For questions relating to cryptography and IT security. This can be computer, network, or database security.

learn more… | top users | synonyms

106
votes
7answers
8k views

You're hired to fix a small bug for a security-intensive site. Looking at the code, it's filled with security holes. What do you do?

I've been hired by someone to do some small work on a site. It's a site for a large company. It contains very sensitive data, so security is very important. Upon analyzing the code, I've noticed it's ...
70
votes
7answers
11k views

How can robots beat CAPTCHAs?

I have a website e-mail form. I use a custom CAPTCHA to prevent spam from robots. Despite this, I still get spam. Why? How do robots beat the CAPTCHA? Do they use some kind of advanced OCR or just ...
38
votes
11answers
3k views

Is there any reason not to go directly from client-side Javascript to a database? [duplicate]

Possible Duplicate: Writing Web “server less” applications So, let's say I'm going to build a Stack Exchange clone and I decide to use something like CouchDB as my backend store. If I use ...
36
votes
6answers
2k views

Logging failed login attempts exposes passwords

I started logging failed logins attempts on my website with a message like Failed login attempt by qntmfred I've noticed some of these logs look like Failed login attempt by qntmfredmypassword I'm ...
34
votes
14answers
4k views

What to do if you find a vulnerability in a competitor's site?

While working on a project for my company, I needed to build functionality that allows users to import/export data to/from our competitor's site. While doing this, I discovered a very serious security ...
33
votes
7answers
3k views

Should a stack trace be in the error message presented to the user?

I've got a bit of an argument at my workplace and I'm trying to figure out who is right, and what is the right thing to do. Context: an intranet web application that our customers use for accounting ...
31
votes
5answers
6k views

How easy is it to hack JavaScript (in a browser)?

My question has to do with JavaScript security. Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a ...
31
votes
9answers
2k views

Are there any valid reasons for disallowing characters and limiting the length of passwords?

I've come across quite a few sites that either limit the length they allow passwords to be and/or disallow certain characters. That's limiting to me as I want to widen and lengthen the search space of ...
28
votes
5answers
976 views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
28
votes
1answer
914 views

If the spec is flawed, should it still be followed?

I have been assigned to develop an integration to one of my employer's applications to an external system developed by our client. Our client's specification for the integration that has some blatant ...
26
votes
14answers
1k views

What if the client needs the ability to retrieve passwords?

I've currently inherited an application at work and to my dismay, I have realized that the user passwords stored in the database are encrypted using an in house encryption function, which also ...
26
votes
3answers
2k views

Should MVC/REST return a 403 or 404 for resources belonging to other users?

When working with a resource-based site (such as an MVC application or REST service), we have two main options when a client tries to GET a resource that they don't have access to: 403, which says ...
24
votes
9answers
2k views

Why not expose a primary key

In my education I have been told that it is a flawed idea to expose actual primary keys (not only DB keys, but all primary accessors) to the user. I always thought it to be a security problem ...
23
votes
6answers
2k views

How is major software protected? [duplicate]

I am a new software developer and I wish to sell my software. I recently realized that from C++ code we can not stop the user seeing parts of the code that are related to scripts or system commands. ...
23
votes
20answers
7k views

How do you prevent the piracy of your software? [closed]

Is it still worth it to protect our software against piracy? There are reasonably effective ways to prevent or at least make piracy difficult?
23
votes
11answers
1k views

Should I accept to write unsecure code if my employer requests me to do so?

My employer asked me to implement a feature that would require storing passwords in clear text in a database (or using an obscure encrypt/decrypt function stored in a binary, which is a bit better, ...
21
votes
5answers
2k views

How to implement a safe password history

Passwords shouldn't be stored in plain text for obvious security reasons: you have to store hashes, and you should also generate the hash carefully to avoid rainbow table attacks. However, usually ...
21
votes
4answers
2k views

Programmers' concerns about export restrictions from the United States

Which aspects do I need to consider when designing and publishing software that must meet the US export restrictions for cryptographic software? Wikipedia says that there are various categories which ...
20
votes
11answers
2k views

Source code stolen\hacked by rival company

On some companies I've worked for, managers have spent quite a lot of money on it-security consultants. Primarily because they're afraid we're gonna get the source code stolen by a rival company. ...
20
votes
4answers
14k views

Web api authentication techniques

We have a asp.net MVC web service framework for serving out xml/json for peoples Get requests but are struggling to figure out the best way (fast, easy, trivial for users coding with javascript or OO ...
19
votes
9answers
2k views

Is an 'if password == XXXXXXX' enough for minimum security?

If I create a login for an app that has middle to low security risk (in other words, its not a banking app or anything), is it acceptable for me to verify a password entered by the user by just saying ...
19
votes
7answers
403 views

Citations for inadvisability of globally unique password

I am having a disagreement with someone (a client) about the user identification/authentication process for a system. The nub of it is that they want each user to have a globally unique password ...
19
votes
8answers
15k views

Why almost no webpages hash passwords in the client before submitting (and hashing them again on the server), as to “protect” against password reuse?

Relevant XKCD There are many sites on the Internet that require login information, and the only way to protect against password reusing is the "promise" that the passwords are hashed on the server, ...
18
votes
5answers
2k views

Data input validation - Where? How much? [closed]

Data input validation always was quite an internal struggle to me. On the verge of adding a real security framework and code to our legacy application rewrite project (which so far pretty much keeps ...
18
votes
5answers
6k views

What best practices should be employed in a PHP login script?

