Questions tagged [security]
For questions relating to cryptography and IT security. This can be computer, network, or database security.
874
questions
0
votes
1
answer
83
views
Should an access token really be cryptographically signed?
In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
- 13
0
votes
0
answers
46
views
Should authorization be implemented within each service or in a central location?
For example, let's say we are building a service to manage employees for a retail corporation:
POST employees
GET employees
GET employees/{id}
PUT employees/{id}
DELETE employees/{id}
You would want ...
- 109
2
votes
4
answers
166
views
Which approach can be used to verify that information has not been manipulated after it has been recorded?
I am looking for an approach to verify that some information has not been modified after a certain point in time.
Let's assume a data provider records a data set at time X and provides it to a data ...
- 29
0
votes
1
answer
284
views
How do you reduce security risks when using NPM packages in commercial Web development?
This is a question for software engineers who are tasked with managing the development cycle for a Web application using NPM packages for deployment on a customer's Intranet or the Internet.
This is ...
- 75
0
votes
2
answers
75
views
Is it a good idea to use database sequential id as a key in external key-value storage?
I use Postgres database to store user information. Some of that information is sensitive so it was decided to store that information in Vault. The user table in Postgres has id's generated by a ...
- 145
3
votes
1
answer
254
views
How does antivirus software protect itself from malware?
How does antivirus protect itself from malware?
Some types of malware will kill the running processes and since antivirus is just another software like any other why they can't just kill the antivirus ...
- 43
-3
votes
1
answer
103
views
How much access should a developer have to a Staging database [closed]
We want our developers to be able to diagnose production issues in staging. For the sake of this, we are planning to make an exact replica of production into staging. We are thinking however, if we ...
- 9
0
votes
0
answers
28
views
Is it possible or does it make sense to use OAuth 2.0 CodeFlow PKCE for an internal authentication provider?
Suppose that in a solution, there is IdentityServer as authentication provider and there is some APIs which need to be protected using OAuth 2.0 CodeFlow PKCE. I have read in several places that a ...
- 213
0
votes
2
answers
118
views
How to verify that a legitimate (but unknown) remote asset from an unknown source has not been compromised and that its integrity remains intact?
I am familiar with and see the benefits of Subresource Integrity (SRI).
I understand that with SRI, once you've added a script reference with the correct integrity attribute, if the remote script is ...
0
votes
1
answer
29
views
Should I check the ownership of every "somethig_id" fields from a POST request?
I have an endpoint API for a POST request in a multi-tenant application, let's say it is for a Payment, where we have to store these fields:
tenant_id (this is the account owner)
amount
date
payer_id ...
- 11
8
votes
1
answer
520
views
Is masking an entered password security through obscurity?
There is a practice of showing bullets, not characters when a user inputs a password. Is this security through obscurity?
My first thought was that it's not, it's not really a system, we know how it ...
- 327
0
votes
1
answer
290
views
What’s the standard used to deploy .env files?
I used docker to containerize the node.js express app and used GitHub action to add the .env file in the container. I googled this method when I was doing the DEV project. But I think that if someone ...
- 125
0
votes
4
answers
327
views
HOWTO: Full-text search over an encrypted database?
I want to adhere to the best practices and obviously encrypt the data sent to me by user. And I also want to provide the full-text search feature to the user (user can only search their own data, if ...
- 75
0
votes
1
answer
82
views
Javascript and payment security
I'm using a third party CRM application which allows you to build web forms using drag and drop widgets and the ability to add javascript code to manipulate those widgets.
I need to build a form to ...
- 291
0
votes
0
answers
26
views
Securing an API in production with Spring Security
At work I have to develop an API that queries data from a Hbase Cluster.
They asked me to implement basic authentication in order to secure this API.
The use case is very simple. For the moment we ...
27
votes
9
answers
7k
views
Is it a security vulnerability to declare class members as public?
I have always wondered whether public, protected, and private has security implications post compilation.
Hypothetically:
class Foo
{
public:
int m_Foo; // Completely vulnerable and dangerous
...
- 3,319
4
votes
1
answer
207
views
If a code inspection tool finds a "heap inspection" vulnerability, is that relevant if the code is for a web app running on a private server?
