Podcast #128: We chat with Kent C Dodds about why he loves React and discuss what life was like in the dark days before Git. Listen now.

Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
1
vote
1answer
570 views

Securing a private API

I have two sites and an API that sends data back and forth between the two. The API is only used on the back end, and the user will not interact with it at all. What I would like to do is ensure that ...
1
vote
2answers
2k views

Refreshing a token best practice

I have been asked to implement refreshing a token. A token ID is the same as a session ID. I have considered resetting the session's idle time to 0 and continue using the same session ID for the ...
4
votes
3answers
90 views

Should authorized users be allowed to add autocomplete suggestions to the list of symptoms?

I am developing an online medical website (similar to a HIS) whose users are hospitals specifically hospital administrators, doctors, and other staff authorized by the hospital to use the system. ...
15
votes
5answers
6k views

Authorization and authentication system for microservices and consumers

We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
3
votes
2answers
2k views

Microservices and authorization

We are currently working on a micro-service based system. The idea behind it is to split our monolithic system to small domains (micro-service per domain). All services will be used by our internal ...
1
vote
6answers
4k views

How to verify that a file has not been tampered with?

Here's the scenario I'm trying to solve: In my application, users provide files to other users. I want to provide a way of verifying that files have not been tampered with. I wonder if this means ...
8
votes
3answers
3k views

REST API authorization strategies

There are a lot of questions on here that deal with the mechanics of authentication and authorization of RESTful APIs but none of them appear to go in to details of how to implement secure services at ...
2
votes
1answer
784 views

Do Non-Functional Requirements for Security make sense for defining SDLC?

I recently had engaged in a security discussion with my companies cyber security risk lead, discussing security controls and standards they would be holding the project to. The expectation of the ...
6
votes
2answers
1k views

Right way to spread secret keys between microservices

I have a few services that sign some data with an asymmetric cryptography algorithm (like RSA). I need to spread some secret (private) keys between all instances of the service. I've found a few ways ...
130
votes
7answers
17k views

Are private, unguessable URLs equivalent to password-based authentication?

I want to expose a resource on the web. I want to protect this resource: to make sure it is only accessible to certain individuals. I could set up some kind of password-based authentication. For ...
0
votes
1answer
379 views

Secure communication between a mobile app and a microcontroller

I have a MCU-based design that essentially controls other hardware and this MCU is controlled through an app. I was hoping someone could help me figure out how to secure this communication between the ...
7
votes
1answer
223 views

Why is it more unsafe to store your password in the URL of a git repo?

As a comment on a response to this question, someone says: It is not advisable to put the password in the URL for this file is saved on the .git/config . Is not safe, it is better to use ssh key ...
-1
votes
2answers
971 views

External User ID to Internal User ID

There is an internal API, REST client over DB, all of which methods require User ID as parameter. User ID is an integer value - numeric PK in User table. Also there is an public API, that is like a ...
2
votes
3answers
324 views

Data from devices with unreliable clocks

Are there any viable approaches to dealing with data coming from devices with unreliable clocks? We have a database system running on a central server. The latest addition to the system is a bunch of ...
1
vote
1answer
67 views

How to implement a secure way to allow users to reset password via url?

Password reset option should be given only if the link has come from that specific user's inbox and not from somewhere else. How to implement url in such a way that the required information i.e. ...
4
votes
1answer
297 views

Is NuGet vulnerable to this typosquatting attack?

A recently-published article demonstrates a way to make "typo-squatting" attacks on popular programming package managers. It singles out Python's pip, Ruby's gem and Node's npm systems, and shows ...
3
votes
3answers
3k views

Preventing abuse of a RESTful Web API (can the server trust the remote IP address?)

I'm designing a RESTful API for my organization. We do use password-based authentication, which generates tokens. One part of our API requires that the users be physically in the office, i.e. there is ...
0
votes
1answer
60 views

Hash system to generate same (specified) hash from multiple datasets?

I have a hashed value X and need to ensure that any of the data sets D1...Dn can be concatenated with a correctional value C1...Cn and passed into a hashing algorithm to result in the value of X. ...
0
votes
1answer
82 views

Extensible web application where users can upload client-side code

I have a simple web application built with Angular which fetches some state from a web server and shows it to the user. Additionally I want to implement a feature where users are able to customize the ...
4
votes
3answers
4k views

How to store uploaded client documents securely in webapplication

A small company without any IT skills wants to run a web application where customers can enter various bits of data and upload pdfs. The documents regard product specifications and have to be kept ...
0
votes
1answer
534 views

Are there any JSON based notations for Access Control Lists? (Alternative to S-Expression)

I'm looking for a notation that is familiar to modern developers and can supersede s-Notation. (additional insight into Rivest's proposal of s-Expression is here) Is there any Swagger, JSON or other ...
0
votes
3answers
113 views

Preventing information leakage while returning an error message

Say my website contains 2 functions: Allow a user to change their own password Allow an administrator to change a user's password (the user must change again before they login) Now let's say that ...
2
votes
2answers
743 views

JWT refresh token exponentially?

This is how I do my JWT refresh token: A token is check for validity every time a request is made. If it's not expired, allow access. If it's expired calls another function named RefreshToken to ...
1
vote
1answer
81 views

When do I reset Two Factor Authentication secret keys?

