Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
4
votes
1answer
243 views

How can social security numbers be safely stored in databases and retrieved?

How can personal information that needs to be retrieved at a later date be stored securely in a database? For instance when companies store social security numbers and use them for taxation purposes. ...
0
votes
1answer
83 views

Custom ACL Implementation

I have been trying to figure out an ACL solution for my application which should manage API endpoint's access rights dynamically. Some said that I have an option of Spring Security ACL. I checked it ...
1
vote
2answers
40 views

Application certification for Microsoft Office VSTO solutions

A potential client is very interested by a VSTO product we developed. However, their IT department is concerned wether they should trust this sofware. Mainly, they are worried it could expose a ...
0
votes
1answer
48 views

How to prevent angular 2 client from accessing privileged fields

I'm learning angular and have been reading about various backend solutions like direct db access, REST, and graphql. One thing I haven't seen addressed anywhere yet is how do you protect privileged ...
-4
votes
1answer
48 views

How to detect that internal hard disk is removed and which files were copied? [closed]

Its easy to steal internal hdd, which do not generate sound signals to aware the owner while removing and allows Thief to copy the data. Is there any way by which these thieves acts can be traced.
21
votes
5answers
21k views

Where to store the private key?

Say I want some parts of my software to be encrypted. For example, the credentials for a database, etc. I need to store those values somewhere, but doing so in cleartext would make it easy for an ...
26
votes
5answers
9k views

Is it possible to read memory from another program by allocating all the empty space on a system?

Theoretically, if I were to build a program that allocated all the unused memory on a system, and continued to request more and more memory as other applications released memory that they no longer ...
2
votes
2answers
163 views

Wrapper Class Should be made static?

I am planning on creating a wrapper class in c# which will call cryptographic functions provided by .Net Framework, just to make sure I am clear, I am not writing any cryptographic algorithm, just ...
1
vote
1answer
78 views

Client Side Hashing + Server Side Hashing

Suppose one wishes to implement an account system for their service/website. There have been cases with Instagram for example where passwords were accidentally stored in plain text due to ...
1
vote
1answer
61 views

Allowing a dynamic list of IP addresses to access a specific port in an AWS EC2 Instance

The problem I am trying to solve today is DDoS. I am working on a game project which is hosted on a TCP port (7777). The game is known to have a community full of idiots (pardon the language) that do ...
2
votes
1answer
121 views

Do i need to implement Security for my webpage, if it is only connected to a LAN

I am making a websocket server that can communicate with clients. This server is going to be on a private vLAN channel on a public place, AKA only the staff have access to the network which the ...
0
votes
1answer
27 views

How to dynamically create and assign user permissions for a group based service

tldr: In building a platform where users can create private groups, and invite other people to those private groups, how is it be to secure those groups? I'm building a platform around private groups ...
0
votes
1answer
529 views

Are there any JSON based notations for Access Control Lists? (Alternative to S-Expression)

I'm looking for a notation that is familiar to modern developers and can supersede s-Notation. (additional insight into Rivest's proposal of s-Expression is here) Is there any Swagger, JSON or other ...
0
votes
0answers
55 views

What is the correct way of setting and then differentiating between paid and free user in Firebase / Firestore?

I am developing a mobile application that will have both free and paid versions. The way I see how I could differentiate between what is a paid and free user is to set a property isPaid on their ...
1
vote
3answers
4k views

Is providing a user login a functional requirement of a system?

Is providing a user login a non functional requirement? Since this is concerned with security which is a non functional requirement, I feel that providing a user login is also non functional but ...
4
votes
4answers
2k views

Why must API keys be kept private?

I have worked with public API's in only one small project, but I recently learned that if one were to distribute a project with API keys inside this is a security risk. So I have two questions: What ...
0
votes
1answer
67 views

Api limit access to subscribers only

I have a vanilla php api(on a vds) and I want to make data coming from that api available to a few clients that are using a python app that's also written by me. That python app is running on my ...
9
votes
2answers
3k views

Should access permissions and roles be included in payload of JWT?

Should information about the permissions and roles of the client be included in JWT? Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
2
votes
0answers
55 views

Securing a microservice that will be accessible from frontend

I need an advice on securing interaction between an application App and a microservice RecordApp. App is the main application, where all users are registered and do some activity. RecordApp is a ...
-2
votes
2answers
120 views

How do I ensure my product is correct the first time? [closed]

I am working on a product that will not be able to be updated once released. Furthermore, if the product malfunctions, the results may include death, serious bodily harm, or major financial setbacks. ...
-1
votes
1answer
46 views

Buffer Overflows and Out-of-bounds Writes [closed]

What is the difference between buffer overflows and out-of-bounds writes? Are buffer overflows a kind of out-of-bounds writes?
0
votes
1answer
45 views

rest service with digitally signed parameters

I'd like to build a rest service that will accept objects that has digital signature. This service has to support both xml and json data serialization formats. I'd like to use .Net core framework to ...
0
votes
0answers
47 views

Prevent token sharing: chained single-use tokens VS a designated invalidation feature

Situation: A Client is requesting a resource from a Host multiple times, usually with minutes or hours between requests. The Client has a signed, verifiable token, which we'll call a Receipt, that ...
4
votes
1answer
144 views

Architecture to lock account to mobile device

I'm currently creating a mobile app and have the following issue. I am required to only allow the user to login from a device that is registered to the users account. A user can have up to X number of ...
8
votes
1answer
389 views

Securely sandboxing user scripts in a C++ program

I've been working on a personal project in C# whose purpose is more or less to allow the user to execute scripts written by other users and restrict the permissions of that script. My program compiles ...
4
votes
2answers
343 views

Are there any widely accepted sets of standards/practices for secure coding? [closed]

The title should be fairly self-explanatory. We need to update our coding standards, and as part of this process we've been asked to try and follow an industry standard from a recognised/...
0
votes
0answers
23 views

Save user credentials for use with multiple third-party websites

I've seen a few similar questions but nothing to address this exact issue... I'd like to have a mobile app that allows users to input username/password once and then be automatically logged in with ...
1
vote
0answers
118 views

How to store relational data belonging to different client customers?

