Questions tagged [security]
For questions relating to cryptography and IT security. This can be computer, network, or database security.
915
questions
0
votes
0
answers
45
views
isolating user run scripts on docker without performance impact
Scenario:
We have a application (web based), in a small part of this application a users is able to create a small python script to mutate (in memory) data. Currently all of these scripts (if it is ...
- 375
0
votes
4
answers
850
views
Open ID Connect Session Management Access/Refresh Token vs Session iFrame
We have a web app in which we allow users to log into the app using any Open ID provider(e.g. Okta, Google, Facebook etc.). We want to implement the correct Open ID Connect prescribed methodology/...
- 75.6k
1652
votes
11
answers
832k
views
Which hashing algorithm is best for uniqueness and speed?
Which hashing algorithm is best for uniqueness and speed? Example (good) uses include hash dictionaries.
I know there are things like SHA-256 and such, but these algorithms are designed to be secure,...
- 46.2k
0
votes
2
answers
312
views
Keeping user provided passwords to 3rd party services safe
I have a SaaS application in which users can connect their RDBMS (postgres, mysql etc) and query data from it. I'm wondering what's the best practice to keep their connection details safe. Currently, ...
CommunityBot
- 1
0
votes
2
answers
138
views
Allow command execution in config file?
My friend and I are developing a screenshot tool for Linux where the screenshot can be saved into a clipboard by using an external tool like xclip or wl-clipboard.
Since there are even more clipboard ...
- 1,750
0
votes
1
answer
163
views
Should I store session id in server database?
I wanted to implement login system using flask framework. I managed to do this using sessions and set them to expire after 31 days and it works (sessions are created using server secret key, timestamp ...
- 6,830
1
vote
1
answer
111
views
Security: Send CompanyId on the http header
I have a web app which authenticates the user using an external identity provider (Microsoft Entra with MSAL library).
This give us an access token to access our API.
After authentication (so, we ...
- 6,830
0
votes
2
answers
161
views
How best to securely store a password for automated access (no user interaction)?
I'm facing the classic chicken/egg problem of where to store the keys to the kingdom.
I'm building an application for retail distribution that will rely on receiving a cadence of regularly-issued Let'...
- 9,365
0
votes
1
answer
117
views
Java Security, How important is the version of JDK for building vs running the Application
How important is the minor version of the Java Build SDK vs. the JDK version at runtime, is it a problem if the minor version is a bit outdated, if the run time version is still up to date?
More ...
- 207k
38
votes
19
answers
27k
views
How do you prevent the piracy of your software? [closed]
Is it still worth it to protect our software against piracy? Are there reasonably effective ways to prevent or at least make piracy difficult?
- 107
0
votes
1
answer
74
views
How to control, or moderate, files uploaded with a bug report?
Presume a desktop application presents a Problem Reporting interface as part of it's GUI, and I wish to allow users to upload files as part of that PR.
One would hope this is only ever used for ...
- 2,338
2
votes
1
answer
60
views
Azure Managed Identity and Zero Trust
Azure Managed Identity provides a mean to only allow explicitly defined users/apps to access a given resource. For instance I can setup that no-one can access my database except the Managed Identities ...
- 74.7k
5
votes
2
answers
6k
views
Is sending username via custom HTTP header good idea?
I have a route in a RESTful API where I need to pass a single username (email address) but not password. The route is designed to have GET method, so my options are either query parameters or a custom ...
- 31
1
vote
2
answers
2k
views
What’s the standard used to deploy .env files?
I used docker to containerize the node.js express app and used GitHub action to add the .env file in the container. I googled this method when I was doing the DEV project. But I think that if someone ...
- 11.5k
0
votes
0
answers
55
views
Maintaining modularity while keeping (secret) configuration separate from application code
This is more a curiosity/query-for-information than anything; apologies if it's thus a little malformed:
This is relevant to a useful API-querying library that can be shared across multiple teams ...
- 101
1
vote
2
answers
329
views
Restricting access to sensitive data in monorepo
Imagine that you have a large monorepo code base running as a monolith application. This application is backed by a database. Some of the data in the database is sensitive, so you want to restrict ...
- 82.7k
1
vote
1
answer
740
views
Creating a web portal to access multiple databases (security and best practice?)
