For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

8
votes
3answers
500 views

Is it a security flaw to log the class and method name when an exception occurs?

I have the following : public class doCheck(){ public void performCheck(){ try { perform all checks...... } catch(Exception e){ ...
0
votes
5answers
596 views

Standards & compliances for secure web application development?

I am working with developers right now that write code the way they want and when i tell them to do it other way they respond that its just matter of preference how to do it and they have their way ...
1
vote
1answer
4k views

HTML5 localStorage and encrypted sensitive data

I'm looking for a way to have a website remember sensitive data, but without actually storing it server side. And I was looking at HTML5 localStorage to do it. Here's the plan as I see it. User ...
3
votes
1answer
130 views

File Upload Forms: Security

SO I'm building an application for uploading files. We're paying scientists to contribute information on pests, diseases and bugs (for Plants). We need the ability to drag and drop a file to upload ...
0
votes
1answer
161 views

Security aspects of an ASP.NET that can be pointed out to the client

I need to write several passages of text in an offer to the client about the security layer in ASP.NET MVC web solution. I am aware of security that comes along with MVC 3 and an improvements in MVC ...
7
votes
2answers
3k views

Where can I safely learn about computer security? [closed]

I find it really hard to find resources about computer security. I asked questions on message boards about key loggers and viruses and I got negative assumption from people assuming the the worse. ...
8
votes
6answers
629 views

How to refuse to give an access to passwords to a customer without being unprofessional or rude?

Let's say you're creating a website for a customer. This website has its own registration (either combined with OpenID or not). The customer asks you to be able to see the passwords the users are ...
1
vote
1answer
280 views

Javascript: Safely upload a client data file

I'm (still) working on a template-based XML editing program. It's a GUI-based XML editor that only allows users to add certain tags and attributes based off the requirements. You can see the current ...
0
votes
5answers
1k views

How do you handle database security from a desktop application?

For about 10 years I've worked on various in-house desktop client applications with SQL Server data stores. Rarely did I start these projects - most are takeover work. One thing that seemed constant ...
2
votes
2answers
108 views

Security of logging people in automatically from another app?

I have 2 apps. They both have accounts, and each account has users. These apps are going to share the same users and accounts and they will always be in sync. I want to be able to login ...
1
vote
2answers
523 views

Securing client->database game

OK, I am creating a game using JavaScript and HTML5. The variables such as map, x, y, level, exp, etc are stored in JavaScript to keep track. On my client page, the JavaScript variables are stored to ...
2
votes
2answers
474 views

Provide a URL to a CouchDB document attachment without giving the username/password?

I posted this question on DBA, but it got closed and was never reopened even after I rewrote the whole thing to be more specific. I think its more appropriate for programmers anyway :) Background ...
5
votes
1answer
755 views

Means for (legit) cross-site scripting

Are there good means for allowing scripts from two or more domains to collaborate in the same browser page? I want to create an extensible platform, where I provide the model and some views, but also ...
12
votes
2answers
470 views

What to do when you find a security hole in your company's site

I have found a major security hole in one of my company's public facing site. This is our first public facing site that was converted from an intranet site. I brought this issue up to my boss and they ...
2
votes
1answer
793 views

Why hasn't Caja been popular? [closed]

Google released Caja around 2008(Capability JavaScript). It is still mainly a laboratory language. But XSS and other attacks would be prevented if there was widespread integration of Caja.
14
votes
7answers
1k views

What makes a hashing algorithm “secure”?

After reading this interesting question, I felt like I had a good idea of which insecure hashing algorithm I'd use if I needed one, but no idea why I might use a secure algorithm instead. So what is ...
10
votes
3answers
3k views

Safe iPhone app ↔ server communication

What would be the best approach to achieving private communication between my iOS app and its server component? Is having a single unchanging “secret key” baked into the app source enough, or do I ...
1
vote
1answer
451 views

What is the future for ASP.NET Membership Providers? [closed]

While working on a new project with MVC3, a DI framework (Ninject), and unit tests (NUnit) paired with mocks (Moq), I found setting up the Membership Provider felt a bit "awkward". I've run into tasks ...
6
votes
2answers
659 views

How to separate sensitive data in database(MySql)

I need to design a database that will contains information about personal disease of users. What can be the approach in order to implement the columns of the DB's tables: encrypt the information, ...
10
votes
2answers
310 views

Weaknesses of 3-Strike Security

I've been reading some literature on security, specifically password security/encryption, and there's been one thing that I've been wondering: is the 3-strike rule a perfect solution to password ...
2
votes
1answer
301 views

Books or guides regarding secure key storage and database encryption [closed]

I have an idea for a SaaS product I want to create, however, this product will store extremely sensitive data that needs to be encrypted at rest. The trouble is not so much the encryption, but the ...
2
votes
3answers
385 views

Validating allowed characters or validating disallowed characters

I've always validated my user input based on a list of valid/allowed characters, rather than a list of invalid/disallowed characters (or simply no validation). It's just a habit I picked up, probably ...
2
votes
1answer
306 views

How to detect if an app was already installed before

How do software applications keep track of whether the user already installed the application before in it's Windows system? Say you install app X, trial version, remove it, then re install it, and ...
-2
votes
1answer
478 views

How is JavaScript insecure, and what are the main methods used to deal with that?

I just read about Caja, which is a "sanitized" version of JavaScript. But I'm wondering - what is the big problem with JavaScript(it seems so widely used )? Just how dangerous is it?
2
votes
1answer
445 views

Security in a private web service

I am developing a web site and a web service for a small on-line game. Technically, I'll be using Express (node.js) and MongoDB+Redis for the databases. This the structure I came up with: One ...
1
vote
3answers
860 views

Is programmatically clearing the browser's history an accepted best practice?