I am wanting to re-write my login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. Password protected control panels are in their ...
16
votes
4answers
3k views

Is it possible to read memory from another program by allocating all the empty space on a system?

Theoretically, if I were to build a program that allocated all the unused memory on a system, and continued to request more and more memory as other applications released memory that they no longer ...
15
votes
3answers
4k views

Predicting the output of PHP's rand()

I've read in numerous sources that the output of PHP's rand() is predictable as its a PRNG, and I mostly accept that as fact simply because I've seen it in so many places. I'm interested in a ...
14
votes
13answers
3k views

Is using ELSE bad programming? [closed]

I've often come across bugs that have been caused by using the ELSE construct. A prime example is something along the lines of: If (passwordCheck() == false){ displayMessage(); }else{ ...
14
votes
10answers
3k views

What attributes of PHP make it insecure? [closed]

It's well known and discussed that PHP has a poor history with relation to security. Is it not a secure language, or are there other reasons for this (such as developer error)? If PHP is truly ...
14
votes
13answers
763 views

How do you keep track of all your passwords? [closed]

I'm going to ask this question at the risk of someone exposing me their own personal algorithm, if that's what you do please don't post that! I'm interested in learning what software you use to ...
14
votes
6answers
926 views

How to assure users that website and passwords are secure

On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All ...
14
votes
10answers
1k views

How important is an SSL certificate for a website?

I'm bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I'm using subdomains and I need to access them with iframes (it's ...
14
votes
7answers
1k views

What makes a hashing algorithm “secure”?

After reading this interesting question, I felt like I had a good idea of which insecure hashing algorithm I'd use if I needed one, but no idea why I might use a secure algorithm instead. So what is ...
14
votes
7answers
1k views

stackoverflow induced passivity - how to cope?

After not really working on my pet project for a while, I discovered Stackoverflow and upon perusing it more intensely I was quite amazed. I'm a bit of a perfectionist, so when I found eye-openers ...
14
votes
4answers
443 views

Should internal code be shared with non-developers in an organisation?

Where I work, we have a lot of developers and an awful lot of code running our proprietary applications used by staff & customers alike. We also have a lot of smart support staff that like to ...
14
votes
7answers
10k views

How secure is localstorage?

The question says it all really. I want to provide a service but I do not want to store any of the data myself in a database. With all the recent news of hacking etc it seems to me that it is nicer ...
13
votes
7answers
856 views

Are all security threats triggered by software bugs?

Most security threats that I've heard of have arisen due to a bug in the software (e.g. all input is not properly sanity checked, stack overflows, etc.). So if we exclude all social hacking, are all ...
13
votes
7answers
2k views

What special considerations are needed when designing databases to hold financial records?

I hope this question isn't too broad. In the future I may need to add some accounting and financial-tracking systems to some applications (mostly web-based applications, but my questions pertains to ...
13
votes
4answers
815 views

What to do when your company doesn't encrypt passwords

Background I'm been contracted to help a company maintain their server. I work on some minor PHP projects but also look over performance issues and recently, scan logs for hackers. These guys have ...
12
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
12
votes
6answers
1k views

How does a large company make rookie mistakes which leave security holes? [closed]

Sony was recently hacked with a SQL injection and the passwords of their user's was stored in plain text. These are rookie mistakes. In such a large company, how does this pass QA? How do they not ...
12
votes
5answers
706 views

Should you ever release something that you yourself could hack?

Being the creator of a program, you are probably in a better position than anyone to be aware of security vulnerabilities and potential hacks. If you know of a vulnerability in a system you wrote, is ...
12
votes
10answers
2k views

Login using email or username?

Is registration login using email a better idea than username to identify the user?
12
votes
6answers
572 views

Discovered large security hole in someone elses website… What to do?

A chap I'm bidding to do some development for has a social network he wrote himself. Not the next facebook by any stretch. But a few thousand local users. I went to have a look at it to see what ...
12
votes
3answers
671 views

Is reliance on parametrized queries the only way to protect against SQL injection?

All I have seen on SQL injection attacks seems to suggest that parametrized queries, particularly ones in stored procedures, are the only way to protect against such attacks. While I was working (back ...
12
votes
2answers
483 views

What to do when you find a security hole in your company's site

I have found a major security hole in one of my company's public facing site. This is our first public facing site that was converted from an intranet site. I brought this issue up to my boss and they ...
12
votes
4answers
3k views

Why do certain sites prevent spaces in passwords?

It seems less common with newer websites, but many websites I need an account on (like for paying bills, etc.) prevent me from creating a password with spaces in it. This only makes things more ...
12
votes
7answers
1k views

Why isn't SSL/TLS built into modern Operating Systems?

A lot of the basic network protocols that make up the infrastructure of the Internet are built in to most major Operating Systems. For example, TCP, UDP, and DNS are all built into Linux, UNIX and ...
12
votes
4answers
646 views

How to securely implement auto-login

I've read many, many, many posts on how "you're probably storing passwords wrong". They are always referring to storing passwords on a server into which a user is logging; they basically rehash (pun ...
11
votes
6answers
2k views

What would truly happen if java.lang.String weren't final?

I'm a long time Java developer and finally, after majoring, I have time to study it decently in order to take the certification exam... One thing that has always bothered me is String being "final". I ...