For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

0
votes
1answer
7 views

Secure authentication using JWT

I read about JWT and how they can provide secure authentication for calling api routes over http. I naively implemented it and here is how it goes : a client posts username and password to a login ...
3
votes
1answer
67 views

PHI, NoSQL, and searching

I am working with a system that is using NoSQL (Azure Table Storage) primarily to house its data. Unfortunately, the work also involves billing and medical records - meaning the data itself will need ...
7
votes
1answer
5k views

API Authentication, One time token VS Dynamic tokens

We are working on a new project, we are two lead developers and got on a crossroad on how to use a token to secure the communication between the server and the client. First Suggestion: (The one time ...
0
votes
2answers
69 views

Is providing a user login a functional requirement of a system?

Is providing a user login a non functional requirement? Since this is concerned with security which is a non functional requirement, I feel that providing a user login is also non functional but ...
0
votes
1answer
60 views

Question on password hashing security

I'm about to add some user account and password functionality to my software, so I'm reading about password hashing. So my understanding is Hashing is a one way function, and it works like this: ...
2
votes
0answers
35 views
+50

Windows Phone 8.1 & above - is there some equivalent for Apple's keychain

I want to store store some app specific secret on the phone - this should be available only for the app & no other app. I was looking at DPAPI - however, if the user does not have a logon ...
2
votes
2answers
524 views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
0
votes
0answers
20 views

WCF security with Java client

I'm about to develop a WCF service which is going to be called by an external Java client. I've developed a couple of services before but they were called internally, so security is now a concern. ...
0
votes
0answers
14 views

Alternatives to a generic authentication to access an admin dashboard without session management

On my private homepage I am hosting some pages and corresponding files for some courses where my students can download material for the classes. Furthermore I am publishing news where I write about ...
9
votes
3answers
2k views

REST API security Stored token vs JWT vs OAuth

I am still trying to find the best security solution for protecting REST API, because the amount of mobile applications and API is increasing every day. I have tried different ways of ...
5
votes
2answers
228 views

Having an discussion about security concerns with another software engineer [closed]

Background: The company I work for uses different systems to hold their insurance data which is customer related. They want to have an app for their customers where they can find their insurance ...
14
votes
4answers
2k views

How to securely implement auto-login

I've read many, many, many posts on how "you're probably storing passwords wrong". They are always referring to storing passwords on a server into which a user is logging; they basically rehash (pun ...
0
votes
1answer
41 views

Postgres roles for website users

I am setting up a PostgreSQL database with a very small number of tables for a simple website. I am looking at ways to make it as solid and auditable as possible. Is there any particular reason why ...
0
votes
1answer
195 views

Security aspects of an ASP.NET that can be pointed out to the client

I need to write several passages of text in an offer to the client about the security layer in ASP.NET MVC web solution. I am aware of security that comes along with MVC 3 and an improvements in MVC ...
3
votes
0answers
29 views

Client Browser, Node Server, Web API auth structure

I have a web API that accepts Authorization headers to allow access. It responds with the requested data in addition to setting a session cookie. Subsequent requests can be made with no auth headers ...
2
votes
2answers
184 views

How to let users share custom code content under the mobile app store restrictions?

Situation Mobile application store owners are known to explicitly forbid some application extensibility scenarios. Apple: 2.7 Apps that download code in any way or form will be rejected 2.8 ...
1
vote
0answers
22 views

Correlating Search Classifiers in a Database Scan for Sensitive Information

Problem Description I am working on an enterprise data discovery project that is designed to scan databases for sensitive information. The basic search unit is called a classifier and covers things ...
0
votes
1answer
75 views

Strategy for Public / Private API, Encrypted (or Hashed) Data, and Server Compromise

In this very simplistic but realistic scenario, I have 2 combo web/database servers (A) behind a load balancer and a single IP address. They also permit access only from one IP address -- the client ...
1
vote
1answer
1k views

Performing user authentication in a CodeIgniter controller constructor?

In "The Clean Code Talks -- Unit Testing", Miško Hevery mentions that "as little work as possible should be done in constructors [to make classes more easily testable]'. It got me thinking about the ...
8
votes
4answers
2k views

What are the security risks/vulnerabilities every C programmer must be aware of? [closed]

There are many security risks coming from having close contact to the hardware as opposed to using well-tested and proved APIs from high level programming languages. It is much easier to cause a ...
2
votes
2answers
87 views

ASP.NET storing encrypted & salted Password

I have a question about storing encrypted passwords in your database to help secure them. I have a class that encrypts the password passed in and returns a string. This string has 3 parts too it, all ...
3
votes
1answer
92 views

How to be sure that a certain code does not call interrupts?

Imagine that you have an object code file from an untrusted source. You want to run this code to know the result of its computation, and you want the code to perform fast, so setting up a whole ...
6
votes
2answers
3k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...
3
votes
1answer
121 views

How do large corporations store API keys?

