Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
0 votes
1 answer
81 views

Should an access token really be cryptographically signed?

In a web app I'm writing, a singed-in user is recognized by their cookie containing a session identifier. That session id has sixty-four bits of entropy, so I believe brute-force attacks are ...
user avatar
  • 13
0 votes
0 answers
46 views

Should authorization be implemented within each service or in a central location?

For example, let's say we are building a service to manage employees for a retail corporation: POST employees GET employees GET employees/{id} PUT employees/{id} DELETE employees/{id} You would want ...
user avatar
  • 109
2 votes
4 answers
166 views

Which approach can be used to verify that information has not been manipulated after it has been recorded?

I am looking for an approach to verify that some information has not been modified after a certain point in time. Let's assume a data provider records a data set at time X and provides it to a data ...
user avatar
0 votes
1 answer
282 views

How do you reduce security risks when using NPM packages in commercial Web development?

This is a question for software engineers who are tasked with managing the development cycle for a Web application using NPM packages for deployment on a customer's Intranet or the Internet. This is ...
user avatar
  • 75
0 votes
2 answers
75 views

Is it a good idea to use database sequential id as a key in external key-value storage?

I use Postgres database to store user information. Some of that information is sensitive so it was decided to store that information in Vault. The user table in Postgres has id's generated by a ...
user avatar
  • 145
3 votes
1 answer
250 views

How does antivirus software protect itself from malware?

How does antivirus protect itself from malware? Some types of malware will kill the running processes and since antivirus is just another software like any other why they can't just kill the antivirus ...
user avatar
  • 43
-3 votes
1 answer
103 views

How much access should a developer have to a Staging database [closed]

We want our developers to be able to diagnose production issues in staging. For the sake of this, we are planning to make an exact replica of production into staging. We are thinking however, if we ...
user avatar
  • 9
0 votes
0 answers
28 views

Is it possible or does it make sense to use OAuth 2.0 CodeFlow PKCE for an internal authentication provider?

Suppose that in a solution, there is IdentityServer as authentication provider and there is some APIs which need to be protected using OAuth 2.0 CodeFlow PKCE. I have read in several places that a ...
user avatar
0 votes
2 answers
118 views

How to verify that a legitimate (but unknown) remote asset from an unknown source has not been compromised and that its integrity remains intact?

I am familiar with and see the benefits of Subresource Integrity (SRI). I understand that with SRI, once you've added a script reference with the correct integrity attribute, if the remote script is ...
user avatar
0 votes
1 answer
29 views

Should I check the ownership of every "somethig_id" fields from a POST request?

I have an endpoint API for a POST request in a multi-tenant application, let's say it is for a Payment, where we have to store these fields: tenant_id (this is the account owner) amount date payer_id ...
user avatar
8 votes
1 answer
520 views

Is masking an entered password security through obscurity?

There is a practice of showing bullets, not characters when a user inputs a password. Is this security through obscurity? My first thought was that it's not, it's not really a system, we know how it ...
user avatar
  • 327
0 votes
1 answer
286 views

What’s the standard used to deploy .env files?

I used docker to containerize the node.js express app and used GitHub action to add the .env file in the container. I googled this method when I was doing the DEV project. But I think that if someone ...
user avatar
0 votes
4 answers
326 views

HOWTO: Full-text search over an encrypted database?

I want to adhere to the best practices and obviously encrypt the data sent to me by user. And I also want to provide the full-text search feature to the user (user can only search their own data, if ...
user avatar
  • 75
0 votes
1 answer
82 views

Javascript and payment security

I'm using a third party CRM application which allows you to build web forms using drag and drop widgets and the ability to add javascript code to manipulate those widgets. I need to build a form to ...
user avatar
  • 291
0 votes
0 answers
26 views

Securing an API in production with Spring Security

At work I have to develop an API that queries data from a Hbase Cluster. They asked me to implement basic authentication in order to secure this API. The use case is very simple. For the moment we ...
user avatar
27 votes
9 answers
7k views

Is it a security vulnerability to declare class members as public?

I have always wondered whether public, protected, and private has security implications post compilation. Hypothetically: class Foo { public: int m_Foo; // Completely vulnerable and dangerous ...
user avatar
  • 3,319
4 votes
1 answer
205 views

If a code inspection tool finds a "heap inspection" vulnerability, is that relevant if the code is for a web app running on a private server?

