For questions relating to cryptography and computer security.
2
votes
5answers
381 views
Hiring Developers - Securing Source Code
I have a popular web-based app, and now suddenly my main developer has disappeared. Although I've found other great developers but I don't want to distribute the source code to everyone. Is there any ...
5
votes
7answers
298 views
How does one securely and privately address security concerns inside code
I recently finished a practicum for which I desperately need a recommendation from. However when I was working on the code for the public face web-portal I noticed many sql injection possibilities ...
6
votes
3answers
237 views
Possible hack aftermath
After being hacked companies often give numbers and details on how much of their data was compromised e.g "13K user and passwords".
After a possible intrusion how do you know what the hacker did in ...
3
votes
3answers
278 views
How would I go about changing encryption methods on existing passwords?
If I have an application that is using a less secure method for storing passwords, such as SHA-1, how would I go about converting to SHA-256 or SHA-512?
3
votes
4answers
182 views
How do I let customers run arbitrary code as securely as possible?
I'd like to offer a service where customers can write arbitrary java code, send it to me, and I'll run it for them on Amazon EC2. My question is: how can I do this without exposing one customer's ...
2
votes
2answers
71 views
Is there a secure way to add a database troubleshooting page to an application?
My team makes a product (business management software) that our customers install on their own servers. The product uses a SQL database for data storage and app configuration.
There have been quite a ...
31
votes
9answers
1k views
Are there any valid reasons for disallowing characters and limiting the length of passwords?
I've come across quite a few sites that either limit the length they allow passwords to be and/or disallow certain characters. That's limiting to me as I want to widen and lengthen the search space of ...
4
votes
4answers
286 views
Develop secureness first or as a later step?
The question Do you actively think about security when coding? asks about security mindset while programming.
Obviously, a developer does need to think about security while coding — SQL ...
2
votes
1answer
318 views
Web security course?
I'd like to do a course about web security. I've seen some certifications that could be interesting:
CIW Web Security Professional
CISSP® - Certified Information
Systems Security Professional
...
7
votes
4answers
319 views
How do you go about checking your open source libraries for keystroke loggers?
A random person on the internet told me that a technology was secure(1), safe to use and didn't contain keyloggers because it is open source. While I can trivially detect the key stroke logger in ...
2
votes
1answer
213 views
Amazon Cloud (EC2) w/SQL Server. Pay for SQL instance, or use an AMI w/SQL Server Express?
I have been considering using the Amazon cloud (EC2) for a small workflow application. In terms of power and storage, a SQL Server Express database will more than meet my needs. I have been cautioned ...
8
votes
7answers
742 views
What special considerations are needed when designing databases to hold financial records?
I hope this question isn't too broad. In the future I may need to add some accounting and financial-tracking systems to some applications (mostly web-based applications, but my questions pertains to ...
2
votes
4answers
486 views
Advice on making sure e-commerce site is secure using PHP and MySQL
Like the title says, I would like some advice from knowledgable web developers on figuring out security issues for my e-commerce site.
I am designing the database as well as the code that ...
1
vote
1answer
1k views
Permissions/right model/pattern for .NET application
I need to implement flexible AND simple (if such thing exist) and at the same time utilize built-on means if possible
So far I have MembershipProvider and RoleProviders implemented. This is cool but ...
0
votes
2answers
169 views
Assigning a local id to a user
I am creating a soap service where users will be able to interact with each other.
They will have a contact list where people can be added.
One of the security measures(others are in place, too) is to ...
3
votes
1answer
469 views
Best practices for expiration of tokens in a Security Token Service (STS)
When creating a Security Token Service (STS) for a claims based security model, it seems appropriate that tokens are generated in such a way that they expire after some duration, as suggested here.
...
20
votes
3answers
1k views
Should MVC/REST return a 403 or 404 for resources belonging to other users?
When working with a resource-based site (such as an MVC application or REST service), we have two main options when a client tries to GET a resource that they don't have access to:
403, which says ...
12
votes
6answers
1k views
How does a large company make rookie mistakes which leave security holes? [closed]
Sony was recently hacked with a SQL injection and the passwords of their user's was stored in plain text. These are rookie mistakes. In such a large company, how does this pass QA? How do they not ...
6
votes
3answers
406 views
Converting a 1,000,000 rows database
If I have a database that stores the login credentials of 1,000,000 users in PLAINTEXT, how much effort will it take me to md5 hash these passwords?
17
votes
5answers
2k views
Data input validation - Where? How much?
Data input validation always was quite an internal struggle to me.
On the verge of adding a real security framework and code to our legacy application rewrite project (which so far pretty much keeps ...
2
votes
3answers
324 views
Security for data produced by ASP.NET web serivce
I'm developing an ASP.NET 2.0 web service that serves XML data from a database. Almost all data traffic is one-way, from server to client, and there is no user-specific data. All clients will ...
13
votes
5answers
611 views
Should you ever release something that you yourself could hack?
Being the creator of a program, you are probably in a better position than anyone to be aware of security vulnerabilities and potential hacks. If you know of a vulnerability in a system you wrote, is ...
1
vote
2answers
610 views
Are sessions secure for captcha on failed login?
I don't like writing open-ended questions but I have a quick security question. I have a PHP login script that shows a CAPTCHA on the third failed login attempts. The way I'm counting failed logins is ...
12
votes
6answers
534 views
Discovered large security hole in someone elses website… What to do?
A chap I'm bidding to do some development for has a social network he wrote himself.
Not the next facebook by any stretch. But a few thousand local users.
I went to have a look at it to see what ...
2
votes
2answers
618 views
How you handle security/permission in enterprise app nowadays (mid 2011)?
what you people use to handle security issues, different security rules, permissions etc.
