For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

0
votes
1answer
51 views

Logging private data

In general, I write a debug log whenever one of my functions is entered, including the parameters. For instance: function execute_query($query, $conn_string) { ...
1
vote
1answer
53 views

Securing service calls

I have a ServiceCallContext object that must be passed in as the first parameter of any service call. I would like to put a User object on the context object but I know I can't force the caller to ...
0
votes
0answers
23 views

Detecting web proxy security

Various online resources offer proxy lists claiming that they offer various levels of anonymity. I'm trying to find out how this can be programmatically tested. I suspect the answer lies in headers. ...
0
votes
1answer
29 views

File sharing web application - folder PIN code entry best practice

I'm developing a web app for internal file sharing and one of the requirements is to have PIN code protected folders. What I came up now is a folder like structure with the following: Folder ...
13
votes
5answers
1k views

Why do we need method level security?

In the real world , why do we need to implement method level security ? We either have a web application or a desktop application , where the user accesses the user interface (and therefore directly ...
3
votes
1answer
9k views

What security is used by default in WSHttpBinding (service side) or the WCF Test client (client side)?

I recently moved a service from BasicHttpBinding to WSHttpBinding (i.e. SOAP 1.1 -> SOAP 1.2). In WCF, using WSHttpBinding() makes it start using some default security settings. I presume the same ...
1
vote
1answer
211 views

How do I verify if 3rd party payment succeeded?

I'm working on a payment processing website that will function like PayPal does on many e-commerce websites. The idea is for the customer to fill their shopping cart and click checkout, then be ...
1
vote
1answer
114 views

How to create donation software? [closed]

I have a requirement to create a donation software for a project. Does anyone know how KickStarter designed theirs? What are the security elements involved? How do I create the credit card ...
1
vote
1answer
87 views

How to generate Generate Hash incorporating time stamp so it can be unhashed to get the timestamp when it was generated?

I want to create hash based on random id, That hash has to be valid for only 15 minutes. Is there a way to do that? I'm using this for form submission. If some unknown submitted form or some one ...
1
vote
2answers
145 views

Convert this abstract class to an interface

I have a security method I would like to be able to sprinkle into other classes throughout my program. It is currently an abstract class but I feel it would be more appropriate as an interface. Can ...
0
votes
0answers
46 views

Passing Data Between Tiers in 3-Tier Architecture

Assuming we are talking physical tiers, my understanding is that in order to pass data from say the data tier to the business logic tier the JSON format is used (or XML), so say I have an ORM ...
0
votes
1answer
53 views

Algorithm to maintain a blog sign up page

I have a functional sign up page for a blog that updates a database with a users name, email, profile picture and a short bio. The General information page and the profile picture upload/bio page are ...
-1
votes
1answer
37 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
1
vote
1answer
78 views

Crypto hash in 'a href'?

It seems to me that it would be pretty useful to be able to indicate an expected crypto hash value in file downloads especially since so many application and data downloads rely on mirrored hosting. ...
4
votes
1answer
116 views

Why does SOP permit cross-origin form submissions?

Same Origin Policy does not prevent origin foo.bar from creating a form with action attribute set to another origin baz.duh and even allows to programmatically submit this form without the user ...
1
vote
2answers
40 views

Security and sanitizing user-input with limited control over 'output' targets

I have recently joined a team working on an application with an integrated chat system. It is a standard chat system that allows clients to communicate, with messages routed through a central server. ...
0
votes
0answers
55 views

Best approach for an android local database-based application containing non-sensitive data

What's the best approach to design an android application with the question title specification? The application will show a first list of buttons with an alphabetical classification (like button1: ...
16
votes
1answer
1k views

Is there an official standard regarding user password storage practices?

I recently used a government service that I had an account for from years ago. I couldn't remember my password for the service so I used the "forgot password" link and was astonished to see that this ...
1
vote
2answers
45 views

Eclipse plugins - safe to install?

I've seen a few useful plugins for Eclipse such as jshint-eclipse. However, I'm a bit leery of installing third-party code. Is it generally safe to install Eclipse plugins without worrying about my ...
39
votes
13answers
5k views

How safe is it to compile a piece of source code from a random stranger? [closed]

Suppose I'm reviewing code that job applicants send to prove their skills. Clearly I don't want to run executables they send. Not so clearly I'd rather not run the result of compilation of their code ...
4
votes
0answers
173 views

Token or ASP.NET Identity based security in ASP.NET Web API 2

Background I have a Web API 2 project, without any extension of ASP.NET MVC or ASP.NET projects. The API will only be used to communicate between the server and Windows 8, Windows Phone 8.1 and iOS ...
0
votes
5answers
249 views

How to handle the problem of modified encrypted files [closed]

I have a simple encryption/decryption application that I am testing to learn more about security. I found out that if the user modifies the encrypted file, then decryption fails because the hashing ...
12
votes
6answers
4k views

What would truly happen if java.lang.String weren't final?

I'm a long time Java developer and finally, after majoring, I have time to study it decently in order to take the certification exam... One thing that has always bothered me is String being "final". I ...
0
votes
2answers
175 views

Binding software to one PC [closed]

I have generated a .exe of a Python script. I wish to give this software as a demo version to few of clients. For the same I want to bind the software to a particular PC. i.e. If I install the ...
0
votes
2answers
255 views

How do I access databases from a mobile device securely?

