Questions tagged [security]
For questions relating to cryptography and IT security. This can be computer, network, or database security.
804
questions
4
votes
1answer
149 views
How to protect potential attackers from finding emails that are already registered?
It seems common practice to not positively indicate during a password reset attempt whether the email requested is actually registered or not. This makes sense because knowing that an email is ...
-2
votes
0answers
30 views
How can I manage multiple .env files with sensitive values?
I'm trying to adopt the .env convention across multiple projects and environments. So in theory I have the following collection of .env files:
PROJECT - ENVIRONMENT
projecta - Testing
projecta - ...
-1
votes
0answers
49 views
Microfrontends architectural approach - initial load and security considerations
I've been going round and round in my own head with this, so I'm looking for some feedback on a micro-frontends approach I wanted to take for a project (obviously I wouldn't overcomplicate anything ...
0
votes
2answers
87 views
What's the pattern to share database to other module in security perspective?
In a large iOS application, I have a database module which is dedicated to handle application databases with read/write public APIs for other module. UI module has a feature to share the database, in ...
0
votes
2answers
67 views
How can I protect sensitive information inside a binary?
I am currently developing an application with Qt/C++ which needs to access a Shopify store using the Admin API. In order to access the API, my application needs to know the following information:
API ...
1
vote
1answer
30 views
Designing Kafka topics for secured event driven job scheduling system
Consider the following
Group A
Job A {
Depends on Job B of Group A
Run User -> User1
}
Job B {
Depends on Job C and Job D of Group A
Run User -> User2
}
Job C {
Depends ...
-4
votes
0answers
29 views
Design for revoking API keys
Imagine running a publicly available REST API which only users have access to which do have an API key. If the API key of a user gets compromised it is advised (for the users sanity) that this key ...
1
vote
0answers
14 views
Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database
I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
1
vote
1answer
66 views
Do you need to implement TLS versions < 1.3 if you were to implement a TLS supporting library today?
I am looking at all the green and red boxes here, and am wondering what it would look like if one were to "implement TLS" today? What should you implement if you were to implement TLS today?
Do you ...
0
votes
3answers
146 views
hash-like algorithm to identify passwords which are “too similar” to previous ones from history
One common issue with secure passwords is that users tend to "cheat", one common cheating pattern we meet recently is the "password swap" antipattern where the user basically keeps using the same two ...
1
vote
3answers
524 views
How can we learn from Flash's vulnerabilities? [closed]
The main reason, to my understanding, that Flash is being phased out is that it is fundamentally insecure (i.e. it isn't just tons of individual issues; it's insecure on a 'core' level). I severely ...
-4
votes
2answers
58 views
How do browsers isolate traffic within a single tab?
I know that browsers use a separate port for each tab. However, in each tab, there might be multiple scripts doing data transfer over the network. How does a browser makes sure that the data is ...
0
votes
1answer
55 views
How should I distribute my app with my own OAuth2 client ID, without letting anyone find it out?
I've written an app using golang which uses OAuth2(Authorization code flow with PKCE) to interact with the Gmail API.
If I build the app using my own client ID then my client ID can easily be found ...
2
votes
0answers
28 views
Api Authorization for first party apps and third party apps
I have a few microservices that i would like to combine in form of an api. The main purpose of the api is to be used by our (first party) mobile app. A side note, we don't have a mobile app or web app ...
2
votes
1answer
88 views
How do projects manage security with so many dependencies in open source projects?
Some node.js libraries (just as an example) can pull in literally hundreds of dependencies. Some of these dependencies are small packages that only have one contributor. Often times the contributor ...
3
votes
1answer
38 views
Storing username and password for another site in Node and MongoDB
This is not about storing my user's login details in the app, I already use hash and JWT tokens for that. There is a part of our app where we need to store the login details of the user for another ...
3
votes
3answers
137 views
How does authentication work for offline software?
I am wondering how software with premium modes, such as Spotify, can operate offline. If a user is not connected to the internet, then they cannot authenticate via a remote server, which has e.g. a ...