A colleague is pushing clearing the client browser's history (i.e. back-button) when they logout of our web application. Is this considered a good practice? It strikes me as a really intrusive. If ...
1
vote
1answer
1k views

How frequent should the Token Updation in CSRF security be?

To start with the background, this post is what Jeff Atwood says about CSRF tokens. In this very page, he goes on to say: An even stronger, albeit more complex, prevention method is to leverage ...
1
vote
4answers
172 views

How is software installed from an image?

I read an article a while back (forgot from where) that essentially stated that someone wrote a virus and inserted it into an image. The end result allowed the cracker to have his way with the system. ...
3
votes
4answers
218 views

Right Amount of Security on Machine

I am basically asking this question to see if I am being unreasonable. My current employer has locked down the machines of all developers so that we do not have access to the root or c: drive. For ...
2
votes
10answers
832 views

is it programmer's duty to disable directory listing?

Recently I have project in which a directory listing is enabled, due to which some scripts can be seen by outside world. I asked website administrator and he said it's not his responsibility, its the ...
7
votes
7answers
3k views

Is obscuring/obfuscating public-facing database ids really a “best practice”?

I've heard people lecture here and there on the internet that it's best practice to obscure public facing database ids in web applications. I suppose they mainly mean in forms and in urls, but I've ...
0
votes
3answers
325 views

API access question

FIRST, THE SCENARIO We have an internal system that is effectively split into 2 very separate parts across 2 sub-domains, our back-end administrative system for internal access only we will call this ...
4
votes
2answers
296 views

Is security a real argument for centralized version control?

I'm trying to understand if security is a real concern, or if distribution actually does a better job with security. See, the access to the main source repository could be layered and inherently ...
-1
votes
1answer
144 views

How can I make sure that people changes his IP or not

I want to check that people who registrates in my site and check in country box , for example, Argentina is really living in Argentina. How can I make sure that people is really living in that country ...
2
votes
1answer
5k views

What security is used by default in WSHttpBinding (service side) or the WCF Test client (client side)?

I recently moved a service from BasicHttpBinding to WSHttpBinding (i.e. soap 1.1 -> soap 1.2). In WCF, using WSHttpBinding() makes it start using some default security settings. I presume the same ...
4
votes
2answers
715 views

Making sure database connection information is secured

This is the first time that I am working on a web application. I was going through the question What should every programmer know about web development? and noticed one thing that I knew nothing of: ...
2
votes
1answer
1k views

Implementing RSA into an Android Messaging App

I am implementing RSA encryption on a Android App so that I can send SMS message securely, each phone will have its own public and private key generated by the App. But am stuck deciding the best ...
0
votes
4answers
456 views

How does using #define for loop and condition bounds in C increase security?

My program uses the following define statements: #define LOWEST_PATIENT_ID 10000 #define HIGHEST_PATIENT_ID 99999 #define LOWEST_CRITICAL_STATUS 1 #define HIGHEST_CRITICAL_STATUS 100 used in this ...
2
votes
4answers
157 views

How to not take risks with new collaborators?

My team is going to add new team members and my manager doesn't want to take any risks. I don't think it's a large problem but my manager is concerned that a new programmer would sabotage and ...
-1
votes
1answer
816 views

python login form vulnerability?

<HTML> <HEAD><TITLE>Login Page</TITLE></HEAD> <BODY> <CENTER> <FORM method="POST" action="http://yourserver/cgi-bin/login.py"> <paragraph> Enter ...
4
votes
2answers
106 views

Would it be hard to screen form submissions (e.g., comments) for non-words/non-sentences?

I've been thinking a lot lately about the need for better form security, and good ways to accomplish that. We currently use captcha codes to screen for bots, but that's annoying to users and may not ...
14
votes
4answers
438 views

Should internal code be shared with non-developers in an organisation?

Where I work, we have a lot of developers and an awful lot of code running our proprietary applications used by staff & customers alike. We also have a lot of smart support staff that like to ...
9
votes
2answers
343 views

Imitating Exchange Server's “RBAC AuthZ” in my own application… (is there something similar?)

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user. (Image source) This is a great & flexible model ...
7
votes
1answer
95 views

How does one request / handle personal or financial information?

I would like to create a budget app for Android. Obviously, to be competitive, I would need to allow users to get data from their bank. For [huge] security reasons, this stuff is not just freely given ...
5
votes
2answers
327 views

What should I do when I find sensitive information in version control?

Today I found what looked to be my supervisor's password in some code in version control. The password is to a database. He is very experienced and has explained before how to avoid having passwords ...
2
votes
2answers
1k views

Implementing oAuth 2 server

Do you have any pointers on how one should go about implementing the oAuth2 protocol itself? That is, the server side or the "provider" facet of OAuth2? If you have tried to implement (a part of) ...
4
votes
2answers
519 views

Is a traditional client app which connects directly to a database a good idea?

After using Django's excellent admin interface, I was pondering creating a similar system which wasn't as tied to an ORM. Now, while considering this, I thought that overcoming webapps limitations ...
1
vote
1answer
260 views

Is there somewhere I can post code used to hack my site? [closed]

I left a bit of a door open recently on my site. Someone tried to post PHP code to a CMS page editing module, but it wasn't executed. I have this code and was wondering if there is somewhere I should ...
2
votes
3answers
105 views

Authentication for 'participants' vs 'users'

I'm building a site that lets users schedule interviews/conferences with third parties and I'm wondering what's the best way to provide security around the participant experience while providing the ...
9
votes
2answers
445 views

How can I prevent programmers from capturing data entered by users?

I'm developing a web application with a strong focus on security. What measures can be taken to prevent those who work on the application (programmers, DBAs, quality assurance staff) from capturing ...