I have been doing some research on accessing a DB from mobile devices. There are so many different ways of doing it. There are also multiple ways to make it secure. What is a good way to access a ...
2
votes
0answers
58 views

Directly query database vs. Using web service

I'm a junior programmer, am working on a WPF application that will deploy to ~50 users. We basically are streamlining all of his charting/tracking of client data. Each user will probably make about ...
-1
votes
1answer
211 views

Program to look at the first say 5 characters of a word and return a string if that string is actually the first 5 characters of a word?

For example, say I have a string and it has the letters: RDNAL This is not an actual English word or it doesn't start an actual english word, so the program would skip this string and would avoid ...
5
votes
4answers
2k views

Development of a bot/web crawler detection system

I am trying to build a system for my company which wants to check for unusual/abusive pattern of users (mainly web scrapers). Currently the logic I have implemented parses the http access logs and ...
0
votes
2answers
84 views

What is the value of encoders with decoders currently present

Can you tell me the value of using PHP encoder (ioncube, phpshield) with currently present service like decry.pt (http://www.decry.pt/) that can easily decode source codes. I have tried decry.pt's ...
1
vote
1answer
91 views

What is a simple, correct and secure way of executing code stored in database?, that is also sandboxed

Webhooks can be a very powerful thing when you try to automate or integrate software, however, handling their deployment in a controlled environment can suck in terms of security and deployment alone. ...
1
vote
2answers
101 views

How much should I concern myself with hiding the IDs of my database in URLs?

I keep coming across questions and articles on the internet suggesting that it's not a good practice to have the IDs of your database records visible to the public. Yet I've never taken it seriously ...
1
vote
1answer
162 views

How to securely store user credentials from external website

I'm developing an application where I'd like to use credentials from external websites. This will be used to login with the website API and get information for the user. Example: I want to use the ...
1
vote
1answer
119 views

Resetting vs. re-sending forgotten passwords

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
0
votes
1answer
41 views

API authentication with a single ID

A typical API authentication usually rely on a pair of API ID + SECRET, my question is: if the API ID is unique and randomly generated and is considered strong enough (e.g. SHA512), why a SECRET is ...
7
votes
3answers
1k views

How to separate sensitive data in database(MySql)

I need to design a database that will contains information about personal disease of users. What can be the approach in order to implement the columns of the DB's tables: encrypt the information, ...
21
votes
5answers
9k views

What best practices should be employed in a PHP login script?

I am wanting to re-write my login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. Password protected control panels are in their ...
2
votes
1answer
59 views

What's the best practise for storing web server credentials for your web app deployment?

I was looking at the Oracle documentation for the weblogic maven plugin. In it, they store the weblogic user name and password for accessing in the pom.xml. Just wondering, isn't this a terrible ...
0
votes
2answers
82 views

How to protect controller endpoint from abuse?

I am building a web app that will first validate a promotion code via AJAX call and then if it is valid, allow the user to fill out the rest of the form, I use KnockoutJS to reveal and hide the ...
31
votes
14answers
2k views

Is it ethical to teach teens about software viruses? [closed]

I volunteered to instruct an after school computer club at my son's middle school. There has been a lot of interest in computer viruses. I was thinking about showing them how to create a simple batch ...
36
votes
9answers
3k views

Looking for meaningful, strong argument in favor of antivirus software on development machines [closed]

When forming opinions, it is a good practice to follow scholastic tradition - think as hard as you can against the opinion you hold and try to find counter-arguments. However, no matter how hard I ...
1
vote
2answers
582 views

Should EICAR be updated to test the revision of Antivirus system?

I'm posting this here since programmers write viruses, and AV software. They also have the best knowledge of heuristics and how AV systems work (cloaking etc). The EICAR test file was used to ...
2
votes
3answers
132 views

Where to store hashes, salts, keys in Desktop Applications

I am trying to figure out where or how i should store application secrets and keys inside a desktop application. For example a facebook app key or dropbox key and secret. So I've read that i should ...
15
votes
9answers
3k views

Can you “stop” a C program from being reverse engineered? [duplicate]

I'm sure that many of the middle to high level languages can be reverse engineered. But if a C program can be reverse-engineered, and turned back into editable source code, how do I discourage such a ...
3
votes
1answer
90 views

Are Secure Desktop and separate process enough for hiding sensitive information in RAM?

In my program, I have an encrypted database on the file system with a password. It is decrypted in RAM, and the sensitive data get spread out too much in RAM for mistake to be auditable easily enough. ...
16
votes
4answers
5k views

Predicting the output of PHP's rand()

I've read in numerous sources that the output of PHP's rand() is predictable as its a PRNG, and I mostly accept that as fact simply because I've seen it in so many places. I'm interested in a ...
1
vote
2answers
350 views

How to prevent people from playing with your website? [closed]

I have designed my first website recently. I created my own blog like thing in PHP. I write articles and below the articles there is a place to add comments. Sometimes I get random comments something ...
4
votes
3answers
721 views

How to open a desktop application through browser without a Java applet?

We run a cloud-based medical software, and a very important part of the program is bridging to an imaging software straight from our website, passing information through command line arguments. We ...
8
votes
9answers
2k views

What is a reasonable and secure password requirement for user registration?

This is the password policy I just got from UPS (just for package status checking): Your password must be between 8 and 26 characters long. It must contain at least three of the following ...
3
votes
1answer
135 views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...
5
votes
3answers
184 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...