For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

0
votes
2answers
50 views

What is the value of encoders with decoders currently present

Can you tell me the value of using PHP encoder (ioncube, phpshield) with currently present service like decry.pt (http://www.decry.pt/) that can easily decode source codes. I have tried decry.pt's ...
0
votes
0answers
5 views

Do VPNs really mask your identity or is it a facade? [migrated]

Disclaimer: This is NOT intended to educate myself or others on carrying out illegal activities. Someone always gets butt hurt when you ask borderline questions. So please save the flames. I am ...
1
vote
1answer
87 views

What is a simple, correct and secure way of executing code stored in database?, that is also sandboxed

Webhooks can be a very powerful thing when you try to automate or integrate software, however, handling their deployment in a controlled environment can suck in terms of security and deployment alone. ...
0
votes
1answer
33 views

Securing service calls

I have a ServiceCallContext object that must be passed in as the first parameter of any service call. I would like to put a User object on the context object but I know I can't force the caller to ...
1
vote
2answers
83 views

How much should I concern myself with hiding the IDs of my database in URLs?

I keep coming across questions and articles on the internet suggesting that it's not a good practice to have the IDs of your database records visible to the public. Yet I've never taken it seriously ...
1
vote
1answer
158 views

How to securely store user credentials from external website

I'm developing an application where I'd like to use credentials from external websites. This will be used to login with the website API and get information for the user. Example: I want to use the ...
1
vote
1answer
104 views

Resetting vs. re-sending forgotten passwords

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
0
votes
1answer
36 views

API authentication with a single ID

A typical API authentication usually rely on a pair of API ID + SECRET, my question is: if the API ID is unique and randomly generated and is considered strong enough (e.g. SHA512), why a SECRET is ...
7
votes
3answers
1k views

How to separate sensitive data in database(MySql)

I need to design a database that will contains information about personal disease of users. What can be the approach in order to implement the columns of the DB's tables: encrypt the information, ...
19
votes
5answers
7k views

What best practices should be employed in a PHP login script?

I am wanting to re-write my login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. Password protected control panels are in their ...
2
votes
1answer
41 views

What's the best practise for storing web server credentials for your web app deployment?

I was looking at the Oracle documentation for the weblogic maven plugin. In it, they store the weblogic user name and password for accessing in the pom.xml. Just wondering, isn't this a terrible ...
-1
votes
0answers
13 views

Choosing security scenario for WCF service/client hosted by IIS

in my case I have web server (hosted by IIS) in DMZ hosts multiple web services (WCF), the clients are non-server application (they are standalone .NET application) reaching these web services via ...
0
votes
2answers
76 views

How to protect controller endpoint from abuse?

I am building a web app that will first validate a promotion code via AJAX call and then if it is valid, allow the user to fill out the rest of the form, I use KnockoutJS to reveal and hide the ...
31
votes
14answers
1k views

Is it ethical to teach teens about software viruses? [closed]

I volunteered to instruct an after school computer club at my son's middle school. There has been a lot of interest in computer viruses. I was thinking about showing them how to create a simple batch ...
36
votes
9answers
2k views

Looking for meaningful, strong argument in favor of antivirus software on development machines [closed]

When forming opinions, it is a good practice to follow scholastic tradition - think as hard as you can against the opinion you hold and try to find counter-arguments. However, no matter how hard I ...
1
vote
2answers
575 views

Should EICAR be updated to test the revision of Antivirus system?

I'm posting this here since programmers write viruses, and AV software. They also have the best knowledge of heuristics and how AV systems work (cloaking etc). The EICAR test file was used to ...
2
votes
3answers
125 views

Where to store hashes, salts, keys in Desktop Applications

I am trying to figure out where or how i should store application secrets and keys inside a desktop application. For example a facebook app key or dropbox key and secret. So I've read that i should ...
15
votes
9answers
2k views

Can you “stop” a C program from being reverse engineered? [duplicate]

I'm sure that many of the middle to high level languages can be reverse engineered. But if a C program can be reverse-engineered, and turned back into editable source code, how do I discourage such a ...
3
votes
1answer
87 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
16
votes
4answers
4k views

Predicting the output of PHP's rand()

I've read in numerous sources that the output of PHP's rand() is predictable as its a PRNG, and I mostly accept that as fact simply because I've seen it in so many places. I'm interested in a ...
1
vote
2answers
349 views

How to prevent people from playing with your website? [closed]

I have designed my first website recently. I created my own blog like thing in PHP. I write articles and below the articles there is a place to add comments. Sometimes I get random comments something ...
3
votes
3answers
241 views

How to open a desktop application through browser without a Java applet?

We run a cloud-based medical software, and a very important part of the program is bridging to an imaging software straight from our website, passing information through command line arguments. We ...
-1
votes
1answer
65 views

JSON Web Token & RESTful Web Service - How to securely store the Secret Key?

I was building a RESTful Web Service when I came across JSON Web Tokens as an alternative to traditional cookies for authentication. The concept core of this method is that the server is the only ...
8
votes
9answers
2k views

What is a reasonable and secure password requirement for user registration?

