Tag Info

New answers tagged

1

Can you tell me the value of using PHP encoder (ioncube, phpshield) with currently present service like decry.pt (http://www.decry.pt/) that can easily decode source codes. The value is that the source code is no longer readable by humans. I have tried decry.pt's free demo. Just drag & drop an encoded source and it will return the decoded one. ...


1

You shouldn't store a user's login credentials to a third-party service. Instead, reddit provides an oAuth API to acquire access to parts of the website that require user authentication. See: https://www.reddit.com/dev/api/oauth.


4

The /Book/55/title-of-book pattern has an important benefit: it contains the title of the book, which is helpful for SEO, but also the ID, which: Won't change (unless you change the type of the ID, say uniqueid instead of int). Is the only thing needed to locate the corresponding resource. This is important when you need a shorter URI, especially when the ...


3

I think the biggest benefit of hiding IDs and presenting a hash-like string instead, is to prevent records being harvested simply by incrementing the value. This isn't so much a security concern, but a deterrence to would-be data harvesters who may wish to collect or index data from your service. As for implementing this, it would be better to generate a ...


14

You should never be in a position to send a user their password. All passwords should be stored in a hashed format, with a sufficiently good hash function that recovering the original password is computationally infeasible. As for password resets, it depends on the application. If it's a web application, send a time-limited, use-once password reset link and ...


1

This is a lot like asking why we have both a username and a password for all our regular internet accounts, when arguably just a password is sufficient. The first reason is actually contained in your question: Actually I would considered using a single API ID is more secure - since when you change , it is more hard to identify the client (as there is no ...


1

Ominus' answer addresses your first question. The answer to the second question may require more details about your application. Another approach with even greater security if the patients must access the database could be to have a separate database for each user. In this approach you might use a framework that provides multi-tenant, multi-database ...


2

This is a terrible idea if there are no clear warnings on the example page. It encourages developers to put their secrets in their configuration files on their developer machines. Those files end up in version control, which is very, very wrong. The only location where configuration files might have secrets (see below about what I mean by secrets) is on ...


1

You could block the user IP address after few attempts within certain period of time (say if certain IP address sends 10 requests over 1 minutes, then block the IP for 10 minutes.


0

I'm not sure if this is the best idea, but it's a decent start to prevent brute forcing your validator. Include a random hash with the original form that has to be passed to the endpoint. Keep a counter in non-persistent storage referencing that hash which expires after some reasonably short timeframe. Then start returning 503 errors after some threshold ...


2

I think there are two distinct problems here 1: Can I stop a user who has access to the client source code from getting at a hardcoded or configigured key /password the client needs to access a service 2: Can I stop a hacker who gains access to the users pc from accessing the users cached username/password my app is using. so with 1, you shouldn't have ...


3

There is no 100% secure solution. What ever you implement must be executable by a deterministic computer, so someone and substitute that and unpick what ever technical barriers you put in their way. You can make it more technically challenging and a more involved and slower process, but in time if the incentives are there, someone will break it. If you are ...


0

You should use a cryptographic hash function: a hash function which is considered practically impossible to invert, that is, to recreate the input data from its hash value alone. To authenticate a user your application will: hash the password presented; compare the value with the stored hash. This way, if the password file is compromised, you haven't a ...


1

You must decide what you are protecting and against whom. First, swap. Your application sensitive data can get to swap file and be extracted from there later. So, you must enable zeroing swap file on shutdown. Second, who is attacking your application. I am pretty sure when ring3 application allocates memory it is already zeroed out. However, if attacker ...


3

To visually illustrate how non-random the rand()function is, here is an image where all pixels are made of "random" red, green and blue values: There normally shouldn't be any pattern in the images. I've tried calling srand() with different values, it doesn't change how predictable this function is. Note that both aren't cryptographically secure and ...


0

"Java Web Start (also known as JavaWS, javaws or JAWS) is a framework developed by Sun Microsystems (now Oracle) that allows users to start application software for the Java Platform directly from the Internet using a web browser." source : "http://en.wikipedia.org/wiki/Java_Web_Start" With Java WS you can start desktop java applications (not applets). ...


8

Running local programs through the web browser is frowned up for most scenarios, so browsers don't really want to implement that support. One idea I had that you could do, is create some obscure file extension, and register your client-side app to open them. Then, your web page serves up some file, in that file extension. The file would get opened by your ...


-2

Things that come to mind, but none as cross platform and browser neutral as Java is supposed to be: Create a Chrome extension. Convince Oracle to support Java in Chrome. Require users to use IE or Firefox. Have your "cloud-based medical software" people also support your imaging needs. I'm trying to think of a clever, simple solution, but you're in a ...


0

One solution is to delegate the security of your key to a cloud provider (If you plan to host this app on the cloud). The cloud provider such as AWS automatically encrypts data stored on S3 and so you do not have to take any specific action to safeguard this data. If you need to locally manage the security of the key. You can use a tool such as Google's ...


0

The complexity of password requirement should be balanced with the contents of your sites. A bank should require a highly complex password (uppercase, lowercase, number, and special characters). However, if the content is trivial, like saved searches and tracking numbers, the password requirement should be relaxed. Minimum length of 6 characters should be ...


3

The purpose of a JSON Web Token is to authenticate you, not to secure the payload. Securing the payload is a separate operation. Naturally, you can encrypt the payload if you wish, but that's not the purpose of a JSON Web Token. You don't encrypt the payload for the same reasons that you don't encrypt anything else: the cost (however small it is) exceeds ...



Top 50 recent answers are included