should kept totally secret (they're supposed to access via web). BTW, because of the position of these people, I need to prevent any chance for ...
0
votes
2answers
1k views

Is using dirname(__FILE__) a good practice?

Looking at the code of Joomla I see that in the first line of the index, it defines the base path of installation with dirname(__FILE__). Is this a possible risk for the site? If a non controlled ...
10
votes
5answers
375 views

What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability?

At my local university, there is a small student computing club of about 20 students. The club has several small teams with specific areas of focus, such as mobile development, robotics, game ...
4
votes
4answers
169 views

System that splits passwords across two servers

I stumbled upon this news article on BBC, RSA splits passwords in two to foil hackers' attacks tl;dr - a (randomized) password is split in half and is stored across two separate servers, to foil ...
-2
votes
3answers
298 views

What is the Best Practice for creating a secure login in a client - server appllication?

It's been a while I have been thinking on what could be the best scenario for creating a secure login in a client-server application running on internet or any other networks ! So I became with the ...
3
votes
2answers
82 views

Resources on securing domain models? [closed]

I'm have good resources on both security, domain modelling, and architecture patterns. I've noticed a distinct lack of any suggestion of how and where to integrate security into the systems I build. I ...
2
votes
2answers
256 views

Drop in service for account management, authentication, identity?

I'm building an Android app and associated set of web services for uploading/downloading data. I need a basic (no frills) solution for account management (register, login, logout, verify ...
4
votes
1answer
166 views

How secure (or insecure) is it to install Node packages globally?

Should I be concerned with security when installing Node packages globally? Why or why not?
6
votes
2answers
375 views

Would I be able to use code hosting services to host malware code?

Let me start by saying that I am a computer security researcher. Part of my job is to create malware to deploy on a controlled environment in order to study or evaluate several aspects of computer ...
8
votes
4answers
257 views

Avoiding “double” subscriptions

I am working on a website that requires a bit of marketing; let me explain. This website is offering a single, say, iTunes 50$ voucher to a lucky winner. To be entered in the draw, you need to ...
6
votes
3answers
324 views

What is the best policy for allowing clients to change email?

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
2
votes
1answer
281 views

Why is iOS “jailbreaking” CPU specific?

Recently, iOS 6 was "jailbroken" but only on the Apple A4 CPU. Why is the "jailbreaking" process specific to a CPU? From Wikipedia: ... "iOS jailbreaking is the process of removing the ...
5
votes
3answers
630 views

Learning about security and finding exploits [closed]

First things first: I have absolutely no interest in learning how to crack systems for personal enrichment, hurting other people or doing anything remotely malicious. I understand the basis of many ...
5
votes
2answers
568 views

Should I be using a JavaScript SPA designed when security is important

I asked something kind of similar on stackoverflow with a particular piece of code however I want to try to ask this in a broader sense. So I have this web application that I have started to write in ...
5
votes
1answer
151 views

Development-led security vs administration-led security in a software product?

There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level ...
2
votes
1answer
222 views

Does the deprecation of mysql_* functions in PHP carry over to other Databases(MSSQL)?

I'm not talking about MySQL, I'm talking about Microsoft SQL Server I've been aware of PDO for quite some time now, standard mysql functions are dangerous and should be avoided. ...
6
votes
1answer
155 views

How to learn what the industry standards/expectations are, particularly with security?

For instance, I was making my first mobile web-application about a year ago, and half-way through, someone pointed me to jQuery Mobile. Obviously this induced a total revolution in my app. Rewrote ...
0
votes
1answer
637 views

How do PGP and PEM differ?

Email messages are sent in plain text which means that the messages I send to Derpina are visible to anyone who somehow gets access to them while they are in transit. To overcome this, various ...
-1
votes
3answers
151 views

Situations that require protecting files against tampering when stored on a users computer

I'm making a 'Pokémon Storage System' with a Client/Server model and as part of that I was thinking of storing an inventory file on the users computer which I do not wish to be edited except by my ...
1
vote
1answer
680 views

Performing user authentication in a CodeIgniter controller constructor?

In "The Clean Code Talks -- Unit Testing" (http://youtu.be/wEhu57pih5w), Miško Hevery mentions that "as little work as possible should be done in constructors [to make classes more easily testable]'. ...
33
votes
7answers
4k views

Should a stack trace be in the error message presented to the user?

I've got a bit of an argument at my workplace and I'm trying to figure out who is right, and what is the right thing to do. Context: an intranet web application that our customers use for accounting ...
4
votes
1answer
1k views

How can we protect the namespace of an object in Javascript?

Continuing from my previous question: Javascript simple code to understand prototype-based OOP basics Let's say we run into console this two separate objects(even if they are called child and parent ...
7
votes
3answers
275 views

How to explain to my customer that the hosting provider is terrible, security-wise?

As a freelance developer, I sometimes have to access the administration panels of hosting providers of my customers. It is an astonishingly frightening experience. Below are some points I noticed when ...
0
votes
4answers
2k views

Application connecting to database server

I'm working on an application which requires user credentials and so on. So a database is required on the backend. What is the best practice to connect to a database without hardcoding your password ...
3
votes
4answers
524 views

Public-private key pair handling on a Windows ecosystem

I've been thinking about how to architect an infrastructure for one of our business applications with the following requirement: Data written by some user can only be read by that user and his ...
4
votes
1answer
1k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...
-2
votes
3answers
246 views

How to handle security of temporary data on web server?

I'm primarily an ASP.NET developer but this question really applies regardless of language. So obviously it is a good idea to prevent external attacks that arise from session hijacking and csrf ...
0
votes
1answer
683 views

Should OAuth token be shared to implement SSO?

What's a commonly accepted way of implementing SSO using a third party OAuth provider? I have a server with user resources associated with server's user ID, the user ID also has a Facebook user ID ...
2
votes
4answers
1k views

why control + alt + delete couldn't be intercepted by any application

The secure attention key is designed to make login spoofing impossible, as the kernel will suspend any program, including those masquerading as the computer's login process, before starting a ...
9
votes
2answers
875 views

How do CDNs protect failover sites from DDoS attacks?

I'm in the design process for a Java web app that I will probably end up deploying to Google App Engine (GAE). The nice thing about GAE is that I really don't have to worry about fortifying my app ...
3
votes
3answers
395 views

Saving Passwords To The Local Device

So In my app (iOS), you have to register in order to use the service (a food service). But in order to change details about your account (username, password, and email), you have to reenter your ...
0
votes
3answers
124 views

User management data - the need for a username and password

I would have this asked on StackOverflow if it had code, but it's more on the idea/concept so I asked here. I am working on the UI of our inventory system when I found out that when registering a ...
0
votes
2answers
201 views

What is the logic behind filtering/sanitizing input?

I have always found it more logic to validate input instead of filtering it. How to appropriately filter data depends on the situation, so IMO it should be done in output or when saving to a database. ...
14
votes
10answers
1k views

How important is an SSL certificate for a website?

I'm bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I'm using subdomains and I need to access them with iframes (it's ...
3
votes
3answers
181 views

Separation of concerns and security

The system I am developing is designed to have multiple organizations, with users and roles for each organization. Some organizations can interact, some can not, and generally organizations are not ...
6
votes
5answers
2k views

What is the rationale behind entering email twice for registration? [duplicate]

Many web sites ask users to enter their email address twice, sometimes taking the trouble to disable copy-pasting. What is the logic behind this? Is this e.g. a security measure?