For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

2
votes
3answers
127 views

Data from devices with unreliable clocks

Are there any viable approaches to dealing with data coming from devices with unreliable clocks? We have a database system running on a central server. The latest addition to the system is a bunch of ...
5
votes
3answers
8k views

How to open a desktop application through browser without a Java applet?

We run a cloud-based medical software, and a very important part of the program is bridging to an imaging software straight from our website, passing information through command line arguments. We ...
-1
votes
0answers
30 views

Principles for secure user login/authentication [on hold]

Backstory: In my from-scratch PHP/MySQL web development projects, I often start (and end) working on a secure user authentication. I'm self-taught and never certain that my site is adequately ...
1
vote
1answer
47 views

How to implement a secure way to allow users to reset password via url?

Password reset option should be given only if the link has come from that specific user's inbox and not from somewhere else. How to implement url in such a way that the required information i.e. ...
3
votes
1answer
273 views

Building dedicated codepad in PHP

I am author of growing framework, which is focused around User Interface building in PHP. Essential requirements for the up-coming website redesign is ability to run code examples. I am willing to ...
-3
votes
0answers
24 views

Does DropBear support ssh key revocation?

I m using Dropbear as a server of ssh in my embedded system. I want to know if DropBear support ssh key revocation? if yes how How I can do it? https://en.wikipedia.org/wiki/Revocation_list
2
votes
2answers
857 views

multi-language system and security with php

I'm coding a new site. İt's like StackExchange, a social site and a blog. I try to create a multi-language site, however I can't decide how to do it. I have to use modules, so I must use OOP, while ...
4
votes
2answers
270 views

How to protect a peer-to-peer network from inappropriate content?

I’m developing a simple peer-to-peer app in .Net which should enable users to share specific content (text and picture files). Inappropriate content can “relatively” easily be identified / controlled ...
5
votes
1answer
130 views

Is NuGet vulnerable to this typosquatting attack?

A recently-published article demonstrates a way to make "typo-squatting" attacks on popular programming package managers. It singles out Python's pip, Ruby's gem and Node's npm systems, and shows ...
2
votes
1answer
45 views

JWT refresh token exponentially?

This is how I do my JWT refresh token: A token is check for validity every time a request is made. If it's not expired, allow access. If it's expired calls another function named RefreshToken to ...
2
votes
3answers
96 views

Preventing abuse of a RESTful Web API (can the server trust the remote IP address?)

I'm designing a RESTful API for my organization. We do use password-based authentication, which generates tokens. One part of our API requires that the users be physically in the office, i.e. there is ...
0
votes
1answer
47 views

Hash system to generate same (specified) hash from multiple datasets?

I have a hashed value X and need to ensure that any of the data sets D1...Dn can be concatenated with a correctional value C1...Cn and passed into a hashing algorithm to result in the value of X. ...
19
votes
5answers
9k views

Best practices for execution of untrusted code

I have a project where I need to allow users to run arbitrary, untrusted python code (a bit like this) against my server. I'm fairly new to python and I'd like to avoid making any mistakes that ...
0
votes
1answer
42 views

Extensible web application where users can upload client-side code

I have a simple web application built with Angular which fetches some state from a web server and shows it to the user. Additionally I want to implement a feature where users are able to customize the ...
0
votes
2answers
58 views

Can a website get user details if the site is using facebook account kit to log in?

Is it possible to for a website to get my number and email id if they are using facebook account kit to verify users without facebook accounts.And how to collect the user details accessing this ...
4
votes
3answers
122 views

How to store uploaded client documents securely in webapplication

A small company without any IT skills wants to run a web application where customers can enter various bits of data and upload pdfs. The documents regard product specifications and have to be kept ...
6
votes
3answers
1k views

How to securely implement roles in a Windows Form application?

As an ISV, what is considered best practice for implementing application role based security? In other words, only allow users to access certain features in the application based on what roles they ...
0
votes
0answers
41 views

How do I build a policy in ASP.NET MVC 5 (or 6) with AuthorizationPolicyBuilder that incorporates an IP address?

I have been studying this, https://leastprivilege.com/2015/10/12/the-state-of-security-in-asp-net-5-and-mvc-6-authorization/ and on that page, public class Startup { public void ...
0
votes
0answers
31 views

Are there any JSON based notations for Access Control Lists? (Alternative to S-Expression)

I'm looking for a notation that is familiar to modern developers and can supersede s-Notation. (additional insight into Rivest's proposal of s-Expression is here) Is there any Swagger, JSON or other ...
1
vote
1answer
71 views

What's the proper name for the type of security where we secure resources by ownerrship?

I work on a REST API that mixes two types of security: First you have standard role-based security - so we have multiple roles such as administrator, read-only user, super user user, etc. Then we ...
0
votes
1answer
264 views

How to secure my authentication code?

I'm working a PHP project where I need to authenticate users to a portal. Just wanted to get your opinion on the code, statistics of the website show some strange behaviour with the login form. ...
1
vote
0answers
21 views

From PreAuthentication to JWTAuthorization

I would like to ask about a problem I have designing a security flow. The context I have a webapp designed in two modules web and server Web: it's a single page client, built with Angular 1.5.5 (...
0
votes
3answers
76 views

Preventing information leakage while returning an error message

Say my website contains 2 functions: Allow a user to change their own password Allow an administrator to change a user's password (the user must change again before they login) Now let's say that ...
4
votes
2answers
1k views

Is masking really necessary when sending from Websocket client

The current Websocket RFC requires that websocket clients mask all data within frames when sending (but server is not required to). The reason the protocol was designed this way is to prevent frame ...
1
vote
0answers
23 views

When do I reset Two Factor Authentication secret keys?

