Tag Info

New answers tagged

1

There is a way to make a text illegible for search engines and web crawlers while maintaining it readable for humans: You encode your text using some simple substitution cipher, such as ROT13 or Atbash. You apply to that text an special font (whose symbols have been unordered) that makes readable the encoded text, by reversing the substitution previously ...


3

Token over https is a time-tested and proven approach for securing a web api. If the token is stolen somehow, via an attack on ssl, it will only be valid for a short time. Consider using Thinktecture's identity server, which has a token server built in. https://github.com/IdentityServer/IdentityServer2 Whatever you do, resist the urge to re-imagine this ...


1

You simply don't give the user access to that API. For example, we have several web apps which uses access tokens and bill the user for certain actions. The billing system is centralised, and there's an app used by our customer services to add credits to the bills. But there's no reason why the access token the end user gets to perform the actions on the ...


1

The safest way to "store User's third party credentials" is to not store them - if you store them, you have two major issues: they may change before you update your cache of them (seen this several times) your app could be compromised, compromising unknown numbers of users' third-party creds And probably many more. You either need to use a different ...


-1

I try to avoid stored proc's if at all possible. But when I have to for security, my goal is a compromised approach. I use stored proc's for updating commands (INSERT, UPDATE, DELETE) and the ORM for everything else. Further, each stored proc does a single operation on a single table. The application code coordinates all of the calls and manages the ...


0

Modern Object Relation Mapping libraries, and even the lower level libraries allowing you to run SQL against the database, have guards in place to prevent SQL injection attacks. To use stored procedures because all other solutions are not secure is both short sighted and false. If you must hard code SQL, you can use parameterized queries, which guard against ...


2

Sprocs are very good for implementing a secure data access layer - you write sprocs for reading and writing data, and give the client execute access to the sprocs only - no access to the underlying tables or views. This gives your DB an API that clients use, in much the same way as any class implemented in your business logic code would, but much more ...


1

For casual protection, you can hash some identification fields (including the ID) and include the hash in the page. When the page is posted, you hash the fields again, and compare them with the hash stored in the page. Make sure it's a salted hash so that it's difficult for the attacker to recreate the hash algorithm and make their own fake hash. For ...


0

What it sounds to me like you are describing is what package managers do: they take files from a repository, copy them to the target machine, and run scripts within them. This is usually done for the purpose of installation of software, but it doesn't have to be, so long as you are OK with their idempotency. They typically use a remote filesystem full of ...


4

Let's say you want to crack passwords which are stored as MD5 Hashes (This is very old technology). Since brute force takes a real long time, and this function is "non-reversible", then the attack is the Reverse Lookup table. The idea is that you create a table storing what you enter as input and the hash it generates. After you run your routine with as ...



Top 50 recent answers are included