Recently, at the organization I work for, we've been using a static code inspection tool.
One of the more interesting findings is that private information, such as passwords, may be stored in the heap ...
- 2,397
0
votes
1
answer
85
views
How to get the CSRF token when using a cross-origin REST API?
Usually, the web server that is serving a page includes the CSRF token inside the HTML. However when I'm using a cross-origin REST API, there is no "initial" page that could include the CSRF ...
0
votes
2
answers
135
views
Do I have too much access to my users' personal media?
This would be a broad question - but I'm asking specific to the situation around an app that I've developed.
In short, I've written an app that allows users to persist their photos and videos to the '...
- 21
0
votes
0
answers
28
views
User proof network app with distant database [duplicate]
I’m currently writing a software for my company (3rd world country), and I wanted it as simple as possible to install and maintain, so I started with Qt and no server app beside the database, (MariaDB ...
- 159
1
vote
2
answers
110
views
REST HTTP Response code for a resource that the user is not authorised to access
Suppose user A creates a private resource at, for example, /books/somebooktitle
If user B attempts to access the resource at /books/somebooktitle what code should be returned?
HTTP403: Permission ...
- 197
1
vote
3
answers
199
views
Is it OK for a public web service to use a database user with rights to execute DDL statements to access its underlying, exclusive database?
I wrote a Java web service using Spring that handles REST calls from
the Internet.
The web service uses a Postgres database underneath to store, modify and read data.
The Postgres database is used ...
- 157
2
votes
2
answers
242
views
Understanding passwordless sign up for mobile apps
How does phone number based authentication work, and what are its best practices?
I've noticed there are apps with streamlined sign-up/log-in processes where only a phone number is required, simply ...
- 23
1
vote
1
answer
69
views
Exposing redis to external clients
We are building a system that runs on our cloud and that needs information from our clients network that must not be exposed openly. We have concluded that the only way this could work, is if our ...
- 13
0
votes
3
answers
169
views
Should I separate the public and private portions of an application into two separate apps?
So I'm currently running an analysis task for my company. I won't go into too much detail but we are dealing with medical records and other confidential data. Previously this application was only used ...
2
votes
1
answer
313
views
Secure way of storing client secrets in Xamarin / Android mobile apps
What would be a secure way of storing client secrets used for authentication (webservices) in Xamarin/Android apps ?
Secure Storage, which interacts with Android Keystore, seems very useful for ...
- 29
0
votes
2
answers
123
views
JWT token security - public key forgery prevention
Question on securing JWT token integrity, given the following scenario:
Client sends a JWT to server signed with Client's private key
Server caches public key, but uses http (and not https) to ...
- 9
-1
votes
3
answers
141
views
How do web apps provide support without revealing customer data?
I'm on a dev team where the product manager wants to allow internal users to "impersonate end-user and show the site exactly as the user sees it". I argue that this raises security flags and,...
- 149
0
votes
0
answers
45
views
How should I handle keys in production
I'm creating an authorisation service, which does signing using a key.
For local development I was randomly generating a key on application start-up.
Now I'm deploying to the cloud (currently going ...
- 675
0
votes
0
answers
182
views
Authorization and Cross-Cutting Concerns in DDD (CQRS) - Filtering Data
We are currently in the early phases of developing several applications that differ significantly in their functionality. As part of building these applications, we have also developed a few generic ...
- 49
1
vote
1
answer
733
views
Authentication with JWT in HTTP only cookie without refresh token
The motto of the upcoming question is "I don't know what I don't know".
I would like to know if there are downsides or security risks with an authentication implementation.
Right now, I'm ...
- 123
74
votes
4
answers
9k
views
What is the purpose of identifier-first login screens?
Companies like Google and Microsoft use identifier-first screens: where you provide your identifier (like an email) before providing the password.
Why is this done, is this somehow more secure?
I'm ...
- 675
0
votes
3
answers
144
views
Is offline secure two party computation possible?
Is there a solution for the following problem?
We have a function f(x,y) where the inputs are secret an cannot be
known by anyone besides the party that submitted them.
The output of f is public and ...
- 9
-3
votes
3
answers
360
views
Should we allow users to write to database directly? How to do it correctly
I'm developing a new application that allows the user to do many writes. Therefore, it is very inefficient that we use our server-side to handle every write request by users. Should we allow users to ...
