Tag Info

New answers tagged

-1

On which operating system are you running your software. I guess that it is Linux or some other POSIX.... If both processes are running on the same host you could use any IPC techniques. In particular, a plain pipe (see pipe(7)) is secure enough. There is no need to encrypt the information, since only the two processes at the two ends of the pipe are able ...


8

If you are going to check the GUID against the zero GUID, you by the same logic also need to do due diligence of checking it against all other GUIDs in your application (as the probability of getting a zero should be the same as the probability of getting any other GUID in your app*). You need to do this to prove the axiom you are acting under is that this ...


34

If you find Guid.NewGuid() == Guid.Empty you have won the hardest lottery on earth. Don't bother with any uniqueness or collision checking. Not having to do that is what guids are for. I will spare you the math, it's everywhere on the web. Also, Windows guids always have one "digit" equal to 4. There is some structure to guids. That code snippet you posted ...


23

I would suggest it's not worth checking for Guid.Empty. The docs for Guid.NewGuid for some reason mention that The chance that the value of the new Guid will be all zeros or equal to any other Guid is very low. Guid.NewGuid is a wrapper for the Win32 API CoCreateGuid, which makes no mention of returning all zeroes. Raymond Chen goes further, ...


2

If an owner can grant access to other users, then it is called Discretionary Access Control (DAC): discretionary access control (DAC) is a type of access control defined <...> "as a means of restricting access to objects based on the identity of subjects and/or groups to which they belong. <...> The term DAC is commonly used in contexts that ...


1

It depends. What is the benefit of not using encryption? Under some circumstances, it can be cheaper to implement and debug. Easier for admins and others to figure out a password / secret access code. What are the drawbacks of not using encryption? Potential legal liability, depending on the context. Easier for admins and others to figure out a ...


6

It looks like your client wants to use those "secret codes" as a fine-grained authorization scheme: Only people who are authorized to access those entries should know the corresponding secret code. If that is the case, then those secret codes serve a similar purpose to passwords and should be subject to the same security standards.


1

Store it in Excel or similar, and encrypt the document so the user has to download and then enter a different password to view it. Not only does this get around your problem of stored browser passwords, it also reinforces the user's attitude to the information as it requires some effort to access - ie. helping to remind them that it is sensitive and requires ...


3

Similar to the answer by jmoreno, you can deny a user access to everything aside from EXECUTE permissions on stored procedures, then take advantage of ownership chaining to have the stored procedure perform the required operations on the tables. See here for details https://msdn.microsoft.com/en-us/library/bb669058(v=vs.110).aspx When the user enters their ...


1

I store identifier claims only (userid, etc.) (encrypted) in my jwt. Then when I get the token on the server (API) I can do a lookup server side (db, or local network api call) and retrieve all the associations to the userid (apps,roles, etc.) However if you want to stuff more into the jwt just be careful with the size since it will likely be sent on each ...


2

While there are multiple approaches here, the best approach and the key to security on the desktop is to assume that any userland software running is already compromised. In other words, place your trust in the operating system, not the programs. If the operating system is compromised... it is time to replace the computer. You mentioned sudo as a way to ...


0

I think this really depends on the nature of your application. Is it for an individual or something that could be run by many on a server environment? Is it for a technical user or somebody less technical. Take Eclipse, for example. You can connect to any repo and download plugins without needing to log in. The users that are going to be doing that, ...


1

There are many well documented vulnerabilities and attacks that use frames. OWASP has a good list of them here with examples: https://www.owasp.org/index.php/Cross_Frame_Scripting Generally, users should always be wary of any frame content especially Cross-Origin frames. Frames, including iframe, have undoubtedly been one of the largest vulnerabilities in ...


3

Although you could avoid "SQL injection" attacks by not using a relational database or not using SQL to query one, they are really part of a broader range of untrusted user input attacks that need to be protected against. Even if you had a NoSQL key / value pair store you could still be vulnerable to an attacker deleting all the data in your store. The ...


0

I'm not 100% sure what you are asking, but I'm taking it you are wondering whether you always have to program SQL strings to query a database? If so, that depends on the language you are working with, using C# you can write LINQ statements (Language integrated query) https://msdn.microsoft.com/en-us/library/bb386976%28v=vs.110%29.aspx. So you can write code ...


0

I think what you're looking for is a Service class. Controllers should be very thin and do literally nothing but forward the data from the request to a service and respond with the appropriate output. The service class should take care of validation delegation and dealing with the database abstraction.


4

You can test that a jar is sealed by defining a class to exist in a package used in the jar file. If the jar is sealed, all packages are normally sealed, else you can seal them on a per-package basis. The class you create should then try to access protected or default members of a class in that package. For example, if the jar has a class com.example.Widget ...


2

If you are building a web framework, this implies you can serve resources including HTML, CSS and JS files. If it has to be, you could even inline all resources into HTML. You can therefore use CSS- and JavaScript-based techniques to make it arbitrarily difficult to spam your form. To each form field, you can apply a different class. Only one of these will ...


1

I separate Users/Profiles from Authentication on my apps. This might be an approach you can use. Especially if in the future you think you might add twitter or other authentication providers to your system. Basically I create a table called Credentials that stores the unique UserID in my system and the Unique id the provider gives. Email is not good because ...


1

Some sites (e.g.: Asana) employ the same tactic as you do: If you register using a 3rd party and then try registering again using their own login, you will be politely reminded that you are already registered and redirected to the 3rd party login. If you go about it the other way around, you will still be able to log in using your own password. Other sites ...


0

If you have a link (or form action) with a relative URI (without a scheme and hostname), then the URI will be completed with the scheme and hostname of the page containing the link. This means that, if you are on the page "https://example.com/form.php", then the link/action "/process.php" will result in a request for the URI ...


2

There is nothing wrong in doing that. Imagine a list of messages which are shown to some groups of users only: one person would see a specific response, another one will see more messages; an administrator will probably see every possible message; a guest won't see anything. You should be careful though. If the form of the response changes radically and ...



Top 50 recent answers are included