For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

19
votes
5answers
3k views

Data input validation - Where? How much? [closed]

Data input validation always was quite an internal struggle to me. On the verge of adding a real security framework and code to our legacy application rewrite project (which so far pretty much keeps ...
23
votes
20answers
8k views

How do you prevent the piracy of your software? [closed]

Is it still worth it to protect our software against piracy? There are reasonably effective ways to prevent or at least make piracy difficult?
18
votes
5answers
7k views

What best practices should be employed in a PHP login script?

I am wanting to re-write my login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. Password protected control panels are in their ...
6
votes
6answers
2k views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
5
votes
1answer
2k views

API Authentication, One time token VS Dynamic tokens

We are working on a new project, we are two lead developers and got on a cross road on how to use a token to secure the communication between the server and the client : First Suggestion : (The one ...
13
votes
4answers
3k views

Best practices for execution of untrusted code

I have a project where I need to allow users to run arbitrary, untrusted python code (a bit like this) against my server. I'm fairly new to python and I'd like to avoid making any mistakes that ...
33
votes
7answers
4k views

Should a stack trace be in the error message presented to the user?

I've got a bit of an argument at my workplace and I'm trying to figure out who is right, and what is the right thing to do. Context: an intranet web application that our customers use for accounting ...
12
votes
3answers
692 views

Is reliance on parametrized queries the only way to protect against SQL injection?

All I have seen on SQL injection attacks seems to suggest that parametrized queries, particularly ones in stored procedures, are the only way to protect against such attacks. While I was working (back ...
11
votes
5answers
2k views

“Forgot Password” - How to handle this?

I read this answer and found a comment insisting not to send password by email: passwords should not be able to be retrieved by email, I hate that. It means my password is stored in plain text ...
8
votes
9answers
3k views

How much database access should developers have? [closed]

So I've worked in many different workplaces as a developer and my level of access to the database has been varied. I typically don't have production db access. Most of the time I have access to the ...
12
votes
4answers
4k views

Why do certain sites prevent spaces in passwords?

It seems less common with newer websites, but many websites I need an account on (like for paying bills, etc.) prevent me from creating a password with spaces in it. This only makes things more ...
12
votes
6answers
577 views

Discovered large security hole in someone elses website… What to do?

A chap I'm bidding to do some development for has a social network he wrote himself. Not the next facebook by any stretch. But a few thousand local users. I went to have a look at it to see what ...
5
votes
4answers
225 views

Are there languages that make it easier to understand secure coding principles?

I'm interested in expanding my knowledge of security issues: things like buffer overflows, format string vulnerabilities, etc. I'd like to be able to go through a language and understand its security ...
1
vote
1answer
316 views

Naming in Security Protocols: Alice, Bob and Eve

Among computer scientists and programmers, there's the common habit of naming people in the context of security protocols e.g. Alice, Bob or Eve. Descriptions of more elaborate attack vector sometimes ...
-2
votes
2answers
235 views

Securing PHP source code from illegal copy [closed]

my IT boss asks what is the best way to secure the PHP source code against illegal copy of the code once it is deployed to clients. Is there a PHP compiler that will make the final codes unreadable? ...
31
votes
5answers
6k views

How easy is it to hack JavaScript (in a browser)?

My question has to do with JavaScript security. Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a ...
34
votes
14answers
4k views

What to do if you find a vulnerability in a competitor's site?

While working on a project for my company, I needed to build functionality that allows users to import/export data to/from our competitor's site. While doing this, I discovered a very serious security ...
28
votes
3answers
3k views

Should MVC/REST return a 403 or 404 for resources belonging to other users?

When working with a resource-based site (such as an MVC application or REST service), we have two main options when a client tries to GET a resource that they don't have access to: 403, which says ...
21
votes
4answers
3k views

Programmers' concerns about export restrictions from the United States

Which aspects do I need to consider when designing and publishing software that must meet the US export restrictions for cryptographic software? Wikipedia says that there are various categories which ...
20
votes
11answers
2k views

Source code stolen\hacked by rival company

On some companies I've worked for, managers have spent quite a lot of money on it-security consultants. Primarily because they're afraid we're gonna get the source code stolen by a rival company. ...
19
votes
9answers
2k views

Is an 'if password == XXXXXXX' enough for minimum security?

