For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

2
votes
2answers
61 views

JWT refresh token exponentially?

This is how I do my JWT refresh token: A token is check for validity every time a request is made. If it's not expired, allow access. If it's expired calls another function named RefreshToken to ...
4
votes
1answer
181 views

Directly query database vs. Using web service

I'm a junior programmer, am working on a WPF application that will deploy to ~50 users. We basically are streamlining all of his charting/tracking of client data. Each user will probably make about ...
0
votes
1answer
29 views

Secure communication between a mobile app and a microcontroller

I have a MCU-based design that essentially controls other hardware and this MCU is controlled through an app. I was hoping someone could help me figure out how to secure this communication between the ...
-1
votes
1answer
58 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
3
votes
0answers
39 views

Right way to spread secret keys between microservices

I have a few services that sign some data with asymmetric cryptography algorithm (like RSA). I need to spread some secret (private) keys between all instances of the service. I've found few ways to ...
2
votes
0answers
68 views

Windows Phone 8.1 & above - is there some equivalent for Apple's keychain

I want to store store some app specific secret on the phone - this should be available only for the app & no other app. I was looking at DPAPI - however, if the user does not have a logon ...
2
votes
0answers
66 views

Client Browser, Node Server, Web API auth structure

I have a web API that accepts Authorization headers to allow access. It responds with the requested data in addition to setting a session cookie. Subsequent requests can be made with no auth headers ...
2
votes
0answers
87 views

How to limit users of a service to a specific program

I have built an android game - I would like to add a "high score" leaderboard to it, such that people can show off how high they managed to score. How should I design it so that people can't "hack" it ...
2
votes
0answers
205 views

Handling permissions in a MVP application

In a windows forms payroll application employing MVP pattern (for a small scale client) I'm planing user permission handling as follows (permission based) as basically its implementation should be ...
2
votes
0answers
112 views

Switching between Azure Mobile Services vs my own implementation. Will UIDs change?

I'm looking at Azure Mobile Services, particularly the Authentication part (which I believe relies exclusively on OAUTH 1 or 2). I want to make sure that my application isn't tightly coupled to the ...
1
vote
0answers
23 views

From PreAuthentication to JWTAuthorization

I would like to ask about a problem I have designing a security flow. The context I have a webapp designed in two modules web and server Web: it's a single page client, built with Angular 1.5.5 (...
1
vote
0answers
23 views

When do I reset Two Factor Authentication secret keys?

I have built a simple authentication system for my web application that makes use of the open-source time-based OTP algorithm (RFC 6238). The key for each user is generated when the user is registered ...
1
vote
0answers
23 views

Securing an Azure Service Bus topic and subscriptions

We are working on a solution that will publish messages on an Azure Service Bus topic but we don't know yet which other team or even third party might be interested in subscribing to those messages in ...
1
vote
0answers
33 views

Correlating Search Classifiers in a Database Scan for Sensitive Information

Problem Description I am working on an enterprise data discovery project that is designed to scan databases for sensitive information. The basic search unit is called a classifier and covers things ...
1
vote
0answers
75 views

Generate a fixed length number hash from a number

Let say I've a fixed length number, e.g. 6 digit: 837493, I want to apply some process (with a salt), and generate a new number of another 6 digits, e.g. number = 837493 another = hash(number + ...
1
vote
0answers
55 views

'HMAC style' design example for a shared secret

I'm looking to secure an API based on a shared key and a given username and datetime. The API gives access to trusted third parties and does not require the input from a user in order to access their ...
1
vote
0answers
160 views

Securing a private API used by an iOS App

I have an app that uses an API server and I do not want to have anything other than it to be able to use that API. I know this isn't totally possible, but I want to do what I can. I don't think my ...
1
vote
0answers
179 views

How to validate information on server without using database or session

Each user has multiple sites they can access reporting data for in an application I am working on. To prevent having to go to the database on every single request, I validate that they have access to ...
1
vote
0answers
43 views

Online error reporting without network access

I have developed an application for android requiring no permissions, but the biggest downside of this is that I don't have error reporting. So, I was playing around for the past week with any ...
1
vote
0answers
42 views