I have built a simple authentication system for my web application that makes use of the open-source time-based OTP algorithm (RFC 6238). The key for each user is generated when the user is registered ...
-1
votes
1answer
376 views

In what way does programming help towards cyber security [closed]

I've been studying the cyber security field with great interest. I understand how networking can help cyber security but I am not sure how advanced programming knowledge can help fight cyber crime or ...
7
votes
2answers
3k views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...
0
votes
1answer
86 views

Universal Form Handler

I'm building a API that gets called from web / mobile applications written using Ionic (web languages on mobile), which uses Angular.js. We want to be able to do server side validation of forms but ...
2
votes
0answers
71 views

Technique to passively take down a host on the network [closed]

I am developing a program which is to be installed on a "simple" machine in a LAN, the only particularity is that the NIC are connected on mirror ports. The software can scan and monitor the network. ...
2
votes
2answers
174 views

Securing my own software… against myself?

I do a lot of programming work for other people's businesses. I am currently working on a project for my local Scouts group that I have worked with before. The problem is I have built them their ...
0
votes
1answer
284 views

How to secure my authentication code?

I'm working a PHP project where I need to authenticate users to a portal. Just wanted to get your opinion on the code, statistics of the website show some strange behaviour with the login form. ...
1
vote
2answers
178 views

Best ways for startups to handle sensitive user information [closed]

Many companies struggle with even basic sensitive information handling. One screaming example I can give is the attack on TalkTalk's servers resulted as 4 millions customer's personal information ...
1
vote
2answers
357 views

Why can't the Synchronizer Token Pattern be circumvented?

The synchronizer token pattern is the most effective protection against CSRF attacks. I understand the theory and implementation, but I do not understand why it can't be circumvented. Generally, the ...
2
votes
1answer
115 views

How to encrypt communication without hard coding key in client?

I've found description of vulnerability here. The kankun smart socket device and the mobile app use a hardcoded AES 256 bit key to encrypt the commands and responses between the device and the app. ...
1
vote
0answers
46 views

Securing an Azure Service Bus topic and subscriptions

We are working on a solution that will publish messages on an Azure Service Bus topic but we don't know yet which other team or even third party might be interested in subscribing to those messages in ...
3
votes
3answers
1k views

Modern recommendations for password recovery

I'm going to implements password recovery in my authentication. I haven't put this together in a while and wondering if there is anything I ought to be aware of. My idea at the moment is: User ...
0
votes
2answers
1k views

Handling delay in entry of OTP for log in validation

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...
1
vote
2answers
125 views

Secure authentication using JWT

I read about JWT and how they can provide secure authentication for calling api routes over http. I naively implemented it and here is how it goes : a client posts username and password to a login ...
1
vote
3answers
5k views

Is providing a user login a functional requirement of a system?

Is providing a user login a non functional requirement? Since this is concerned with security which is a non functional requirement, I feel that providing a user login is also non functional but ...
0
votes
1answer
108 views

Question on password hashing security

I'm about to add some user account and password functionality to my software, so I'm reading about password hashing. So my understanding is Hashing is a one way function, and it works like this: ...
3
votes
0answers
105 views

Windows Phone 8.1 & above - is there some equivalent for Apple's keychain

I want to store store some app specific secret on the phone - this should be available only for the app & no other app. I was looking at DPAPI - however, if the user does not have a logon ...
4
votes
2answers
266 views

Having an discussion about security concerns with another software engineer [closed]

Background: The company I work for uses different systems to hold their insurance data which is customer related. They want to have an app for their customers where they can find their insurance ...
4
votes
0answers
152 views

Client Browser, Node Server, Web API auth structure

I have a web API that accepts Authorization headers to allow access. It responds with the requested data in addition to setting a session cookie. Subsequent requests can be made with no auth headers ...
4
votes
1answer
1k views

Postgres roles for website users

I am setting up a PostgreSQL database with a very small number of tables for a simple website. I am looking at ways to make it as solid and auditable as possible. Is there any particular reason why ...
1
vote
0answers
47 views

Correlating Search Classifiers in a Database Scan for Sensitive Information

Problem Description I am working on an enterprise data discovery project that is designed to scan databases for sensitive information. The basic search unit is called a classifier and covers things ...
3
votes
1answer
899 views

Strategy for Public / Private API, Encrypted (or Hashed) Data, and Server Compromise

In this very simplistic but realistic scenario, I have 2 combo web/database servers (A) behind a load balancer and a single IP address. They also permit access only from one IP address -- the client (...
2
votes
2answers
801 views

ASP.NET storing encrypted & salted Password

I have a question about storing encrypted passwords in your database to help secure them. I have a class that encrypts the password passed in and returns a string. This string has 3 parts too it, all ...
4
votes
1answer
271 views

How do large corporations store API keys?

When FaceBook or Google give me an API key, are they just storing it in a database? Unlike a password, where you can hash and salt it before putting it in the database, it seems to me that a key ...
-2
votes
2answers
125 views

Tables vs. Booleans: Which of the two are more secure for setting admin roles in an app? [closed]

I'm currently in the process of setting up roles where there are regular users, admins, and super admins, each of which have special permissions. I deferred to this post on how to do so. It ...
1
vote
1answer
189 views

Access rights through database table

I made a login system with access rights (ASP.NET WebForm) and I store the info's in a database table. I don't use the built in feature of asp.net like Forms authentication and webconfig. My question ...
3
votes
1answer
203 views

Using SMS as transaction in offline situations

Currently, I have this hybrid mobile application which talks to my C# web service to do CRUD transactions. As the mobile application is always on the go, and there might not have internet connectivity ...