Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
37
votes
19answers
22k views

How do you prevent the piracy of your software? [closed]

Is it still worth it to protect our software against piracy? Are there reasonably effective ways to prevent or at least make piracy difficult?
75
votes
17answers
53k views

How can software be protected from piracy?

Why does it seem so easy to pirate today? It just seems a little hard to believe that with all of our technological advances and the billions of dollars spent on engineering the most unbelievable and ...
26
votes
5answers
7k views

Data input validation - Where? How much? [closed]

Data input validation always was quite an internal struggle to me. On the verge of adding a real security framework and code to our legacy application rewrite project (which so far pretty much keeps ...
96
votes
8answers
67k views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
61
votes
15answers
17k views

Is there any reason not to go directly from client-side Javascript to a database?

Possible Duplicate: Writing Web “server less” applications So, let's say I'm going to build a Stack Exchange clone and I decide to use something like CouchDB as my backend store. If I use their ...
27
votes
5answers
16k views

What best practices should be employed in a PHP login script?

I am wanting to re-write my login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. Password protected control panels are in their ...
109
votes
7answers
9k views

You're hired to fix a small bug for a security-intensive site. Looking at the code, it's filled with security holes. What do you do? [closed]

I've been hired by someone to do some small work on a site. It's a site for a large company. It contains very sensitive data, so security is very important. Upon analyzing the code, I've noticed it's ...
12
votes
1answer
7k views

Software architecture for authentication/access-control of REST web service

I am setting up a new RESTful web service and I need to provide a role-based access control model. I need to create an architecture that will allow users to provide their username and password to get ...
15
votes
9answers
11k views

How much database access should developers have? [closed]

So I've worked in many different workplaces as a developer and my level of access to the database has been varied. I typically don't have production db access. Most of the time I have access to the ...
13
votes
3answers
901 views

Is reliance on parametrized queries the only way to protect against SQL injection?

All I have seen on SQL injection attacks seems to suggest that parametrized queries, particularly ones in stored procedures, are the only way to protect against such attacks. While I was working (back ...
43
votes
2answers
20k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
45
votes
7answers
17k views

Should a stack trace be in the error message presented to the user?

I've got a bit of an argument at my workplace and I'm trying to figure out who is right, and what is the right thing to do. Context: an intranet web application that our customers use for accounting ...
12
votes
1answer
18k views

API Authentication, One time token VS Dynamic tokens

We are working on a new project, we are two lead developers and got on a crossroad on how to use a token to secure the communication between the server and the client. First Suggestion: (The one time ...
14
votes
5answers
6k views

Authorization and authentication system for microservices and consumers

We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
19
votes
9answers
2k views

Is an 'if password == XXXXXXX' enough for minimum security?

If I create a login for an app that has middle to low security risk (in other words, its not a banking app or anything), is it acceptable for me to verify a password entered by the user by just saying ...
39
votes
10answers
3k views

Are there any valid reasons for disallowing characters and limiting the length of passwords?

I've come across quite a few sites that either limit the length they allow passwords to be and/or disallow certain characters. That's limiting to me as I want to widen and lengthen the search space of ...
19
votes
6answers
3k views

What makes a hashing algorithm “secure”?

After reading this interesting question, I felt like I had a good idea of which insecure hashing algorithm I'd use if I needed one, but no idea why I might use a secure algorithm instead. So what is ...
9
votes
11answers
733 views

Do you actively think about security when coding?

When you're coding, do you actively think about your code might be exploited in ways it wasn't originally meant to do and thus gain access to protected information, run commands or something else you ...
16
votes
6answers
7k views

What would truly happen if java.lang.String weren't final?

I'm a long time Java developer and finally, after majoring, I have time to study it decently in order to take the certification exam... One thing that has always bothered me is String being "final". I ...
7
votes
1answer
3k views

Naming in Security Protocols: Alice, Bob and Eve [closed]

Among computer scientists and programmers, there's the common habit of naming people in the context of security protocols e.g. Alice, Bob or Eve. Descriptions of more elaborate attack vector sometimes ...
4
votes
4answers
382 views

Small projects using the cathedral model: does open-source lower security?

We know of Linus' law: With enough eyeballs all bugs are shallow In general, people seem to say that open-source software is more secure because of that very thing, but... There are many small ...
3
votes
1answer
1k views

How to *detect* if open source software is used in a commercial product? [closed]

The established procedure regarding releasing code out in the open is to accompany it with a license. Out of the many flavors that exist (BSD, MIT, GPL, LGPL, Boost ...) there are some that prohibit ...
2
votes
3answers
1k views

Where to store hashes, salts, keys in Desktop Applications

I am trying to figure out where or how i should store application secrets and keys inside a desktop application. For example a facebook app key or dropbox key and secret. So I've read that i should ...
3
votes
2answers
952 views

Is having sensitive data in a PHP script secure?

I've heard that PHP is somewhat secure because Apache won't allow the download of raw PHP. Is this reliable, though? For example, if you wanted to password protect something, but didn't want to create ...
2
votes
1answer
355 views

Password reset process

So I'm working on my first password reset mechanism. I'm going with what I understand to be a fairly common procedure: User clicks "Forgot Password" User is prompted for email address If the entered ...
37
votes
5answers
23k views

How easy is it to hack JavaScript (in a browser)?

