For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

5
votes
2answers
61 views

prevent abuse to rest api endpoint

Question 1 I have a login api endpoint http://127.0.0.1:8080/api/account/login it checks if phone number has been validated. If not it'll call POST http://127.0.0.1:8080/api/account/sendsms ...
0
votes
1answer
60 views

Universal Form Handler

I'm building a API that gets called from web / mobile applications written using Ionic (web languages on mobile), which uses Angular.js. We want to be able to do server side validation of forms but ...
0
votes
1answer
121 views

How to secure my authentication code?

I'm working a PHP project where I need to authenticate users to a portal. Just wanted to get your opinion on the code, statistics of the website show some strange behaviour with the login form. ...
23
votes
7answers
15k views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
0
votes
0answers
46 views

How to deal with it that not all HTTP response headers reach the browser?

Some companies use firewalls that filter unknown HTTP response headers. I've personally witnessed that a page used the default font instead of the chosen external Google font because the firewall was ...
2
votes
0answers
61 views

Technique to passively take down a host on the network [closed]

I am developing a program which is to be installed on a "simple" machine in a LAN, the only particularity is that the NIC are connected on mirror ports. The software can scan and monitor the network. ...
-1
votes
0answers
39 views

please help me regarding backward compatibility of java1.8 with security features

I'm upgrading my application to java1.8 - reason is some of our customers have started using 2048 bit encrypted certificate. But I have two concerns , please help me with these queries: For incoming ...
0
votes
0answers
26 views

How to use Integrated authentication for a user other than the logged in user?

I have a Winforms .net app that requires a user to login to our app. I want to use integrated database authentication, but the user logged in to the app may be a different (Windows/Active Directory) ...
2
votes
2answers
150 views

ASP.NET storing encrypted & salted Password

I have a question about storing encrypted passwords in your database to help secure them. I have a class that encrypts the password passed in and returns a string. This string has 3 parts too it, all ...
17
votes
3answers
5k views

REST API security Stored token vs JWT vs OAuth

I am still trying to find the best security solution for protecting REST API, because the amount of mobile applications and API is increasing every day. I have tried different ways of ...
0
votes
0answers
20 views

Where to store authentication/authorization entities with respect to crosscuting concerns?

Can you explain me how and where to store authentication/authorization entities in project structure. For example I have 4 projects in my solution in Visual Studio: SolutionName.WebApp ...
2
votes
2answers
163 views

Securing my own software… against myself?

I do a lot of programming work for other people's businesses. I am currently working on a project for my local Scouts group that I have worked with before. The problem is I have built them their ...
4
votes
1answer
152 views

Directly query database vs. Using web service

I'm a junior programmer, am working on a WPF application that will deploy to ~50 users. We basically are streamlining all of his charting/tracking of client data. Each user will probably make about ...
1
vote
2answers
102 views

Best ways for startups to handle sensitive user information [closed]

Many companies struggle with even basic sensitive information handling. One screaming example I can give is the attack on TalkTalk's servers resulted as 4 millions customer's personal information ...
1
vote
2answers
47 views

Why can't the Synchronizer Token Pattern be circumvented?

The synchronizer token pattern is the most effective protection against CSRF attacks. I understand the theory and implementation, but I do not understand why it can't be circumvented. Generally, the ...
2
votes
1answer
77 views

How to encrypt communication without hard coding key in client?

I've found description of vulnerability here. The kankun smart socket device and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the ...
0
votes
0answers
322 views

How to protect own software from copying [duplicate]

Possible Duplicate: How do you prevent the piracy of your software? Is possible to protect some file from copying if you are administrator of machine? I heard some story about some ...
32
votes
20answers
13k views

How do you prevent the piracy of your software? [closed]

Is it still worth it to protect our software against piracy? Are there reasonably effective ways to prevent or at least make piracy difficult?
1
vote
0answers
15 views

Securing an Azure Service Bus topic and subscriptions

We are working on a solution that will publish messages on an Azure Service Bus topic but we don't know yet which other team or even third party might be interested in subscribing to those messages in ...
28
votes
8answers
6k views

Should I spend time preventing piracy of my app? [duplicate]

The title says it all, the more I do research about piracy and the tools used to crack an app the more I think it is just wasted time. My biggest threat is that my app is being cracked and uploaded ...
66
votes
17answers
35k views

How can software be protected from piracy?

Why does it seem so easy to pirate today? It just seems a little hard to believe that with all of our technological advances and the billions of dollars spent on engineering the most unbelievable and ...
-2
votes
2answers
227 views

Protecting application against piracy [closed]

Can I somehow protect a source available (you can see the source, but you don't have rights to use it) application against piracy? Is it even theoretically possible? Not all of the application has to ...
3
votes
3answers
255 views

Modern recommendations for password recovery

I'm going to implements password recovery in my authentication. I haven't put this together in a while and wondering if there is anything I ought to be aware of. My idea at the moment is: User ...
43
votes
14answers
7k views

Is there any reason not to go directly from client-side Javascript to a database?

Possible Duplicate: Writing Web “server less” applications So, let's say I'm going to build a Stack Exchange clone and I decide to use something like CouchDB as my backend store. If I use ...
0
votes
2answers
47 views

Handling delay in entry of OTP for log in validation

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...
35
votes
5answers
11k views

How easy is it to hack JavaScript (in a browser)?