I have built a simple authentication system for my web application that makes use of the open-source time-based OTP algorithm (RFC 6238). The key for each user is generated when the user is registered ...
-2
votes
1answer
83 views

In what way does programming help towards cyber security [closed]

I've been studying the cyber security field with great interest. I understand how networking can help cyber security but I am not sure how advanced programming knowledge can help fight cyber crime or ...
7
votes
2answers
150 views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...
0
votes
1answer
63 views

Universal Form Handler

I'm building a API that gets called from web / mobile applications written using Ionic (web languages on mobile), which uses Angular.js. We want to be able to do server side validation of forms but ...
27
votes
7answers
18k views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
0
votes
0answers
48 views

How to deal with it that not all HTTP response headers reach the browser?

Some companies use firewalls that filter unknown HTTP response headers. I've personally witnessed that a page used the default font instead of the chosen external Google font because the firewall was ...
2
votes
0answers
62 views

Technique to passively take down a host on the network [closed]

I am developing a program which is to be installed on a "simple" machine in a LAN, the only particularity is that the NIC are connected on mirror ports. The software can scan and monitor the network. ...
0
votes
0answers
38 views

How to use Integrated authentication for a user other than the logged in user?

I have a Winforms .net app that requires a user to login to our app. I want to use integrated database authentication, but the user logged in to the app may be a different (Windows/Active Directory) ...
2
votes
2answers
184 views

ASP.NET storing encrypted & salted Password

I have a question about storing encrypted passwords in your database to help secure them. I have a class that encrypts the password passed in and returns a string. This string has 3 parts too it, all ...
23
votes
3answers
8k views

REST API security Stored token vs JWT vs OAuth

I am still trying to find the best security solution for protecting REST API, because the amount of mobile applications and API is increasing every day. I have tried different ways of authentication,...
0
votes
0answers
20 views

Where to store authentication/authorization entities with respect to crosscuting concerns?

Can you explain me how and where to store authentication/authorization entities in project structure. For example I have 4 projects in my solution in Visual Studio: SolutionName.WebApp SolutionName....
2
votes
2answers
167 views

Securing my own software… against myself?

I do a lot of programming work for other people's businesses. I am currently working on a project for my local Scouts group that I have worked with before. The problem is I have built them their ...
4
votes
1answer
174 views

Directly query database vs. Using web service

I'm a junior programmer, am working on a WPF application that will deploy to ~50 users. We basically are streamlining all of his charting/tracking of client data. Each user will probably make about ...
1
vote
2answers
106 views

Best ways for startups to handle sensitive user information [closed]

Many companies struggle with even basic sensitive information handling. One screaming example I can give is the attack on TalkTalk's servers resulted as 4 millions customer's personal information ...
1
vote
2answers
52 views

Why can't the Synchronizer Token Pattern be circumvented?

The synchronizer token pattern is the most effective protection against CSRF attacks. I understand the theory and implementation, but I do not understand why it can't be circumvented. Generally, the ...
2
votes
1answer
80 views

How to encrypt communication without hard coding key in client?

I've found description of vulnerability here. The kankun smart socket device and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app....
23
votes
19answers
22k views

Use of pirated/cracked software for development [closed]

Disclaimer: I by no means condone the use of pirated software. Have you ever witnessed the use of pirated software for development purposes? May be a company didn't have enough money to buy a piece ...
0
votes
0answers
324 views

How to protect own software from copying [duplicate]

Possible Duplicate: How do you prevent the piracy of your software? Is possible to protect some file from copying if you are administrator of machine? I heard some story about some behavior: ...
32
votes
20answers
14k views

How do you prevent the piracy of your software? [closed]

Is it still worth it to protect our software against piracy? Are there reasonably effective ways to prevent or at least make piracy difficult?
1
vote
0answers
23 views

Securing an Azure Service Bus topic and subscriptions

We are working on a solution that will publish messages on an Azure Service Bus topic but we don't know yet which other team or even third party might be interested in subscribing to those messages in ...
28
votes
8answers
6k views

Should I spend time preventing piracy of my app? [duplicate]

The title says it all, the more I do research about piracy and the tools used to crack an app the more I think it is just wasted time. My biggest threat is that my app is being cracked and uploaded ...
67
votes
17answers
36k views

How can software be protected from piracy?

Why does it seem so easy to pirate today? It just seems a little hard to believe that with all of our technological advances and the billions of dollars spent on engineering the most unbelievable and ...
-2
votes
2answers
233 views

Protecting application against piracy [closed]

Can I somehow protect a source available (you can see the source, but you don't have rights to use it) application against piracy? Is it even theoretically possible? Not all of the application has to ...
3
votes
3answers
271 views

Modern recommendations for password recovery

I'm going to implements password recovery in my authentication. I haven't put this together in a while and wondering if there is anything I ought to be aware of. My idea at the moment is: User ...
43
votes
14answers
8k views

Is there any reason not to go directly from client-side Javascript to a database?

Possible Duplicate: Writing Web “server less” applications So, let's say I'm going to build a Stack Exchange clone and I decide to use something like CouchDB as my backend store. If I use ...
0
votes
2answers
69 views

Handling delay in entry of OTP for log in validation

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...