Possible answers:
1) Security framework like Rhino security or any other. (pros/cons?)
2) Custom solution ...
5
votes
3answers
710 views
Is blocking java applets a necessary security measure?
Chrome 11 is now asking user permission to run both signed and unsigned Applets (yes, for signed applets the user is asked twice). Chromium team decided that this measure is needed even when the user ...
7
votes
5answers
4k views
Best practices for web application Authentication/Security (Any Platform)
I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many ...
1
vote
4answers
193 views
How to handle the problem of modified encrypted files
I have a simple encryption/decryption application that I am testing to learn more about security. I found out that if the user modifies the encrypted file, then decryption fails because the hashing ...
3
votes
5answers
315 views
Is it possible to insert the hash of an executable into the executable itself without changing the resulting hash? What's the best alternative?
I've been thinking about this problem recently and it really doesn't seem like it's possible, but I figured that I'd ask just in case.
Assume a simple program, in pseudocode:
run hash on an ...
15
votes
9answers
6k views
Why almost no webpages hash passwords in the client before submitting (and hashing them again on the server), as to “protect” against password reuse?
Relevant XKCD
There are many sites on the Internet that require login information, and the only way to protect against password reusing is the "promise" that the passwords are hashed on the server, ...
14
votes
3answers
2k views
Predicting the output of PHP's rand()
I've read in numerous sources that the output of PHP's rand() is predictable as its a PRNG, and I mostly accept that as fact simply because I've seen it in so many places.
I'm interested in a ...
4
votes
2answers
203 views
Is there any risk of web browsers spying away localhost applications on an Internet-connected PC?
Despite what it might look like this is a serious question. After that story with Android OS and Chrome browser submitting to Google the details of the WiFi access points they see in the neighborhood ...
2
votes
2answers
498 views
which input sanitization function is better?
apparently, some of our websites have been hacked by a hack bot. The reason: bad input sanitzation. Our boss is giving us this file to put on all our servers to secure them: ...
2
votes
2answers
488 views
multi-language system and security with php
Firstly sorry for my English.
I'm coding new site. İt's like StackExchange, a social site and a blog. Whatever, I try to create multilanguage, however I can't decide how to do it.
I have to use ...
9
votes
7answers
5k views
How secure is localstorage?
The question says it all really. I want to provide a service but I do not want to store any of the data myself in a database. With all the recent news of hacking etc it seems to me that it is nicer ...
26
votes
14answers
951 views
What if the client needs the ability to retrieve passwords?
I've currently inherited an application at work and to my dismay, I have realized that the user passwords stored in the database are encrypted using an in house encryption function, which also ...
15
votes
5answers
3k views
What best practices should be employed in a PHP login script?
I am wanting to re-write my login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. Password protected control panels are in their ...
2
votes
1answer
230 views
Dive into Field of Information Security?
For a fresh graduate with quite a bit of development (mainly web) background - what is the easiest way to break into the security field?
Are certifications a necessity? Is it possible to get intern ...
3
votes
3answers
2k views
Why is Google blocking users from accessing their local file system in Chromium? [closed]
The question is based on this issue in Chromium. It is marked as Won't Fix.
Do you see any reason to block a local html file from accessing another local html file located in the same folder?
3
votes
3answers
137 views
What parts of my configuration and my code should I not post?
When people post code on forums they tend to change or blur out parts of their code. Probably because they want to protect certain parts that might be exploited if it ends up in the wrong hands, I ...
9
votes
4answers
284 views
Could developers learn anything from studying malware?
Malware uses interesting techniques for hiding themselves from anti-malware software and more. They can "polymorph" themselves: practically change the code while it continuing to mean pretty much the ...
5
votes
3answers
376 views
What are the security risks/vulnerabilities every C programmer must be aware of?
There are many security risks coming from having close contact to the hardware as opposed to using well-tested and proved APIs from high level programming languages. It is much easier to cause a ...
18
votes
11answers
1k views
Source code stolen\hacked by rival company
On some companies I've worked for, managers have spent quite a lot of money on it-security consultants. Primarily because they're afraid we're gonna get the source code stolen by a rival company.
...
0
votes
1answer
143 views
Legal Requirements for Software Makers
Since the Legal site of Stack Exchange isn't ready quite yet, I figured this would be the best place to ask this question.
What are, if any, the legal requirements (or online resources for finding ...
0
votes
10answers
398 views
Should I provide some way to disable my software post-delivery?
I'm debating the value of putting remote disable (or destruct) functions into my software before delivering it to clients...
As a hypothetical example, consider the development of a Silverlight app ...
3
votes
4answers
360 views
How viable is a PhD in software security research?
I am planning to do a Ph.D in software security. My school is giving a full scholarship for "Detecting security vulnerabilities from source code and binary code" project.
Is is worth taking it? I ...
5
votes
1answer
529 views
Is there an official standard regarding user password storage practices?
I recently used a government service that I had an account for from years ago. I couldn't remember my password for the service so I used the "forgot password" link and was astonished to see that this ...
3
votes
4answers
1k views
Storing credit card information: Looking for a creative solution
I recently found the need to do recurrent billing. I am extremely averse to storing people's credit card information and I refuse to take risks in that area.
I am stuck between a rock and a hard ...
0
votes
2answers
279 views
What is the best way to have security auditing done?
I have an authentication system(ASP.Net library) that I want to make sure is secure. What companies/resources can I use to make sure of this? Also, what should I make sure to do before sending it off ...
3
votes
1answer
2k views
How to generate nonce for Ajax web requests
As many of you know WordPress uses "secret key" like thing for every AJAX request. Making each request unique and also 'somewhat' secure (just a step ahead than nothing). How would I implement the ...