When FaceBook or Google give me an API key, are they just storing it in a database? Unlike a password, where you can hash and salt it before putting it in the database, it seems to me that a key ...
-2
votes
2answers
89 views

Tables vs. Booleans: Which of the two are more secure for setting admin roles in an app? [closed]

I'm currently in the process of setting up roles where there are regular users, admins, and super admins, each of which have special permissions. I deferred to this post on how to do so. It ...
2
votes
2answers
46 views

Customer Authentication in a website

Just to be clear, by authentication I don't mean user-authentication, but I want to make sure that my app is running on the customer's server and in a defined time-span. Some of our customers use our ...
3
votes
1answer
112 views

Using SMS as transaction in offline situations

Currently, I have this hybrid mobile application which talks to my C# web service to do CRUD transactions. As the mobile application is always on the go, and there might not have internet connectivity ...
0
votes
1answer
67 views

Access rights through database table

I made a login system with access rights (ASP.NET WebForm) and I store the info's in a database table. I don't use the built in feature of asp.net like Forms authentication and webconfig. My question ...
11
votes
2answers
1k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a ...
-4
votes
1answer
22 views

Protect settings on rooted device [closed]

I have an app and it stores data in shared preferences which can be easily changed using something like root explorer. So, how can I keep settings and be sure that user won't be able to edit them even ...
1
vote
3answers
276 views

Javascript Password Security [closed]

I am having difficulty with the answer provided here, but I couldn't understand how to implement it. My code is pretty much identical: <script language="javascript"> function check(form) { ...
32
votes
6answers
4k views

What is a good security practice for storing a critical database on developer's laptops?

We have a few givens: Developers need a replica of the production database on their machines. Developers have the password to said database in the App.config files. We don't want the data in ...
3
votes
4answers
2k views

why control + alt + delete couldn't be intercepted by any application

The secure attention key is designed to make login spoofing impossible, as the kernel will suspend any program, including those masquerading as the computer's login process, before starting a ...
1
vote
2answers
81 views

Architecture supporting digitally signing of tons of soap requests [closed]

What is the optimal architecture for such case: Web application(.Net Web Forms) connects to third party web service via wcf. Third party web service accepts only digitally signed soap requests Some ...
2
votes
2answers
109 views

Where should you store/how should you control access to application secrets?

There are these relevant questions questions: Strategy for keeping secret info such as API keys out of source control? How do you deal with configuration files in source control? How to version ...
0
votes
3answers
137 views

Making internal search engine return results that adhere to local permissions on an internal web application

I have an ElasticSearch search engine and an internal web application. Prior to applying the security model, search results were very fast. The security model restricts some users from accessing ...
-3
votes
1answer
77 views

Manage lock of a software feature [closed]

I've wrote a standalone java SE software which executes, for example, the features A, B and C. Now, i want to that, if a lock is enabled (and this lock is a command sent remotely by my backend), the ...
1
vote
1answer
50 views

Is opening a templating engine to users a bad idea?

My site allows users to create custom HTML templates for their profiles (very much like Tumblr and the theme system), and I picked the Twig template engine for the site. However, I'm not sure if ...
16
votes
4answers
6k views

Predicting the output of PHP's rand()

I've read in numerous sources that the output of PHP's rand() is predictable as its a PRNG, and I mostly accept that as fact simply because I've seen it in so many places. I'm interested in a ...
3
votes
1answer
893 views

Security Risks of Unsigned ClickOnce Manifests

Using signed manifests in ClickOnce deployments, it is not possible to modify files after the deployment package has been published - installation will fail as hash information in the manifest won't ...
0
votes
0answers
32 views

Web service security token storage

I have two operations in my JAX-WS web service: First takes username and password as parameters and generates random alphanumeric token, second takes this token and username as parameters, verifies ...
0
votes
0answers
25 views

Client application and secure data exchange without ssl/tls

I have my own home server and port 80/443 is blocked from my ISP provider. I want to create a Qt gui application that saves my data on my server using REST (using port 8080 or something) using ...
1
vote
0answers
63 views

Generate a fixed length number hash from a number

Let say I've a fixed length number, e.g. 6 digit: 837493, I want to apply some process (with a salt), and generate a new number of another 6 digits, e.g. number = 837493 another = hash(number + ...
14
votes
2answers
733 views

Should UDP data payloads include a CRC?

For a company I used to work for, I had to implement a socket receiver that mostly took data in UDP form over a local connection from some specialized sensor hardware. The data in question was a ...
0
votes
1answer
138 views

Algorithm to maintain a blog sign up page

I have a functional sign up page for a blog that updates a database with a users name, email, profile picture and a short bio. The General information page and the profile picture upload/bio page are ...
0
votes
0answers
46 views

Client blocks fonts in browser => font-awesome is not being displayed

I am working on a web platform for which we have different clients. In this platform we make a strong use of font-awesome. I have always thought this was a safe and elegant choice with which I had ...
2
votes
2answers
122 views

Making a security on webapi for browser usage [closed]

I have a webapi project working in production for few months now. The entire webapi is server to server. There is a need now to have the same functionality in a browser, meaning the customers ...
1
vote
0answers
40 views

'HMAC style' design example for a shared secret

I'm looking to secure an API based on a shared key and a given username and datetime. The API gives access to trusted third parties and does not require the input from a user in order to access their ...
-1
votes
2answers
162 views

Do people modify open source code to hack? [duplicate]

I am trying to create an authentication client and server for my project, and I am trying to think of ways on how a potential hacker could modify my code and use it to hack the servers. Do people ...
2
votes
1answer
41 views

Identity propagation using Azure service bus

We currently have a platform with a SOA architecture in which the user's identity is propagated from the web application via middle tier services (REST and SOAP) until we actually query our data ...