Recently, at the organization I work for, we've been using a static code inspection tool. One of the more interesting findings is that private information, such as passwords, may be stored in the heap ...
user avatar
  • 2,397
0 votes
1 answer
85 views

How to get the CSRF token when using a cross-origin REST API?

Usually, the web server that is serving a page includes the CSRF token inside the HTML. However when I'm using a cross-origin REST API, there is no "initial" page that could include the CSRF ...
user avatar
0 votes
2 answers
135 views

Do I have too much access to my users' personal media?

This would be a broad question - but I'm asking specific to the situation around an app that I've developed. In short, I've written an app that allows users to persist their photos and videos to the '...
user avatar
  • 21
0 votes
0 answers
28 views

User proof network app with distant database [duplicate]

I’m currently writing a software for my company (3rd world country), and I wanted it as simple as possible to install and maintain, so I started with Qt and no server app beside the database, (MariaDB ...
user avatar
  • 159
1 vote
2 answers
110 views

REST HTTP Response code for a resource that the user is not authorised to access

Suppose user A creates a private resource at, for example, /books/somebooktitle If user B attempts to access the resource at /books/somebooktitle what code should be returned? HTTP403: Permission ...
user avatar
  • 197
1 vote
3 answers
198 views

Is it OK for a public web service to use a database user with rights to execute DDL statements to access its underlying, exclusive database?

I wrote a Java web service using Spring that handles REST calls from the Internet. The web service uses a Postgres database underneath to store, modify and read data. The Postgres database is used ...
user avatar
2 votes
2 answers
241 views

Understanding passwordless sign up for mobile apps

How does phone number based authentication work, and what are its best practices? I've noticed there are apps with streamlined sign-up/log-in processes where only a phone number is required, simply ...
user avatar
1 vote
1 answer
69 views

Exposing redis to external clients

We are building a system that runs on our cloud and that needs information from our clients network that must not be exposed openly. We have concluded that the only way this could work, is if our ...
user avatar
  • 13
0 votes
3 answers
166 views

Should I separate the public and private portions of an application into two separate apps?

So I'm currently running an analysis task for my company. I won't go into too much detail but we are dealing with medical records and other confidential data. Previously this application was only used ...
user avatar
2 votes
1 answer
309 views

Secure way of storing client secrets in Xamarin / Android mobile apps

What would be a secure way of storing client secrets used for authentication (webservices) in Xamarin/Android apps ? Secure Storage, which interacts with Android Keystore, seems very useful for ...
user avatar
0 votes
2 answers
122 views

JWT token security - public key forgery prevention

Question on securing JWT token integrity, given the following scenario: Client sends a JWT to server signed with Client's private key Server caches public key, but uses http (and not https) to ...
user avatar
  • 9
-1 votes
3 answers
141 views

How do web apps provide support without revealing customer data?

I'm on a dev team where the product manager wants to allow internal users to "impersonate end-user and show the site exactly as the user sees it". I argue that this raises security flags and,...
user avatar
  • 149
0 votes
0 answers
45 views

How should I handle keys in production

I'm creating an authorisation service, which does signing using a key. For local development I was randomly generating a key on application start-up. Now I'm deploying to the cloud (currently going ...
user avatar
0 votes
0 answers
182 views

Authorization and Cross-Cutting Concerns in DDD (CQRS) - Filtering Data

We are currently in the early phases of developing several applications that differ significantly in their functionality. As part of building these applications, we have also developed a few generic ...
user avatar
  • 49
1 vote
1 answer
731 views

Authentication with JWT in HTTP only cookie without refresh token

The motto of the upcoming question is "I don't know what I don't know". I would like to know if there are downsides or security risks with an authentication implementation. Right now, I'm ...
user avatar
74 votes
4 answers
9k views

What is the purpose of identifier-first login screens?

Companies like Google and Microsoft use identifier-first screens: where you provide your identifier (like an email) before providing the password. Why is this done, is this somehow more secure? I'm ...
user avatar
0 votes
3 answers
144 views

Is offline secure two party computation possible?

Is there a solution for the following problem? We have a function f(x,y) where the inputs are secret an cannot be known by anyone besides the party that submitted them. The output of f is public and ...
user avatar
  • 9
-3 votes
3 answers
357 views

Should we allow users to write to database directly? How to do it correctly

I'm developing a new application that allows the user to do many writes. Therefore, it is very inefficient that we use our server-side to handle every write request by users. Should we allow users to ...
user avatar
0 votes
1 answer
109 views

Why do users and programs have different client authentication mechanisms?