This is the password policy I just got from UPS (just for package status checking): Your password must be between 8 and 26 characters long. It must contain at least three of the following ...
3
votes
1answer
76 views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...
5
votes
3answers
175 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
0
votes
0answers
33 views

Implement taxometer paywall

I need to add a paywall to my site. According to this article, I want to implement a taxometer system. The easiest and least secure way would be tracking the number of viewed articles using secure ...
-1
votes
1answer
158 views

How can I make sure that people changes his IP or not

I want to check that people who registrates in my site and check in country box , for example, Argentina is really living in Argentina. How can I make sure that people is really living in that country ...
1
vote
3answers
257 views

How do I dissuade users from using the same password with similar systems?

I'm building a web application that connects to other web services (using strictly anonymous binding, so no user passwords are being used). However the web application maintains its own users itself, ...
1
vote
3answers
1k views

Entire webpage obfuscation

I want to obfuscate all the webpages of my website. I Googled through some free tools like HTML and Javascript obfuscation but don't know how effective they are. First of all, does it makes sense to ...
1
vote
1answer
40 views

Securing a Web Api for individual Users

We currently have a web app (.net MVC 5), user's login using their username and password and then we store an encrypted value in a cookie to authenticate them on future requests. We are now in the ...
15
votes
6answers
668 views

Discovered large security hole in someone elses website… What to do? [duplicate]

A chap I'm bidding to do some development for has a social network he wrote himself. Not the next facebook by any stretch. But a few thousand local users. I went to have a look at it to see what ...
0
votes
2answers
77 views

Secure Rest api from authenticated user

Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call: @Post /increasePoints host:https://www.example.com/increasePoints ...
5
votes
1answer
78 views

Safest way to use and store User's third party credentials

I'm working on an add-in that will integrate git into the VBA IDE. I'm using the LibGit2Sharp library under the hood, which supports User name and password credentials, but not SSH Keys. I would use ...
3
votes
3answers
82 views

Secure DAL Design using Stored Procedures

I normally avoid sProcs as much as possible. I dont like the language be it TSQL or PL/SQL; they seem archaic against Java/Dot-Net which I use. I go for them when a routine needs to fetch a lot of ...
0
votes
1answer
50 views

How Do I Securely Edit a Database Entry Based On ID in an Admin System?

This is more of a conceptual question because the way that I am doing it would be secure enough for my purposes (educational). I created a simple admin panel that displays a stock picks database as ...
-1
votes
1answer
99 views

Can someone please explain reverse look up tables? [closed]

Im finding it difficult to understand reverse look up tables and how it works, and the concept of hash chains. This is apart of a computer security model i am taking. So i understand that brute force, ...
0
votes
0answers
15 views

Should I use OAUTH 'scopes' to provide access to specific resources?

I am researching & and learning about OAUTH, so please forgive me if this is a very stupid question.. It seems that scopes are typically used to define actions that I can take on behalf of a ...
0
votes
1answer
65 views

Personal Digital Signatures in Web Applications [closed]

In order to sign data with personal digital signature in a web application, server side languages like PHP can do the whole job, but that would require that the user uploads his private key, lets say ...
0
votes
2answers
106 views

Security scheme that prevents duplicate message attacks

I am using custom security scheme to verify communication between client and server. Both client and server have same secret hash phrase. Client builds a message, combines it with hash phrase and ...
3
votes
1answer
52 views

Web application security: Need a 2 phase check?

(Is this the best forum for this type of question?) I'm writing a web application which allows approved users to login, and perform various tasks, depending on the security role(s) they have been ...
9
votes
3answers
1k views

How did desktop applications communicate with remote server before webservices?

I don't have lot of expierence with desktop applications, but if I had to create a client server desktop app, the data access would be done through a webservice. I believe data access through a ...
1
vote
2answers
163 views

Is setting “permanent” persistent login cookies a bad practice?

I realized that in Rails there is a built in permanent method for its persistent login cookies (aka. "remember me" cookies) method to give the client a cookie that expires in 20 years: ...
0
votes
1answer
160 views

Program to look at the first say 5 characters of a word and return a string if that string is actually the first 5 characters of a word?

For example, say I have a string and it has the letters: RDNAL This is not an actual English word or it doesn't start an actual english word, so the program would skip this string and would avoid ...
10
votes
2answers
567 views

How can I prevent programmers from capturing data entered by users?

I'm developing a web application with a strong focus on security. What measures can be taken to prevent those who work on the application (programmers, DBAs, quality assurance staff) from capturing ...
1
vote
2answers
201 views

Hide admin menu if no admin option is available

If you have a menu "Admin tasks" and different admin tasks (like 10) that you could separately assign to each user, but there are users who don't have any admin tasks, how would you deal with "Hiding ...
21
votes
4answers
2k views

Is it worth even checking to see if Guid.NewGuid() is Guid.Empty?

In one of the projects I'm working on the following pattern is seen on a fairly regular basis: var guid = Guid.NewGuid().ToString(); while (guid == Guid.Empty.ToString()) { guid = ...
17
votes
6answers
1k views

What makes a hashing algorithm “secure”?

After reading this interesting question, I felt like I had a good idea of which insecure hashing algorithm I'd use if I needed one, but no idea why I might use a secure algorithm instead. So what is ...
1
vote
1answer
34 views

What's the proper name for type of security where we secure resources by ownerrship

I work on REST API that mixes two types of security: First you have standard role-based security - so we have multiple roles such as admin, read-only user, super user user etc. Then we have also ...
0
votes
2answers
110 views

Should a “secret access code” use the same security as a normal password? [closed]

Obviously, when you store a password, you should use something similar to bcrypt before you store it in in the database. But I have a client who wants to add the ability to add a "secret code" to ...