For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

50
votes
6answers
7k views

Are private, unguessable URLs equivalent to authentication?

I want to expose a resource on the web. I want to protect this resource - make sure it is only accessible to certain individuals. I could set up some kind of authentication. For example, I could only ...
3
votes
0answers
40 views

Right way to spread secret keys between microservices

I have a few services that sign some data with asymmetric cryptography algorithm (like RSA). I need to spread some secret (private) keys between all instances of the service. I've found few ways to ...
28
votes
8answers
19k views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
-5
votes
0answers
26 views

How to secure code of Java web project? [duplicate]

I am working on one application java/jsp application. I want to package this project in a way so that ONLY intended tomcat can decrypt and deploy it ? What are the possible ways to achieve this ?
28
votes
3answers
10k views

REST API security Stored token vs JWT vs OAuth

I am still trying to find the best security solution for protecting REST API, because the amount of mobile applications and API is increasing every day. I have tried different ways of authentication,...
0
votes
0answers
22 views

Seeking advice on accountsecurity in mobile application

I have the idea of developing a lightweight application that provides people playing a specific game (League of Legends) with VOIP. The appplication flow goes like this: User enters lol accountname ...
5
votes
1answer
166 views

Why is it more unsafe to store your password in the URL of a git repo?

As a comment on a response to this question, someone says: It is not advisable to put the password in the URL for this file is saved on the .git/config . Is not safe, it is better to use ssh key ...
0
votes
1answer
29 views

Secure communication between a mobile app and a microcontroller

I have a MCU-based design that essentially controls other hardware and this MCU is controlled through an app. I was hoping someone could help me figure out how to secure this communication between the ...
4
votes
2answers
2k views

Best practice in application design / SQL authentication

I am currently involved in the implementation/design of an existing application for a large scale customer. The application has a similar model as e.g. vCenter Server whereby a number of components ...
2
votes
2answers
61 views

JWT refresh token exponentially?

This is how I do my JWT refresh token: A token is check for validity every time a request is made. If it's not expired, allow access. If it's expired calls another function named RefreshToken to ...
0
votes
0answers
22 views

External User ID to Internal User ID

There is an internal API, REST client over DB, all of which methods require User ID as parameter. User ID is an integer value - numeric PK in User table. Also there is an public API, that is like a ...
2
votes
3answers
140 views

Data from devices with unreliable clocks

Are there any viable approaches to dealing with data coming from devices with unreliable clocks? We have a database system running on a central server. The latest addition to the system is a bunch of ...
5
votes
3answers
9k views

How to open a desktop application through browser without a Java applet?

We run a cloud-based medical software, and a very important part of the program is bridging to an imaging software straight from our website, passing information through command line arguments. We ...
1
vote
1answer
52 views

How to implement a secure way to allow users to reset password via url?

Password reset option should be given only if the link has come from that specific user's inbox and not from somewhere else. How to implement url in such a way that the required information i.e. ...
3
votes
1answer
273 views

Building dedicated codepad in PHP

I am author of growing framework, which is focused around User Interface building in PHP. Essential requirements for the up-coming website redesign is ability to run code examples. I am willing to ...
2
votes
2answers
863 views

multi-language system and security with php

I'm coding a new site. İt's like StackExchange, a social site and a blog. I try to create a multi-language site, however I can't decide how to do it. I have to use modules, so I must use OOP, while ...
4
votes
2answers
271 views

How to protect a peer-to-peer network from inappropriate content?

I’m developing a simple peer-to-peer app in .Net which should enable users to share specific content (text and picture files). Inappropriate content can “relatively” easily be identified / controlled ...
5
votes
1answer
136 views

Is NuGet vulnerable to this typosquatting attack?

A recently-published article demonstrates a way to make "typo-squatting" attacks on popular programming package managers. It singles out Python's pip, Ruby's gem and Node's npm systems, and shows ...
2
votes
3answers
126 views

Preventing abuse of a RESTful Web API (can the server trust the remote IP address?)

I'm designing a RESTful API for my organization. We do use password-based authentication, which generates tokens. One part of our API requires that the users be physically in the office, i.e. there is ...
0
votes
1answer
47 views

Hash system to generate same (specified) hash from multiple datasets?

I have a hashed value X and need to ensure that any of the data sets D1...Dn can be concatenated with a correctional value C1...Cn and passed into a hashing algorithm to result in the value of X. ...
20
votes
5answers
9k views

Best practices for execution of untrusted code

I have a project where I need to allow users to run arbitrary, untrusted python code (a bit like this) against my server. I'm fairly new to python and I'd like to avoid making any mistakes that ...
0
votes
1answer
45 views

Extensible web application where users can upload client-side code

I have a simple web application built with Angular which fetches some state from a web server and shows it to the user. Additionally I want to implement a feature where users are able to customize the ...
0
votes
2answers
58 views

Can a website get user details if the site is using facebook account kit to log in?

Is it possible to for a website to get my number and email id if they are using facebook account kit to verify users without facebook accounts.And how to collect the user details accessing this ...
4
votes
3answers
130 views

How to store uploaded client documents securely in webapplication

A small company without any IT skills wants to run a web application where customers can enter various bits of data and upload pdfs. The documents regard product specifications and have to be kept ...
6
votes
3answers
2k views

How to securely implement roles in a Windows Form application?

As an ISV, what is considered best practice for implementing application role based security? In other words, only allow users to access certain features in the application based on what roles they ...
0
votes
0answers
56 views

How do I build a policy in ASP.NET MVC 5 (or 6) with AuthorizationPolicyBuilder that incorporates an IP address?