1
vote
0answers
51 views
Using Azure AD MSAL as only authentication solution for SPA
I have an Angular SPA and I spun up my own basic form-based authentication using a .net core web API and SQL server to store user accounts / hashed and salted credentials. This is obviously not an ...
1
vote
2answers
136 views
Does POP suffer from any inherent security problems
I recall seeing a large email corporation discourage POP client access, suggesting it was insecure.
Assuming this is not FUD meant to encourage adoption of their client, I am wondering whether either ...
-2
votes
4answers
186 views
Is it required for an app developer to know information security?
So I've been an indie apps developer for 2 years (I launched my first Android app at the end of 2017), and I've built few apps since then, but all of them were simple apps.
Currently I'm planning my ...
1
vote
0answers
73 views
How to trust servers in a network where anyone can add its own
I'm building a multiplayer game where anyone can add its own server but there is only one central server that contains the database where player information, like experience and gold, are stored. To ...
0
votes
0answers
11 views
Programmatic Application login into Jhipster Application
Let's say you have created a monolithic jhipster application with JWT authentication and where typically the login is by a user registering themselves and activating through email:
Let's say that ...
2
votes
3answers
162 views
Securing REST API with authenticated user
I want to build a REST API but I have some holes when it comes to the security part. I would like to get my head around how to authenticate the calls to the API.
Therefore, this is my first draft for ...
2
votes
3answers
225 views
Is it good or bad practice to use the user email in two separate columns of the user SQL table?
I'm fairly new to web development and I have a bit of a weird question.
I'm currently working on a personal project that may or may not eventually become a real, commercialized product.
In my ...
0
votes
0answers
57 views
How can i implement two way asymmetric encryption for my app and backend server?
I'm planning to setup a hybrid encryption procedure in my app. So basically i did encryption for data send from client to server using this method, now i'm confused on how to encrypt data send from ...
2
votes
1answer
63 views
Delegating authorization across multiple API's
I'm building a multi-tenant system that consists of one (SPA) client, calling multiple API's, all under my control.
User authentication is done with OpenID Connect, I'm sending an ID and access token ...
3
votes
2answers
162 views
Does removing unused features from libraries through compiler flags increase or reduce security risks?
Software libraries targetting resource constrained environments like embedded systems use conditional compilation to allow consumers to shave space and thus increase performance by removing unused ...
4
votes
4answers
237 views
How is memory unsafety generated, found, exploited and fixed?
I'm not a low-level programmer, I mainly program in C# which is a managed language. Still, every now and then I read articles, news and patch notes about the most varied software talking about memory ...
0
votes
1answer
41 views
VNC security: SSH tunnel from local machine to VM necessary?
SETUP:
Local Windows 10 machine. It runs a VM (Ubuntu Server, NAT, Virtualbox)
QUESTION:
I want to make a VNC connection from my Local machine to the VM. Since VNC is not a secure protocol, it is ...
0
votes
0answers
32 views
How do I properly secure a Spring Boot app serving server-side rendered pages and API?
I'm wondering how do I properly secure this example app (https://github.com/brunodrugowick/spring-thymeleaf-vue-crud-example).
The app is:
A Spring (Boot) app with server-rendered pages via ...
1
vote
1answer
19 views
Identity Server 4 Authentication - Security questions around using the same API for internal application and third parties
So, I have an API that authenticates with Identity Server OAuth2 and gives our user a JWT token when logging in through a front end application, this is a token that has access to everything.
The API ...
1
vote
1answer
144 views
License control for an on-premise application
TL;DR How do you build an airtight license control system for your onprem application, which revokes access once subscription ends?
Premise
I am building this application in Python that needs to ...
2
votes
1answer
64 views
Does putting a serverless application in a VPC make it more secure?
I have an application which uses lambda and fargate (task) containers for compute, EventBridge for communication, S3 and DynamoDB for storage and exposes data out via an API Gateway.
