For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

1
vote
1answer
78 views

Crypto hash in 'a href'?

It seems to me that it would be pretty useful to be able to indicate an expected crypto hash value in file downloads especially since so many application and data downloads rely on mirrored hosting. ...
1
vote
1answer
53 views

Securing service calls

I have a ServiceCallContext object that must be passed in as the first parameter of any service call. I would like to put a User object on the context object but I know I can't force the caller to ...
0
votes
1answer
53 views

Algorithm to maintain a blog sign up page

I have a functional sign up page for a blog that updates a database with a users name, email, profile picture and a short bio. The General information page and the profile picture upload/bio page are ...
-1
votes
1answer
37 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
4
votes
0answers
175 views

Token or ASP.NET Identity based security in ASP.NET Web API 2

Background I have a Web API 2 project, without any extension of ASP.NET MVC or ASP.NET projects. The API will only be used to communicate between the server and Windows 8, Windows Phone 8.1 and iOS ...
2
votes
0answers
58 views

Directly query database vs. Using web service

I'm a junior programmer, am working on a WPF application that will deploy to ~50 users. We basically are streamlining all of his charting/tracking of client data. Each user will probably make about ...
2
votes
0answers
76 views

How to limit users of a service to a specific program

I have built an android game - I would like to add a "high score" leaderboard to it, such that people can show off how high they managed to score. How should I design it so that people can't "hack" it ...
2
votes
0answers
115 views

Handling permissions in a MVP application

In a windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as basically its implementation should be ...
1
vote
0answers
225 views

What is the “correct” way to store functions in a database?

Note: Yes, I know that storing functions in databases should be punishable by law. We are developing a financial web application using PostgreSQL, Sinatra and AngularJS. As you may have guessed, a ...
1
vote
0answers
91 views

How to validate information on server without using database or session

Each user has multiple sites they can access reporting data for in an application I am working on. To prevent having to go to the database on every single request, I validate that they have access to ...
1
vote
0answers
41 views

Online error reporting without network access

I have developed an application for android requiring no permissions, but the biggest downside of this is that I don't have error reporting. So, I was playing around for the past week with any ...
1
vote
0answers
36 views

Domain security involving domain logic

Together with my application's domain logic I am trying to outline the security model. I am stuck with a requirement that prevents me from considering security just a cross-cutting concern over my ...
1
vote
0answers
103 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
1
vote
0answers
928 views

Connecting with OAuth, dealing with logout and browser sessions

I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services. Primarily we ...
0
votes
0answers
23 views

Detecting web proxy security

Various online resources offer proxy lists claiming that they offer various levels of anonymity. I'm trying to find out how this can be programmatically tested. I suspect the answer lies in headers. ...
0
votes
0answers
48 views

Passing Data Between Tiers in 3-Tier Architecture

Assuming we are talking physical tiers, my understanding is that in order to pass data from say the data tier to the business logic tier the JSON format is used (or XML), so say I have an ORM ...
0
votes
0answers
56 views

Best approach for an android local database-based application containing non-sensitive data

What's the best approach to design an android application with the question title specification? The application will show a first list of buttons with an alphabetical classification (like button1: ...
0
votes
0answers
42 views

Implement taxometer paywall

I need to add a paywall to my site. According to this article, I want to implement a taxometer system. The easiest and least secure way would be tracking the number of viewed articles using secure ...
0
votes
0answers
23 views

Should I use OAUTH 'scopes' to provide access to specific resources?

I am researching & and learning about OAUTH, so please forgive me if this is a very stupid question.. It seems that scopes are typically used to define actions that I can take on behalf of a ...
0
votes
0answers
267 views

Row and Field level Security Management through Code First EF, WebApi2

I could not find such question specific to asp.net webapi row level security on SO. I am building an API through .NET Webapi2 with Entity Framework. I am trying to assess various options that are ...
0
votes
0answers
21 views

Storing a WCF endpoint in the registry - worried about security

I am storing my wcf endpoint in the registry, and using that whenever my app starts up to instantiate a wcf derived object. The user can change the endpoint location, to another server, and the ...
0
votes
0answers
628 views

Best practice: Secure Android app online authentication

Currently, I develop an Android App needing online authentication for login (and registration). The main focus is on security. I’m amaing for: keeping the users’ passwords safe and preventing MITM ...
0
votes
0answers
178 views

Security in Transversal Layer in Domain Driven Design

I'm building a solution based on Domain Driven Design, I'm trying to implement the security system (authentication, authorization, roles, system configuration, connection strings, etc..) in a ...
0
votes
0answers
96 views

Token based autorization for a web game

I am lead developer for a multiplayer game in a small startup company. I would like to present here my solution for token based authentication and hear your opinions about possible weak spots. I am ...
0
votes
0answers
57 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
0
votes
0answers
1k views

How secure is this way of authenticating an ASP .NET Web API - creating your own tokens?

http://www.codeproject.com/Articles/630986/Cross-Platform-Authentication-With-ASP-NET-Web-API#_rating The above link shows exactly how I want to go about authenticating against an ASP .NET Web API. ...