Typically in any application, the way a user (human) is authenticated is using a username/id and a password, whereas programmatic or api based access is authenticated using API keys (based on system ...
user avatar
  • 145
1 vote
3 answers
352 views

Better than ongoing integer and uuid as primary key

I read a lot about using ongoing numbers vs UUIDs as the primary key and had an idea how it might be possible to combine both and profit from their advantages, without their disadvantages. The table ...
user avatar
  • 119
1 vote
0 answers
38 views

Automatic interaction between API and secured 3rd party API

I would like to create GUI + API that calls third party API as follows: third party API is consumed once a day by my API, GUI user doesn’t have to log in every day (eg. can log in only once every 30 ...
user avatar
0 votes
1 answer
48 views

Should we use an Identity server for our core? [closed]

We are currently making the codebase for our company. In this project we upload user data like users ID card, drive license, bills for identity confirmation and a lot of other sensitive data. My ...
user avatar
  • 103
1 vote
1 answer
55 views

Limiting access to telemetry API only for certain application

Let's consider such an example: I'm an author of application like Google Chrome. I would like to my application sends anonymous telemetry logs to my server. How do I prevent somebody to use my server ...
user avatar
  • 113
2 votes
4 answers
487 views

How to compare passwords which is stored in DB in encrypted form in secure way?

Recently In an interview I was asked this question - Question- If are storing passwords in encrypted format in DB and in future when user login into our website how will we perform authentication? Me:...
user avatar
  • 147
0 votes
3 answers
85 views

How to create a code that will be send by SMS to verify that it's a valid phone number? [closed]

I'm creating a mobile app that will have a verification process of the phone number like most of apps do when they use your phone. I'm also developing the back-end but I don't know exactly what is the ...
user avatar
  • 329
1 vote
3 answers
214 views

Should I keep in the database a record of the user accepting the terms and coditions?

Most of applications, when you sign up, you must agree with some terms and conditions. Should the information that the user agreed to those terms be saved in the database? I asking this because I'm ...
user avatar
  • 329
0 votes
1 answer
107 views

How to use an API key without knowing it?

let's say I would like to create a service like eToro that allows people to trade stocks but with their own brokers. If I do it just for me, it's pretty straightforward: create logic that replicates ...
user avatar
  • 9
1 vote
3 answers
173 views

Is it a good practice to isolate the database from public APIs?

We develop web-applications using a javascript frontend framework (ReactJS), to retrieve the data to show, the user's browser calls an authenticated REST API which is our backend (Kotlin+Spring), the ...
user avatar
  • 119
4 votes
6 answers
409 views

Error messages and security concerns

What is considered good practice for application security wise when returning errors from a backend API? I have inherited a project with a lot of technical debt, which I intend to improve. One ...
user avatar
  • 1,764
-2 votes
1 answer
46 views

mask username and password in service file, or better approach

At work there is a given task where a python application is currently running on a server, this application is using a enviorment file, which has username and password information. The current ask is ...
user avatar
-2 votes
1 answer
36 views

Securing the REST APIs - Security Framework (Technology) V/S Custom

There are many ways to secure the REST APIs, from authentication and authorization view point. Below are the two which I know so far: Using existing token based IAM solutions like Okta, KeyCloak, ...
user avatar
1 vote
1 answer
90 views

How to randomly allocate a set of IDs digitally, one ID per person, such that everyone knows that the particular allocations are kept private?

I have a set of UUIDs that I want to assign to a set of people. I want to deliver these UUIDs to people in a secure manner, such that everyone knows that I do not know which UUID corresponds to which ...
user avatar
-1 votes
1 answer
56 views

Protecting cryptocurrency private keys in a corporate environment

Now that Tesla has bought a large amount of BitCoin, other companies may follow suit. If my company wanted to do that, I was thinking about how it could be done. I'm familiar with the way private ...
user avatar
6 votes
2 answers
270 views

What are best practices for enterprise software, should a developer be able to login as one of its users? (when its your own company)

My company has its own proprietary software that I have both built and maintained over the last 5 years I am about to release a big change for all of my software to use OAuth2 instead of handling ...
user avatar
  • 287

1
2 3 4 5
18