0
votes
1
answer
109
views
Why do users and programs have different client authentication mechanisms?
Typically in any application, the way a user (human) is authenticated is using a username/id and a password, whereas programmatic or api based access is authenticated using API keys (based on system ...
- 145
1
vote
3
answers
354
views
Better than ongoing integer and uuid as primary key
I read a lot about using ongoing numbers vs UUIDs as the primary key and had an idea how it might be possible to combine both and profit from their advantages, without their disadvantages.
The table ...
- 119
1
vote
0
answers
39
views
Automatic interaction between API and secured 3rd party API
I would like to create GUI + API that calls third party API as follows:
third party API is consumed once a day by my API,
GUI user doesn’t have to log in every day (eg. can log in only once every 30 ...
- 11
0
votes
1
answer
48
views
Should we use an Identity server for our core? [closed]
We are currently making the codebase for our company.
In this project we upload user data like users ID card, drive license, bills for identity confirmation and a lot of other sensitive data.
My ...
- 103
1
vote
1
answer
55
views
Limiting access to telemetry API only for certain application
Let's consider such an example:
I'm an author of application like Google Chrome. I would like to my application sends anonymous telemetry logs to my server. How do I prevent somebody to use my server ...
- 113
2
votes
4
answers
491
views
How to compare passwords which is stored in DB in encrypted form in secure way?
Recently In an interview I was asked this question -
Question- If are storing passwords in encrypted format in DB and in future when user login into our website how will we perform authentication?
Me:...
- 147
0
votes
3
answers
85
views
How to create a code that will be send by SMS to verify that it's a valid phone number? [closed]
I'm creating a mobile app that will have a verification process of the phone number like most of apps do when they use your phone.
I'm also developing the back-end but I don't know exactly what is the ...
- 329
1
vote
3
answers
215
views
Should I keep in the database a record of the user accepting the terms and coditions?
Most of applications, when you sign up, you must agree with some terms and conditions.
Should the information that the user agreed to those terms be saved in the database?
I asking this because I'm ...
- 329
0
votes
1
answer
107
views
How to use an API key without knowing it?
let's say I would like to create a service like eToro that allows people to trade stocks but with their own brokers.
If I do it just for me, it's pretty straightforward:
create logic that replicates ...
- 9
1
vote
3
answers
173
views
Is it a good practice to isolate the database from public APIs?
We develop web-applications using a javascript frontend framework (ReactJS), to retrieve the data to show, the user's browser calls an authenticated REST API which is our backend (Kotlin+Spring), the ...
- 119
4
votes
6
answers
410
views
Error messages and security concerns
What is considered good practice for application security wise when returning errors from a backend API?
I have inherited a project with a lot of technical debt, which I intend to improve.
One ...
- 1,774
-2
votes
1
answer
46
views
mask username and password in service file, or better approach
At work there is a given task where a python application is currently running on a server, this application is using a enviorment file, which has username and password information. The current ask is ...
- 107
-2
votes
1
answer
36
views
Securing the REST APIs - Security Framework (Technology) V/S Custom
There are many ways to secure the REST APIs, from authentication and authorization view point. Below are the two which I know so far:
Using existing token based IAM solutions like Okta, KeyCloak, ...
1
vote
1
answer
90
views
How to randomly allocate a set of IDs digitally, one ID per person, such that everyone knows that the particular allocations are kept private?
I have a set of UUIDs that I want to assign to a set of people. I want to deliver these UUIDs to people in a secure manner, such that everyone knows that I do not know which UUID corresponds to which ...
- 21
-1
votes
1
answer
56
views
Protecting cryptocurrency private keys in a corporate environment
Now that Tesla has bought a large amount of BitCoin, other companies may follow suit. If my company wanted to do that, I was thinking about how it could be done.
I'm familiar with the way private ...
- 115
6
votes
2
answers
270
views
What are best practices for enterprise software, should a developer be able to login as one of its users? (when its your own company)
My company has its own proprietary software that I have both built and maintained over the last 5 years
I am about to release a big change for all of my software to use OAuth2 instead of handling ...
- 287