I am looking to create a website.
There will be a portal, from which the user (and thier associated users) can create/access one or more databases. There will be many different databases in the ...
- 1
3
votes
2
answers
2k
views
Are there security implications to using dynamically-assigned TCP port numbers?
I'm getting pushback from operations for having a server process listen on a dynamically-assigned port number (i.e. it binds a socket to a port number of 0, triggering a dynamic assignment by the OS, ...
- 1
28
votes
6
answers
9k
views
Is it worth even checking to see if Guid.NewGuid() is Guid.Empty?
In one of the projects I'm working on the following pattern is seen on a fairly regular basis:
var guid = Guid.NewGuid().ToString();
while (guid == Guid.Empty.ToString())
{
guid = Guid.NewGuid()....
- 119
0
votes
0
answers
47
views
How to handle roles and scopes using oauth2 auth flow
I'm using python and fastapi with oauth2 flow (just for clarification as the question isn't language specific).
I'm confused on how to implement scopes in an efficient and secure way. I was thinking ...
- 101
1
vote
1
answer
86
views
Safe Plugin Architecture for Python Web API
I am making a web application for parameterized procedural world generation. Given the computational resources involved, this application involves a server backend for generating the world with an API ...
- 6,830
1
vote
1
answer
124
views
Open source projects, SBOMs and security
I was just reading a StackOverflow question here, about extracting the version number from a node package.json file. And the simple
'read in the json and access the property in your build tool'
got ...
- 207k
1
vote
3
answers
186
views
Handling a Refactoring Project with Limited Access to Source Code
I recently finished an interview with a company as a web developer. I'm the first and only developer that is about to be hired in this company.
They have a web application that was created by a ...
- 75.6k
1
vote
2
answers
87
views
Are mature dependencies less risky than state of the art ones?
There are tools like dependabot or greenkeeper for npm and others for other languages. Now at first glance they improve security by keeping open source dependencies up-to-date. But I am wondering, do ...
- 11.4k
0
votes
0
answers
182
views
Should we use sessions instead of bearer tokens with OpenID Connect server-side authorization code flows?
I want to build an app with a SPA (Angular) frontend and a REST API (Spring Boot) backend.
I want a modern account system for this app: users log in through OpenID Connect, using either a social login ...
- 141
21
votes
9
answers
829
views
Citations for inadvisability of globally unique password
I am having a disagreement with a client about the user authentication process for a system. The nub of it is that they want each user to have a globally unique password (i.e. no two users can have ...
- 45.1k
9
votes
8
answers
7k
views
Is Password Hashing Bad?
In software design and security, why would it not be a good idea for users to send you their passwords and it would be a better idea to delegate: use public-key auth or logging in with one of these: ...
- 27.3k
7
votes
5
answers
5k
views
What type of Password Reset/Forgot Password (verification) mechanism would you recommend
I am looking for ways to verify the user in order to reset their passwords. 2 commonly used ones:
Email verification
Secret question
I wonder which will you recommend? I am trying to avoid having to ...
- 101
2
votes
1
answer
121
views
EU Cyber Resilience Act - Conflicting Requirements? [closed]
As a fellow SW developer in EU, I hope that you know that there is a proposal for a new law, called Cyber Resilience Act, that will, if approved, will affect all digital products on the EU market.
In ...
- 3,045
1
vote
1
answer
166
views
Is it more secure to develop libraries in-house than using existing libraries? [closed]
I (unfortunately) work in a large German corporation, in a department where the codebase is up to 20 years old, written in C++ (actually more like C with the occasional classes, since most developers ...
- 18.4k
-1
votes
2
answers
232
views
Are Physical Firewalls mandatory
I have a Delphi software application that uses non standard port nnnnn to nnnnn+50 with the FTPS protocol TLS 1.3
Until now I was suggesting my customers that the Server Side application needs to have
...
- 6,830
1
vote
2
answers
202
views
Best way to protect action links from CSRF
An application has a multifactor login.
The user logs in with its e-mail and password, and then the following screen asks for a one time password received via e-mail or generated by a mobile app.
In ...
- 37.2k
0
votes
0
answers
40
views
Cascading ACL to embedded objects
We have an object Root, which references many other objects. Which eventually is translated into FKs on the DB level. We came up with an ACL scheme where there's a separate permissions table with the ...