I have been studying this, https://leastprivilege.com/2015/10/12/the-state-of-security-in-asp-net-5-and-mvc-6-authorization/ and on that page, public class Startup { public void ...
0
votes
0answers
38 views

Are there any JSON based notations for Access Control Lists? (Alternative to S-Expression)

I'm looking for a notation that is familiar to modern developers and can supersede s-Notation. (additional insight into Rivest's proposal of s-Expression is here) Is there any Swagger, JSON or other ...
1
vote
1answer
71 views

What's the proper name for the type of security where we secure resources by ownerrship?

I work on a REST API that mixes two types of security: First you have standard role-based security - so we have multiple roles such as administrator, read-only user, super user user, etc. Then we ...
0
votes
1answer
266 views

How to secure my authentication code?

I'm working a PHP project where I need to authenticate users to a portal. Just wanted to get your opinion on the code, statistics of the website show some strange behaviour with the login form. ...
1
vote
0answers
23 views

From PreAuthentication to JWTAuthorization

I would like to ask about a problem I have designing a security flow. The context I have a webapp designed in two modules web and server Web: it's a single page client, built with Angular 1.5.5 (...
0
votes
3answers
81 views

Preventing information leakage while returning an error message

Say my website contains 2 functions: Allow a user to change their own password Allow an administrator to change a user's password (the user must change again before they login) Now let's say that ...
5
votes
2answers
1k views

Is masking really necessary when sending from Websocket client

The current Websocket RFC requires that websocket clients mask all data within frames when sending (but server is not required to). The reason the protocol was designed this way is to prevent frame ...
1
vote
0answers
23 views

When do I reset Two Factor Authentication secret keys?

I have built a simple authentication system for my web application that makes use of the open-source time-based OTP algorithm (RFC 6238). The key for each user is generated when the user is registered ...
-2
votes
1answer
85 views

In what way does programming help towards cyber security [closed]

I've been studying the cyber security field with great interest. I understand how networking can help cyber security but I am not sure how advanced programming knowledge can help fight cyber crime or ...
7
votes
2answers
179 views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...
0
votes
1answer
64 views

Universal Form Handler

I'm building a API that gets called from web / mobile applications written using Ionic (web languages on mobile), which uses Angular.js. We want to be able to do server side validation of forms but ...
0
votes
0answers
49 views

How to deal with it that not all HTTP response headers reach the browser?

Some companies use firewalls that filter unknown HTTP response headers. I've personally witnessed that a page used the default font instead of the chosen external Google font because the firewall was ...
2
votes
0answers
63 views

Technique to passively take down a host on the network [closed]

I am developing a program which is to be installed on a "simple" machine in a LAN, the only particularity is that the NIC are connected on mirror ports. The software can scan and monitor the network. ...
0
votes
0answers
42 views

How to use Integrated authentication for a user other than the logged in user?

I have a Winforms .net app that requires a user to login to our app. I want to use integrated database authentication, but the user logged in to the app may be a different (Windows/Active Directory) ...
2
votes
2answers
192 views

ASP.NET storing encrypted & salted Password

I have a question about storing encrypted passwords in your database to help secure them. I have a class that encrypts the password passed in and returns a string. This string has 3 parts too it, all ...
0
votes
0answers
20 views

Where to store authentication/authorization entities with respect to crosscuting concerns?

Can you explain me how and where to store authentication/authorization entities in project structure. For example I have 4 projects in my solution in Visual Studio: SolutionName.WebApp SolutionName....
2
votes
2answers
169 views

Securing my own software… against myself?

I do a lot of programming work for other people's businesses. I am currently working on a project for my local Scouts group that I have worked with before. The problem is I have built them their ...
4
votes
1answer
181 views

Directly query database vs. Using web service

I'm a junior programmer, am working on a WPF application that will deploy to ~50 users. We basically are streamlining all of his charting/tracking of client data. Each user will probably make about ...
1
vote
2answers
108 views

Best ways for startups to handle sensitive user information [closed]

Many companies struggle with even basic sensitive information handling. One screaming example I can give is the attack on TalkTalk's servers resulted as 4 millions customer's personal information ...
1
vote
2answers
54 views

Why can't the Synchronizer Token Pattern be circumvented?

The synchronizer token pattern is the most effective protection against CSRF attacks. I understand the theory and implementation, but I do not understand why it can't be circumvented. Generally, the ...
2
votes
1answer
83 views

How to encrypt communication without hard coding key in client?

I've found description of vulnerability here. The kankun smart socket device and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app....
23
votes
19answers
22k views

Use of pirated/cracked software for development [closed]

Disclaimer: I by no means condone the use of pirated software. Have you ever witnessed the use of pirated software for development purposes? May be a company didn't have enough money to buy a piece ...
0
votes
0answers
327 views

How to protect own software from copying [duplicate]

Possible Duplicate: How do you prevent the piracy of your software? Is possible to protect some file from copying if you are administrator of machine? I heard some story about some behavior: ...
33
votes
19answers
14k views

How do you prevent the piracy of your software? [closed]

Is it still worth it to protect our software against piracy? Are there reasonably effective ways to prevent or at least make piracy difficult?
1
vote
0answers
23 views

Securing an Azure Service Bus topic and subscriptions

We are working on a solution that will publish messages on an Azure Service Bus topic but we don't know yet which other team or even third party might be interested in subscribing to those messages in ...