New answers tagged

1

In the end, if I didn't misunderstand you, you've got the following situation: Android device has a clock set to a potentially random/wrong time. There's no network connection other when deploying them in their dock (probably during the night or in the morning). As such I assume the only unknown value is the time offset between the local device's clock ...


9

There's actually quite a bit you can do to recover something close to the actual time of most of your events. Android gives you a few useful tools to work with, notably broadcast intents sent when the device completes a boot, when the system clock changes and when a shutdown is imminent. It also gives you a way to check the amount of real time that's ...


1

A simple (but approximate) way to approach this is to record the offset of each device every time it syncs. When inserting the data into your master database, use the most recent offset value for the device to adjust the recorded time. Without a reliable reference clock on the device, it's not even possible to guarantee that two actions recorded by the ...


4

You put a cryptographically random, unguessable token on the password reset link that you send to the user's mailbox, and give them a time limit, expiring the link after that time limit has passed. The token insures that it came from the right mailbox. Further Reading Implementing web application self password reset mechanisms properly Forgot Password ...


4

Packages can be submitted and accepted automatically, with no manual review or human oversight Yes. Packages can cause the package manager to execute arbitrary "setup" code on the client system at install-time. The "old" project model allows running PowerShell scripts, so yes I would say this is also an issue for NuGet. Even the new ones are ...


0

One way you can prevent this scenario is quite heavy handed. You could introduce minimum latency for outbound connection, say 30 ms. Within your internal network, you need to make sure that you do a series of cryptographic requests and response to measure latency, such that the access card must respond below the latency limit. Thus the card has to be ...


0

I think that IP spoofing is much easier than explained in the other answer. This can be achieved without any admin right on your network. Just the right software (or some consumer grade devices). Even hardware MAC address isn't reliable to whitelist devices. No, this approach isn't protecting anything. The client secret that you are talking about looks ...


1

I believe IP spoofing is possible, but it is very difficult. You either need administrator access in one of the servers in the same subnet as the client, or access in one of the router between your server and the end server. If you use HTTPS, the password based authentication would be enough, no one could capture the password in transit (assuming SSL ...


1

Since most hash algorithms (at least cryptographic ones like the SHA family) are designed to prevent what you're trying to do, you won't have an easy time of it. Some older hash functions like MD5 do have some vulnerabilities, though.


0

As long as performance isn't massively important to you you could always run it in Brython which effectively puts it in the JavaScript sandbox


2

dynamically appending new code on the rendered page in a way that the changes would reflect on the other clients And this makes it possible to do XSS, mislead the users into providing confidential data such as passwords, and do lots of other cool stuff. You can't just let the users change the source code and run it, unverified, in other people's browsers. ...


0

You can get some of the information via api provided by Facebook. https://developers.facebook.com


1

No, you can't get the telephone number but you can get other information such as location, birthdate ecc... IF the users explicitly gives you the permission. Those are links to the documentation useful for the purpose: graph api, retrive user's profile and a list of infos you can get


0

Thank you for all the provided feedback! I will give them the following advice: Make sure that the programmer follows the OWASP secure coding guidelines. Make sure passwords are stored encrypted in the database. Do not save the documents on the webserver. Sync them at once to Google or Spideroak if they need to be encryped. If the sync fails, the whole ...


2

First off, you shouldn't be thinking of security in terms of a binary 'ok' or 'not ok'. Every choice you make has security implications that you want to understand. Regarding keeping the files on the web server's machine, that's not typically a problem for most commercial applications. You just need to make sure they aren't accessible via the web server....


2

There are a number of potential problems here. Theres not enough detail on the technical solution to say for sure but it seems an unsophistocated approach. Instead of critising the technology selection though, we should establish the security criteria needed for the application and ask how the solution achieves each point. eg. Should the documents be ...



Top 50 recent answers are included