My question has to do with JavaScript security. Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a ...
3
votes
2answers
61 views

Pem certificate in mobile app

I am developing a cross platform app that can handle payments, the online payment service issued a certificate for my use, thus I have a .pem certificate and within it there is 2 actual certificates ...
0
votes
2answers
31 views

Secure authentication using JWT

I read about JWT and how they can provide secure authentication for calling api routes over http. I naively implemented it and here is how it goes : a client posts username and password to a login ...
3
votes
1answer
74 views

PHI, NoSQL, and searching

I am working with a system that is using NoSQL (Azure Table Storage) primarily to house its data. Unfortunately, the work also involves billing and medical records - meaning the data itself will need ...
8
votes
1answer
6k views

API Authentication, One time token VS Dynamic tokens

We are working on a new project, we are two lead developers and got on a crossroad on how to use a token to secure the communication between the server and the client. First Suggestion: (The one time ...
0
votes
2answers
103 views

Is providing a user login a functional requirement of a system?

Is providing a user login a non functional requirement? Since this is concerned with security which is a non functional requirement, I feel that providing a user login is also non functional but ...
0
votes
1answer
71 views

Question on password hashing security

I'm about to add some user account and password functionality to my software, so I'm reading about password hashing. So my understanding is Hashing is a one way function, and it works like this: ...
2
votes
0answers
52 views

Windows Phone 8.1 & above - is there some equivalent for Apple's keychain

I want to store store some app specific secret on the phone - this should be available only for the app & no other app. I was looking at DPAPI - however, if the user does not have a logon ...
3
votes
2answers
793 views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
0
votes
0answers
39 views

WCF security with Java client

I'm about to develop a WCF service which is going to be called by an external Java client. I've developed a couple of services before but they were called internally, so security is now a concern. ...
4
votes
2answers
235 views

Having an discussion about security concerns with another software engineer [closed]

Background: The company I work for uses different systems to hold their insurance data which is customer related. They want to have an app for their customers where they can find their insurance ...
14
votes
4answers
2k views

How to securely implement auto-login

I've read many, many, many posts on how "you're probably storing passwords wrong". They are always referring to storing passwords on a server into which a user is logging; they basically rehash (pun ...
0
votes
1answer
61 views

Postgres roles for website users

I am setting up a PostgreSQL database with a very small number of tables for a simple website. I am looking at ways to make it as solid and auditable as possible. Is there any particular reason why ...
0
votes
1answer
199 views

Security aspects of an ASP.NET that can be pointed out to the client

I need to write several passages of text in an offer to the client about the security layer in ASP.NET MVC web solution. I am aware of security that comes along with MVC 3 and an improvements in MVC ...
2
votes
0answers
43 views

Client Browser, Node Server, Web API auth structure

I have a web API that accepts Authorization headers to allow access. It responds with the requested data in addition to setting a session cookie. Subsequent requests can be made with no auth headers ...
2
votes
2answers
226 views

How to let users share custom code content under the mobile app store restrictions?

Situation Mobile application store owners are known to explicitly forbid some application extensibility scenarios. Apple: 2.7 Apps that download code in any way or form will be rejected 2.8 ...
1
vote
0answers
26 views

Correlating Search Classifiers in a Database Scan for Sensitive Information

Problem Description I am working on an enterprise data discovery project that is designed to scan databases for sensitive information. The basic search unit is called a classifier and covers things ...
0
votes
1answer
96 views

Strategy for Public / Private API, Encrypted (or Hashed) Data, and Server Compromise

In this very simplistic but realistic scenario, I have 2 combo web/database servers (A) behind a load balancer and a single IP address. They also permit access only from one IP address -- the client ...
1
vote
1answer
1k views

Performing user authentication in a CodeIgniter controller constructor?

In "The Clean Code Talks -- Unit Testing", Miško Hevery mentions that "as little work as possible should be done in constructors [to make classes more easily testable]'. It got me thinking about the ...
8
votes
4answers
3k views

What are the security risks/vulnerabilities every C programmer must be aware of? [closed]

There are many security risks coming from having close contact to the hardware as opposed to using well-tested and proved APIs from high level programming languages. It is much easier to cause a ...
3
votes
1answer
94 views

How to be sure that a certain code does not call interrupts?

Imagine that you have an object code file from an untrusted source. You want to run this code to know the result of its computation, and you want the code to perform fast, so setting up a whole ...
7
votes
2answers
4k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...
3
votes
1answer
126 views

How do large corporations store API keys?

When FaceBook or Google give me an API key, are they just storing it in a database? Unlike a password, where you can hash and salt it before putting it in the database, it seems to me that a key ...
-2
votes
2answers
95 views

Tables vs. Booleans: Which of the two are more secure for setting admin roles in an app? [closed]

I'm currently in the process of setting up roles where there are regular users, admins, and super admins, each of which have special permissions. I deferred to this post on how to do so. It ...
2
votes
2answers
46 views

Customer Authentication in a website

Just to be clear, by authentication I don't mean user-authentication, but I want to make sure that my app is running on the customer's server and in a defined time-span. Some of our customers use our ...