- 37.2k
18
votes
9
answers
5k
views
Authentication and authorisation for people with intellectual disabilities
Currently, I'm involved in a research project in which we are evaluating an existing web environment providing a safe online playground for children/adolescents with intellectual disabilities. Certain ...
- 14.6k
24
votes
3
answers
12k
views
Should UDP data payloads include a CRC?
For a company I used to work for, I had to implement a socket receiver that mostly took data in UDP form over a local connection from some specialized sensor hardware. The data in question was a well-...
2
votes
1
answer
855
views
Client Side Hashing + Server Side Hashing
Suppose one plans to implement authentication for their web app. There have been cases, like with Instagram, where passwords were accidentally stored in plain text due to logs.
While we'd hope to ...
- 141
0
votes
2
answers
293
views
Best practices for a new application to be ready for post-quantum cryptography
Suppose today I'm designing a new application that will employ asymmetric cryptography to allow users to securely exchange data with one another. As far as I can tell there are no quantum-safe ...
- 134k
60
votes
16
answers
14k
views
Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?
The way I see it, SQL injection attacks can be prevented by:
Carefully screening, filtering, encoding input (before insertion into SQL)
Using prepared statements / parameterized queries
I suppose ...
- 45.1k
0
votes
2
answers
204
views
How to best protect a public API from unwanted requests
I’ll try my best to explain, but for the closest context I could think of, imagine that I am building an analytics platform that allows paying users to sign up, place a tracking script on their ...
- 3,338
1
vote
1
answer
100
views
Is my security pattern correct for authenticating principal users to my microservices?
We are trying to implement an authorization and authentication service for our product.
Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
-1
votes
1
answer
76
views
What is the best way to authenticate a user over IVR?
I am trying to build an IVR system that requires some form of username & password/pin entry to access sensitive data. My naïve solution seemed obvious enough, until I realized that username/pass ...
- 75.6k
0
votes
2
answers
161
views
The best way of preventing unauthorised API use and reducing costs of declining API requests
To best explain my context, imagine that I’m creating an alternative piece of software to google analytics (since my personal project’s principle is similar). Each unique user creates an account and ...
- 13.4k
45
votes
5
answers
7k
views
SQL sanitizing in code with no user input
In my company's codebase, we hardcode sql queries without using an ORM.
Here's an example of a query we would run:
UPDATE client SET status="active" WHERE client_id=123
Since the query is ...
- 324
19
votes
2
answers
16k
views
REST API security: HMAC/key hashing vs JWT
I just read this article that is a few years old but describes a clever way of securing your REST APIs. Essentially:
Each client has a unique public/private key pair
Only the client and the server ...
- 121
0
votes
1
answer
208
views
Is it secured to accept and execute user provided CURL commands
Assume you have to figure out a dynamic way where the user can provide an API call to hit in the backend
for example, user to provide a webhook to call on his end server
So, An idea for users to ...
- 134k
0
votes
0
answers
51
views
SSO Application Storing a Custom Secret in the User Profile
I have an application that employs "zero knowledge" data security, where even with full backend access to our application, customer data cannot be read without knowing their individual ...
- 119
1
vote
1
answer
251
views
How to manage autorization for internal service to service communication in a microservice architecture?
At deployment time, I register my microservices in the following way:
They register themselves in Keycloak to have an identity as a confidential client;
Then they call an endpoint on a dedicated ...
- 3,212
5
votes
5
answers
531
views
How do you keep logins organized between multiple developers?
I've worked at several places with 2-10 developers and each place has struggled in the area of tracking if the company has an account on a given web site or service. We're always left wondering...
...
- 27
3
votes
1
answer
241
views
How much should we spend on improving software security?
Is there a "scientific" method to determine how much resources/money should be spent on improving the security of a piece of software?
I work in a team where our work is prioritized by a product ...
- 200k
1
vote
3
answers
261
views
Are interchangeable types a security vulnerability? Are they good vectors for attack?
Suppose you are given a python API:
def onArgumentReceived(x):
doWhatever(x) # expects a unicode string
I am not a security expert by any stretch of the imagination, however on the face of this, ...
- 207k