Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
0
votes
0answers
19 views

How do I properly secure a Spring Boot app serving server-side rendered pages and API?

I'm wondering how do I properly secure this example app (https://github.com/brunodrugowick/spring-thymeleaf-vue-crud-example). The app is: A Spring (Boot) app with server-rendered pages via ...
1
vote
1answer
16 views

Identity Server 4 Authentication - Security questions around using the same API for internal application and third parties

So, I have an API that authenticates with Identity Server OAuth2 and gives our user a JWT token when logging in through a front end application, this is a token that has access to everything. The API ...
1
vote
1answer
80 views

License control for an on-premise application

TL;DR How do you build an airtight license control system for your onprem application, which revokes access once subscription ends? Premise I am building this application in Python that needs to ...
1
vote
0answers
35 views

Does putting a serverless application in a VPC make it more secure?

I have an application which uses lambda and fargate (task) containers for compute, EventBridge for communication, S3 and DynamoDB for storage and exposes data out via an API Gateway. From my ...
2
votes
1answer
145 views

Why is it fine to use a user's ID in their JWT, as opposed to their email/username?

I'm wondering whether it is bad practice to keep a user's ID in a JWT. I'm planning on using the email in the sub, since it's already available to them, and I can use it to identify them, all the ...
-1
votes
1answer
48 views

How does separation of duties work between the kinds of workers described below?

I'm trying to understand how separation of duties works between various job functions as a security measure. For starters, there are computer (hardware) operations, applications programs, and systems ...
0
votes
0answers
39 views

PHP preg_replace() vs filter_var()

I have seen numerous posts on this subject but none really answered my questions. I have some user input that is inserted into my DB and displayed back to the user later. Before inserting it into the ...
1
vote
4answers
100 views

How can I store an user's capabilities to boost performance while allowing real-time updates of said capabilities?

I'm ingesting 150 objects that each require an user capabilities check, the function isUserAdmin tells me whether or not an user is an admin or not. Inside this function, there's a lot of deeper ...
0
votes
0answers
44 views

Which authentication should be used for external users (not registered with the system)

I'm working with a project that uses ASP.NET Core 2.2. The main solution contains different projects, including APIs for a mobile application, APIs to integrate the system with third parties, a web ...
21
votes
9answers
8k views

Is this scenario an exception to the rule of never storing passwords in plaintext?

I am making a full-stack web application for a professor. At his request, the passwords and usernames are generated programmatically, and they cannot be changed or reset by the students. (If you ...
3
votes
1answer
38 views

Securing a voice assistant skill/app - any established patterns?

When creating new skills/apps for a voice assistant such as Google Home or Amazon Echo, are there any established patterns for providing an extra level of security for certain actions that go beyond ...
-1
votes
1answer
75 views

How can I securely store and process user data?

I am creating a Discord Bot in Discord.Net. So first, of course this bot is not a professional project, but I still want it to look as professional as possible. And a huge part is the storage and ...
3
votes
1answer
100 views

Is it possible to spoof a recipient in a SMTP transaction? If not how does SMTP prevent this from happening?

Is it possible to have a scenario where there are 3 email addresses. Each on a different mail server. alice@contoso.com bob@fabrikam.com charlie@treyresearch.net Charlie writes an email with Alice ...
0
votes
0answers
37 views

Is it a good practice to store session in two different places?

I have a use case like this and I am wondering if this solution is a good practice or not. Say I have a website called dashboard.com and this is only for US region. When users login here, I am ...
0
votes
1answer
56 views

Check that a POST request is the origin of the application and not of a user

Hello, I want to secure access to a POST request so that the user cannot forge it via software such as postman. Let’s say a player plays a game and gets a score. At the end of the game, the score is ...
1
vote
4answers
110 views

REST API include permissions into resource

We currently have REST API, where you have a set of different resources, like: GET /cats GET /cats/{catId} GET /dogs Clients decide whether they can perform an action based on resource permissions. ...
-3
votes
1answer
59 views