From my ...
2
votes
1answer
149 views
Why is it fine to use a user's ID in their JWT, as opposed to their email/username?
I'm wondering whether it is bad practice to keep a user's ID in a JWT.
I'm planning on using the email in the sub, since it's already available to them, and I can use it to identify them, all the ...
-1
votes
1answer
48 views
How does separation of duties work between the kinds of workers described below?
I'm trying to understand how separation of duties works between various job functions as a security measure. For starters, there are computer (hardware) operations, applications programs, and systems ...
0
votes
2answers
98 views
PHP preg_replace() vs filter_var()
I have seen numerous posts on this subject but none really answered my questions.
I have some user input that is inserted into my DB and displayed back to the user later. Before inserting it into the ...
1
vote
4answers
103 views
How can I store an user's capabilities to boost performance while allowing real-time updates of said capabilities?
I'm ingesting 150 objects that each require an user capabilities check, the function isUserAdmin tells me whether or not an user is an admin or not. Inside this function, there's a lot of deeper ...
0
votes
0answers
49 views
Which authentication should be used for external users (not registered with the system)
I'm working with a project that uses ASP.NET Core 2.2. The main solution contains different projects, including APIs for a mobile application, APIs to integrate the system with third parties, a web ...
21
votes
9answers
8k views
Is this scenario an exception to the rule of never storing passwords in plaintext?
I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
3
votes
1answer
39 views
Securing a voice assistant skill/app - any established patterns?
When creating new skills/apps for a voice assistant such as Google Home or Amazon Echo, are there any established patterns for providing an extra level of security for certain actions that go beyond ...
-1
votes
1answer
75 views
How can I securely store and process user data?
I am creating a Discord Bot in Discord.Net. So first, of course this bot is not a professional project, but I still want it to look as professional as possible. And a huge part is the storage and ...
3
votes
1answer
102 views
Is it possible to spoof a recipient in a SMTP transaction? If not how does SMTP prevent this from happening?
Is it possible to have a scenario where there are 3 email addresses. Each on a different mail server.
alice@contoso.com
bob@fabrikam.com
charlie@treyresearch.net
Charlie writes an email with Alice ...
0
votes
0answers
39 views
Is it a good practice to store session in two different places?
I have a use case like this and I am wondering if this solution is a good practice or not.
Say I have a website called dashboard.com and this is only for US region. When users login here, I am ...
0
votes
1answer
57 views
Check that a POST request is the origin of the application and not of a user
Hello,
I want to secure access to a POST request so that the user cannot forge it via software such as postman.
Let’s say a player plays a game and gets a score. At the end of the game, the score is ...
1
vote
4answers
199 views
REST API include permissions into resource
We currently have REST API, where you have a set of different resources, like:
GET /cats
GET /cats/{catId}
GET /dogs
Clients decide whether they can perform an action based on resource permissions. ...
-3
votes
1answer
60 views
Protecting research source from spyware/data mining
My question is simple: What steps should you take to protect research from the vast amount of spyware or insecure applications on a given device?
Background:
I do research into developing new models ...
1
vote
2answers
124 views
Develop a distributed pointer in C++
I s it possible to develop a distributed memory pointer in C++ by using operator overload?
The idea would be that you pass ip address and port to the overloaded pointer *, &, and the pointer ...
2
votes
1answer
60 views
Role based authentication/authorization security
I have my backend endpoint for registering and logging in the users delivered trough RestApi or GraphQL to be more specific.
I want to implement role based system for my users.
The admins and ...
1
vote
3answers
160 views
Why would you cut off your continuous integration system from the internet?
I read that Facebook's continuous integration environments are cut off from the internet for security and reliability reasons.
What would these reasons be? Is this a common practice?
1
vote
1answer
29 views
Storage of Per-Device Keys in Database?
In the context of many devices being secured with their own symmetric key (think: thousands of IoT devices), is it reasonable to hold these secret keys in a MySQL database?
The goal is to verify the ...