My users will be businesses with a small number of accounts each: e.g. Business #1 with 3 users, Business #2 with 5 users, etc. I am trying to determine the best way to organise the relation (on ...
2
votes
0answers
69 views

What's the best way to control distribution/usage of proprietary, internal software?

I was tasked with writing software for my company. As I am now writing a third program (with many more coming), what's the best way to control the distribution/usage of our software? The software I'...
1
vote
3answers
9k views

Is using dirname(__FILE__) a good practice?

Looking at the code of Joomla I see that in the first line of the index, it defines the base path of installation with dirname(__FILE__). Is this a possible risk for the site? If a non controlled ...
1
vote
1answer
92 views

How to store private ssh keys for my application?

I 've a pair of private and public ssh keys, which I'm using in encrypting and decrypting my JWT. So I'm creating and signing my JWT with my private key and shared the public key with the client who ...
0
votes
0answers
17 views

W3C Reporting API - Mitigate spam/forged reports

I'm looking into the W3C Reporting API, which enables websites to instruct the client (browser) to send reports about: browser crashes, network errors, browser interventions etc. ouside the JS ...
0
votes
2answers
134 views

How do companies store private keys offline but still sign code with them?

I've heard that companies store their private keys offline "in a safe that will never be opened" and stuff like that (the context for this is a console developer like Microsoft keeping the Xbox ...
0
votes
1answer
52 views

Designing anonymous registration website

I am developing a website where customers can register products they bought in order to receive a benefit in the form of e.g. a cashback, a discount or promotional goods. In the future, we also plan ...
0
votes
0answers
10 views

Open ID Connect Session Management Access/Refresh Token vs Session iFrame

We have a web app in which we allow users to log into the app using any Open ID provider(e.g. Okta, Google, Facebook etc.). We want to implement the correct Open ID Connect prescribed methodology/...
2
votes
1answer
106 views

Is it possible to create once loadable files?

I know very little about encryption, so I figured I'd ask the internet if it's possible to do the following (and if so, what kind of algorithm should I be looking at): Write some code that saves data ...
1
vote
2answers
41 views

JDBC Connection Url Logging - Security Risk

In one of the existing batch process codebase, I can see a practice of JDBC Connection String is getting logged and also persisted. Logging or Persisting a JDBC Connection String alone may not be a ...
0
votes
4answers
56 views

Extent of Administrator Capabilities: HR and Design Logistics?

So I am developing an employee management application on behalf of a company and am concerned about the extent of rights and capabilities that are to be bestowed upon registered administrator accounts....
0
votes
1answer
75 views

Is it a bad thing to delegate a callout to an external system, given that my current one can't do it?

Custom code written for the Salesforce platform is incapable of making a PATCH request to an external server (PUT and POST are okay though), and I need to make a PATCH request to an external service (...
0
votes
0answers
34 views

How to restrict API endpoints which are deployed in AWS Application Load Balancer?

I created one webapi application which includes few modules like account, user etc and overall includes 10 or more endpoints. I deployed this in EC2 instances and configured in application load ...
3
votes
1answer
214 views

Does it make sense to authenticate a method that exposes non-sensitive data

We're developing an Angular application that consumes a web method exposing some information that is not sensitive, just bus seat promotions; the user enters where he wants to go and when and he will ...
1
vote
1answer
84 views

Is it more secure to use more PKI keys?

Consider a token issuer/validator. Every token is PKI signed. Is it more secure to use a new key-pair (performance could be ignored for now) per request or is it no difference to have only one key-...
0
votes
0answers
39 views

Which OAuth2 Flow?

I'm just getting into OAuth2 and I'm a tad confused (you've probably heard that before)! I am writing a small independent service which will expose a basic REST API enabling client applications to ...
3
votes
4answers
253 views

Is a cookie hash that matches with file hash safe?

I've made a simple login form. It's made very generic to be used for any project. Now I wonder if the security is good enough and if my approach is safe. On success When successfully logged in I do ...
3
votes
1answer
125 views

How to authenticate devices across organisation boundaries without a third party CA

I'm currently working on a protocol which passes automated instructions between separate organisations. I'm looking for a way to delegate authentication of devices to which ever organisation a device ...
2
votes
3answers
5k views

How do I / what is the best way to interact with a desktop application from a browser web application?

Situation: We have a desktop application. We also have a web application. We need the two to interact with each other. So when a button is pushed in the web application, the desktop application ...
1
vote
1answer
108 views

Should usernames and passwords to external systems be documented?

This is basically an extension to my previous question. That time our internal discussions didn't end up anywhere and the whole issue was forgotten for the time being. Now we've touched upon it again,...
1
vote
1answer
76 views

How to safely allow different end users to insert data into a table stored in an Oracle database?

This is a basic question, but I don't have any sense of what other developers do in this scenario. The Situation I am creating an interface to allow end users to insert and update data in a table ...
1
vote
0answers
123 views

Is my microservices architecture in line with best practises? (STS/SPA/Frontend API/Backend services)

My goal is to make an application with a SPA front end that updates in real time, incorporating microservices architecture (and for solutions CQRS design patterns and eventing with Azure Service Bus). ...
1
vote
1answer
226 views

Breaking 3-tier architecture into multi-tier architecture

Recently I have been working on a rather large system with Vue.js for a single page app (SPA) and an API for the backend. The customer is concerned with the security, performance and maintainability. ...