Protecting research source from spyware/data mining

My question is simple: What steps should you take to protect research from the vast amount of spyware or insecure applications on a given device? Background: I do research into developing new models ...
1
vote
2answers
119 views

Develop a distributed pointer in C++

I s it possible to develop a distributed memory pointer in C++ by using operator overload? The idea would be that you pass ip address and port to the overloaded pointer *, &, and the pointer ...
2
votes
1answer
59 views

Role based authentication/authorization security

I have my backend endpoint for registering and logging in the users delivered trough RestApi or GraphQL to be more specific. I want to implement role based system for my users. The admins and ...
1
vote
3answers
154 views

Why would you cut off your continuous integration system from the internet?

I read that Facebook's continuous integration environments are cut off from the internet for security and reliability reasons. What would these reasons be? Is this a common practice?
1
vote
1answer
27 views

Storage of Per-Device Keys in Database?

In the context of many devices being secured with their own symmetric key (think: thousands of IoT devices), is it reasonable to hold these secret keys in a MySQL database? The goal is to verify the ...
1
vote
2answers
50 views

Application certification for Microsoft Office VSTO solutions

A potential client is very interested by a VSTO product we developed. However, their IT department is concerned wether they should trust this sofware. Mainly, they are worried it could expose a ...
4
votes
1answer
327 views

How can social security numbers be safely stored in databases and retrieved?

How can personal information that needs to be retrieved at a later date be stored securely in a database? For instance when companies store social security numbers and use them for taxation purposes. ...
-4
votes
1answer
52 views

How to detect that internal hard disk is removed and which files were copied? [closed]

Its easy to steal internal hdd, which do not generate sound signals to aware the owner while removing and allows Thief to copy the data. Is there any way by which these thieves acts can be traced.
1
vote
1answer
100 views

Client Side Hashing + Server Side Hashing

Suppose one wishes to implement an account system for their service/website. There have been cases with Instagram for example where passwords were accidentally stored in plain text due to ...
0
votes
1answer
34 views

How to dynamically create and assign user permissions for a group based service

tldr: In building a platform where users can create private groups, and invite other people to those private groups, how is it be to secure those groups? I'm building a platform around private groups ...
0
votes
0answers
55 views

What is the correct way of setting and then differentiating between paid and free user in Firebase / Firestore?

I am developing a mobile application that will have both free and paid versions. The way I see how I could differentiate between what is a paid and free user is to set a property isPaid on their ...
2
votes
3answers
255 views

Wrapper Class Should be made static?

I am planning on creating a wrapper class in c# which will call cryptographic functions provided by .Net Framework, just to make sure I am clear, I am not writing any cryptographic algorithm, just ...
4
votes
4answers
2k views

Why must API keys be kept private?

I have worked with public API's in only one small project, but I recently learned that if one were to distribute a project with API keys inside this is a security risk. So I have two questions: What ...
1
vote
1answer
70 views

Api limit access to subscribers only

I have a vanilla php api(on a vds) and I want to make data coming from that api available to a few clients that are using a python app that's also written by me. That python app is running on my ...
2
votes
0answers
57 views

Securing a microservice that will be accessible from frontend

I need an advice on securing interaction between an application App and a microservice RecordApp. App is the main application, where all users are registered and do some activity. RecordApp is a ...
-2
votes
2answers
124 views

How do I ensure my product is correct the first time? [closed]

I am working on a product that will not be able to be updated once released. Furthermore, if the product malfunctions, the results may include death, serious bodily harm, or major financial setbacks. ...
-1
votes
1answer
48 views

Buffer Overflows and Out-of-bounds Writes [closed]

What is the difference between buffer overflows and out-of-bounds writes? Are buffer overflows a kind of out-of-bounds writes?
0
votes
1answer
47 views

rest service with digitally signed parameters

I'd like to build a rest service that will accept objects that has digital signature. This service has to support both xml and json data serialization formats. I'd like to use .Net core framework to ...
0
votes
0answers
47 views