Domain security involving domain logic

Together with my application's domain logic I am trying to outline the security model. I am stuck with a requirement that prevents me from considering security just a cross-cutting concern over my ...
1
vote
0answers
1k views

Connecting with OAuth, dealing with logout and browser sessions

I work on a open-source web application (Moodle) which connects to a number of external services such as Google Drive, Dropbox etc. to allow users to exchange files with these services. Primarily we ...
0
votes
0answers
22 views

Seeking advice on accountsecurity in mobile application

I have the idea of developing a lightweight application that provides people playing a specific game (League of Legends) with VOIP. The appplication flow goes like this: User enters lol accountname ...
0
votes
0answers
22 views

External User ID to Internal User ID

There is an internal API, REST client over DB, all of which methods require User ID as parameter. User ID is an integer value - numeric PK in User table. Also there is an public API, that is like a ...
0
votes
0answers
56 views

How do I build a policy in ASP.NET MVC 5 (or 6) with AuthorizationPolicyBuilder that incorporates an IP address?

I have been studying this, https://leastprivilege.com/2015/10/12/the-state-of-security-in-asp-net-5-and-mvc-6-authorization/ and on that page, public class Startup { public void ...
0
votes
0answers
38 views

Are there any JSON based notations for Access Control Lists? (Alternative to S-Expression)

I'm looking for a notation that is familiar to modern developers and can supersede s-Notation. (additional insight into Rivest's proposal of s-Expression is here) Is there any Swagger, JSON or other ...
0
votes
0answers
49 views

How to deal with it that not all HTTP response headers reach the browser?

Some companies use firewalls that filter unknown HTTP response headers. I've personally witnessed that a page used the default font instead of the chosen external Google font because the firewall was ...
0
votes
0answers
42 views

How to use Integrated authentication for a user other than the logged in user?

I have a Winforms .net app that requires a user to login to our app. I want to use integrated database authentication, but the user logged in to the app may be a different (Windows/Active Directory) ...
0
votes
0answers
20 views

Where to store authentication/authorization entities with respect to crosscuting concerns?

Can you explain me how and where to store authentication/authorization entities in project structure. For example I have 4 projects in my solution in Visual Studio: SolutionName.WebApp SolutionName....
0
votes
0answers
57 views

WCF security with Java client

I'm about to develop a WCF service which is going to be called by an external Java client. I've developed a couple of services before but they were called internally, so security is now a concern. ...
0
votes
0answers
65 views

Web service security token storage

I have two operations in my JAX-WS web service: First takes username and password as parameters and generates random alphanumeric token, second takes this token and username as parameters, verifies ...
0
votes
0answers
33 views

Client application and secure data exchange without ssl/tls

I have my own home server and port 80/443 is blocked from my ISP provider. I want to create a Qt gui application that saves my data on my server using REST (using port 8080 or something) using nginx/...
0
votes
0answers
66 views

Client blocks fonts in browser => font-awesome is not being displayed

I am working on a web platform for which we have different clients. In this platform we make a strong use of font-awesome. I have always thought this was a safe and elegant choice with which I had ...
0
votes
0answers
149 views

Should a SPA have a route URL visible in address bar?

I am developing a Angular SPA using angular-ui-route. We are in a confusion of should we have the route visible for User in the address bar or just have index.html (or home page) always ? Is there a ...
0
votes
0answers
35 views

Detecting web proxy security

Various online resources offer proxy lists claiming that they offer various levels of anonymity. I'm trying to find out how this can be programmatically tested. I suspect the answer lies in headers. ...
0
votes
0answers
162 views

Passing Data Between Tiers in 3-Tier Architecture

Assuming we are talking physical tiers, my understanding is that in order to pass data from say the data tier to the business logic tier the JSON format is used (or XML), so say I have an ORM (...
0
votes
0answers
67 views

Implement taxometer paywall

I need to add a paywall to my site. According to this article, I want to implement a taxometer system. The easiest and least secure way would be tracking the number of viewed articles using secure ...
0
votes
0answers
371 views

Security in Transversal Layer in Domain Driven Design

I'm building a solution based on Domain Driven Design, I'm trying to implement the security system (authentication, authorization, roles, system configuration, connection strings, etc..) in a ...
0
votes
0answers
69 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...