My question has to do with JavaScript security. Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a ...
22
votes
5answers
8k views

How do web servers enforce the same-origin policy?

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
31
votes
8answers
8k views

Should I spend time preventing piracy of my app? [duplicate]

The title says it all, the more I do research about piracy and the tools used to crack an app the more I think it is just wasted time. My biggest threat is that my app is being cracked and uploaded ...
23
votes
19answers
29k views

Use of pirated/cracked software for development [closed]

Disclaimer: I by no means condone the use of pirated software. Have you ever witnessed the use of pirated software for development purposes? May be a company didn't have enough money to buy a piece ...
37
votes
14answers
6k views

What to do if you find a vulnerability in a competitor's site?

While working on a project for my company, I needed to build functionality that allows users to import/export data to/from our competitor's site. While doing this, I discovered a very serious security ...
33
votes
4answers
6k views

Should MVC/REST return a 403 or 404 for resources belonging to other users?

When working with a resource-based site (such as an MVC application or REST service), we have two main options when a client tries to GET a resource that they don't have access to: 403, which says ...
23
votes
11answers
2k views

Source code stolen\hacked by rival company

On some companies I've worked for, managers have spent quite a lot of money on it-security consultants. Primarily because they're afraid we're gonna get the source code stolen by a rival company. ...
26
votes
4answers
9k views

Is it possible to read memory from another program by allocating all the empty space on a system?

Theoretically, if I were to build a program that allocated all the unused memory on a system, and continued to request more and more memory as other applications released memory that they no longer ...
9
votes
1answer
7k views

Permissions/right model/pattern for .NET application

I need to implement flexible AND simple (if such thing exist) and at the same time utilize built-on means if possible So far I have MembershipProvider and RoleProviders implemented. This is cool but ...
5
votes
4answers
5k views

What is the “correct” way to store functions in a database?

Note: Yes, I know that storing functions in databases should be punishable by law. We are developing a financial web application using PostgreSQL, Sinatra and AngularJS. As you may have guessed, a ...
17
votes
5answers
5k views

“Forgot Password” - How to handle this?

I read this answer and found a comment insisting not to send password by email: passwords should not be able to be retrieved by email, I hate that. It means my password is stored in plain text ...
16
votes
4answers
8k views

Why do certain sites prevent spaces in passwords?

It seems less common with newer websites, but many websites I need an account on (like for paying bills, etc.) prevent me from creating a password with spaces in it. This only makes things more ...
3
votes
2answers
732 views

typical way to share database connection for open-source project, without revealing too much

I have an open source project for mydomain.com which requires connections to a database (...as is tradition). What is the standard practice for allowing others to work on the site, without giving them ...
14
votes
3answers
6k views

Safe iPhone app ↔ server communication

What would be the best approach to achieving private communication between my iOS app and its server component? Is having a single unchanging “secret key” baked into the app source enough, or do I ...
11
votes
7answers
598 views

What information must never appear in logs? [closed]

I'm about to write the company guidelines about what must never appear in logs (trace of an application). In fact, some developers try to include as many information as possible in trace, making it ...
9
votes
3answers
2k views

How to separate sensitive data in database(MySql)

I need to design a database that will contains information about personal disease of users. What can be the approach in order to implement the columns of the DB's tables: encrypt the information, ...
8
votes
2answers
7k views

What are the reasons for sealing a .jar and how would I verify that?

I have created a sealed jar, but I don't see difference compared to using a non-sealed one. What tests I can perform to verify the jar is sealed? What reason we could have to prefer using a sealed ...
7
votes
7answers
2k views

How to make security usable in a web application?

I'm in the planning stages of developing a web application that I want to make as secure as possible. I'm pretty clear about how to do that from a technical point of view, but there is one massive ...
7
votes
2answers
289 views

Do you apply a code of conduct on accepting jobs, projects or requirements?

When writing software for yourself, your company or third parties, do you always consider certain principles, values, standards, or rules of behavior that guide the decisions, procedures and systems ...
7
votes
2answers
3k views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...
4
votes
2answers
2k views

user security pattern recommendation/best practice

I'm looking for good reference on patterns that apply to user security and ACLs for multi-user network applications. I'm re-writing a fairly large application from scratch. Now I'm looking at the ...
34
votes
14answers
2k views

What if the client needs the ability to retrieve passwords?

I've currently inherited an application at work and to my dismay, I have realized that the user passwords stored in the database are encrypted using an in house encryption function, which also ...
15
votes
6answers
722 views

Discovered large security hole in someone elses website… What to do? [duplicate]

A chap I'm bidding to do some development for has a social network he wrote himself. Not the next facebook by any stretch. But a few thousand local users. I went to have a look at it to see what ...
12
votes
6answers
4k views

Why do websites restrict the number & choice of characters in a password? [duplicate]

Registering on an insurance company's website right now, and my password is 16 characters long, using a nice variety of letters, numbers, special characters, etc. However, here's their list of ...
3
votes
1answer
1k views

Are there security implications to using dynamically-assigned TCP port numbers?

I'm getting pushback from operations for having a server process listen on a dynamically-assigned port number (i.e. it binds a socket to a port number of 0, triggering a dynamic assignment by the OS, ...