Prevent token sharing: chained single-use tokens VS a designated invalidation feature

Situation: A Client is requesting a resource from a Host multiple times, usually with minutes or hours between requests. The Client has a signed, verifiable token, which we'll call a Receipt, that ...
4
votes
1answer
145 views

Architecture to lock account to mobile device

I'm currently creating a mobile app and have the following issue. I am required to only allow the user to login from a device that is registered to the users account. A user can have up to X number of ...
0
votes
1answer
40 views

Save user credentials for use with multiple third-party websites

I've seen a few similar questions but nothing to address this exact issue... I'd like to have a mobile app that allows users to input username/password once and then be automatically logged in with ...
1
vote
0answers
121 views

How to store relational data belonging to different client customers?

My users will be businesses with a small number of accounts each: e.g. Business #1 with 3 users, Business #2 with 5 users, etc. I am trying to determine the best way to organise the relation (on ...
2
votes
0answers
78 views

What's the best way to control distribution/usage of proprietary, internal software?

I was tasked with writing software for my company. As I am now writing a third program (with many more coming), what's the best way to control the distribution/usage of our software? The software I'...
1
vote
1answer
163 views

How to store private ssh keys for my application?

I 've a pair of private and public ssh keys, which I'm using in encrypting and decrypting my JWT. So I'm creating and signing my JWT with my private key and shared the public key with the client who ...
0
votes
0answers
17 views

W3C Reporting API - Mitigate spam/forged reports

I'm looking into the W3C Reporting API, which enables websites to instruct the client (browser) to send reports about: browser crashes, network errors, browser interventions etc. ouside the JS ...
0
votes
2answers
138 views

How do companies store private keys offline but still sign code with them?

I've heard that companies store their private keys offline "in a safe that will never be opened" and stuff like that (the context for this is a console developer like Microsoft keeping the Xbox ...
0
votes
1answer
71 views

How to prevent angular 2 client from accessing privileged fields

I'm learning angular and have been reading about various backend solutions like direct db access, REST, and graphql. One thing I haven't seen addressed anywhere yet is how do you protect privileged ...
0
votes
1answer
52 views

Designing anonymous registration website

I am developing a website where customers can register products they bought in order to receive a benefit in the form of e.g. a cashback, a discount or promotional goods. In the future, we also plan ...
1
vote
2answers
24 views

Open ID Connect Session Management Access/Refresh Token vs Session iFrame

We have a web app in which we allow users to log into the app using any Open ID provider(e.g. Okta, Google, Facebook etc.). We want to implement the correct Open ID Connect prescribed methodology/...
2
votes
1answer
106 views

Is it possible to create once loadable files?

I know very little about encryption, so I figured I'd ask the internet if it's possible to do the following (and if so, what kind of algorithm should I be looking at): Write some code that saves data ...
1
vote
2answers
42 views

JDBC Connection Url Logging - Security Risk

In one of the existing batch process codebase, I can see a practice of JDBC Connection String is getting logged and also persisted. Logging or Persisting a JDBC Connection String alone may not be a ...
0
votes
0answers
36 views

How to restrict API endpoints which are deployed in AWS Application Load Balancer?

I created one webapi application which includes few modules like account, user etc and overall includes 10 or more endpoints. I deployed this in EC2 instances and configured in application load ...
0
votes
1answer
76 views

Is it a bad thing to delegate a callout to an external system, given that my current one can't do it?

Custom code written for the Salesforce platform is incapable of making a PATCH request to an external server (PUT and POST are okay though), and I need to make a PATCH request to an external service (...
0
votes
4answers
59 views

Extent of Administrator Capabilities: HR and Design Logistics?

So I am developing an employee management application on behalf of a company and am concerned about the extent of rights and capabilities that are to be bestowed upon registered administrator accounts....

1 2 3 4 5 16