If I create a login for an app that has middle to low security risk (in other words, its not a banking app or anything), is it acceptable for me to verify a password entered by the user by just saying ...
2
votes
2answers
313 views

typical way to share database connection for open-source project, without revealing too much

I have an open source project for mydomain.com which requires connections to a database (...as is tradition). What is the standard practice for allowing others to work on the site, without giving them ...
24
votes
6answers
2k views

How is major software protected? [duplicate]

I am a new software developer and I wish to sell my software. I recently realized that from C++ code we can not stop the user seeing parts of the code that are related to scripts or system commands. ...
11
votes
7answers
496 views

What information must never appear in logs?

I'm about to write the company guidelines about what must never appear in logs (trace of an application). In fact, some developers try to include as many information as possible in trace, making it ...
9
votes
1answer
4k views

Software architecture for authentication/access-control of REST web service

I am setting up a new RESTful web service and I need to provide a role-based access control model. I need to create an architecture that will allow users to provide their username and password to get ...
8
votes
11answers
681 views

Do you actively think about security when coding?

When you're coding, do you actively think about your code might be exploited in ways it wasn't originally meant to do and thus gain access to protected information, run commands or something else you ...
7
votes
2answers
876 views

How to separate sensitive data in database(MySql)

I need to design a database that will contains information about personal disease of users. What can be the approach in order to implement the columns of the DB's tables: encrypt the information, ...
5
votes
2answers
218 views

Do you apply a code of conduct on accepting jobs, projects or requirements?

When writing software for yourself, your company or third parties, do you always consider certain principles, values, standards, or rules of behavior that guide the decisions, procedures and systems ...
16
votes
4answers
4k views

Is it possible to read memory from another program by allocating all the empty space on a system?

Theoretically, if I were to build a program that allocated all the unused memory on a system, and continued to request more and more memory as other applications released memory that they no longer ...
15
votes
3answers
4k views

Predicting the output of PHP's rand()

I've read in numerous sources that the output of PHP's rand() is predictable as its a PRNG, and I mostly accept that as fact simply because I've seen it in so many places. I'm interested in a ...
11
votes
6answers
2k views

Why do websites restrict the number & choice of characters in a password?

Registering on an insurance company's website right now, and my password is 16 characters long, using a nice variety of letters, numbers, special characters, etc. However, here's their list of ...
7
votes
7answers
1k views

How to make security usable in a web application?

I'm in the planning stages of developing a web application that I want to make as secure as possible. I'm pretty clear about how to do that from a technical point of view, but there is one massive ...
4
votes
1answer
1k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (google for example) and ...
4
votes
2answers
223 views

How to protect a peer-to-peer network from inappropriate content?

I’m developing a simple peer-to-peer app in .Net which should enable users to share specific content (text and picture files). As I've learned with my last question, inappropriate content can ...
3
votes
1answer
305 views

Are there security implications to using dynamically-assigned TCP port numbers?

I'm getting pushback from operations for having a server process listen on a dynamically-assigned port number (i.e. it binds a socket to a port number of 0, triggering a dynamic assignment by the OS, ...
3
votes
2answers
1k views

user security pattern recommendation/best practice

I'm looking for good reference on patterns that apply to user security and ACLs for multi-user network applications. I'm re-writing a fairly large application from scratch. Now I'm looking at the ...
5
votes
6answers
1k views

How can I prevent users from creating multiple accounts on a web site?

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
4
votes
2answers
864 views

Making sure database connection information is secured

This is the first time that I am working on a web application. I was going through the question What should every programmer know about web development? and noticed one thing that I knew nothing of: ...
3
votes
2answers
1k views

I need advice developing a sensitive data transfer/storage/encryption system

I got closed on SO and told to post this here as it's about general application design as opposed to specific code. Intro I'm currently working on a project which involves the daily extraction of ...
1
vote
2answers
174 views

Parent and child permission schemes

Which approach makes most sense to use, the destructive one or the non-destructive one? Does anyone have real-world experience with one, both or even a different approach? Model A permission scheme ...
-1
votes
1answer
994 views

python login form vulnerability?

<HTML> <HEAD><TITLE>Login Page</TITLE></HEAD> <BODY> <CENTER> <FORM method="POST" action="http://yourserver/cgi-bin/login.py"> <paragraph> Enter ...