We’re rewarding the question askers & reputations are being recalculated! Read more.

Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
129
votes
7answers
17k views

Are private, unguessable URLs equivalent to password-based authentication?

I want to expose a resource on the web. I want to protect this resource: to make sure it is only accessible to certain individuals. I could set up some kind of password-based authentication. For ...
109
votes
7answers
9k views

You're hired to fix a small bug for a security-intensive site. Looking at the code, it's filled with security holes. What do you do? [closed]

I've been hired by someone to do some small work on a site. It's a site for a large company. It contains very sensitive data, so security is very important. Upon analyzing the code, I've noticed it's ...
107
votes
4answers
58k views

REST API security Stored token vs JWT vs OAuth

I am still trying to find the best security solution for protecting REST API, because the amount of mobile applications and API is increasing every day. I have tried different ways of authentication,...
97
votes
8answers
69k views

How to safeguard a REST API for only trusted mobile applications

How do I make sure my REST API only responds to requests generated by trusted clients, in my case my own mobile applications? I want to prevent unwanted requests coming from other sources. I don't ...
85
votes
7answers
45k views

How can robots beat CAPTCHAs?

I have a website e-mail form. I use a custom CAPTCHA to prevent spam from robots. Despite this, I still get spam. Why? How do robots beat the CAPTCHA? Do they use some kind of advanced OCR or just ...
78
votes
17answers
53k views

How can software be protected from piracy?

Why does it seem so easy to pirate today? It just seems a little hard to believe that with all of our technological advances and the billions of dollars spent on engineering the most unbelievable and ...
62
votes
15answers
18k views

Is there any reason not to go directly from client-side Javascript to a database?

Possible Duplicate: Writing Web “server less” applications So, let's say I'm going to build a Stack Exchange clone and I decide to use something like CouchDB as my backend store. If I use their ...
59
votes
14answers
13k views

Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?

The way I see it, SQL injection attacks can be prevented by: Carefully screening, filtering, encoding input (before insertion into SQL) Using prepared statements / parameterized queries I suppose ...
53
votes
9answers
20k views

Why not expose a primary key

In my education I have been told that it is a flawed idea to expose actual primary keys (not only DB keys, but all primary accessors) to the user. I always thought it to be a security problem (...
46
votes
8answers
56k views

Why almost no webpages hash passwords in the client before submitting (and hashing them again on the server), as to “protect” against password reuse?

There are many sites on the Internet that require login information, and the only way to protect against password reusing is the "promise" that the passwords are hashed on the server, which is not ...
45
votes
7answers
17k views

Should a stack trace be in the error message presented to the user?

I've got a bit of an argument at my workplace and I'm trying to figure out who is right, and what is the right thing to do. Context: an intranet web application that our customers use for accounting ...
45
votes
2answers
22k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
41
votes
13answers
8k views

How safe is it to compile a piece of source code from a random stranger? [closed]

Suppose I'm reviewing code that job applicants send to prove their skills. Clearly I don't want to run executables they send. Not so clearly I'd rather not run the result of compilation of their code (...
40
votes
9answers
4k views

Looking for meaningful, strong argument in favor of antivirus software on development machines [closed]

When forming opinions, it is a good practice to follow scholastic tradition - think as hard as you can against the opinion you hold and try to find counter-arguments. However, no matter how hard I ...
39
votes
10answers
3k views

Are there any valid reasons for disallowing characters and limiting the length of passwords?

I've come across quite a few sites that either limit the length they allow passwords to be and/or disallow certain characters. That's limiting to me as I want to widen and lengthen the search space of ...
38
votes
4answers
4k views

Logging failed login attempts exposes passwords

I started logging failed logins attempts on my website with a message like Failed login attempt by qntmfred I've noticed some of these logs look like Failed login attempt by qntmfredmypassword I'm ...
37
votes
14answers
6k views

What to do if you find a vulnerability in a competitor's site?

While working on a project for my company, I needed to build functionality that allows users to import/export data to/from our competitor's site. While doing this, I discovered a very serious security ...
37
votes
19answers
23k views

How do you prevent the piracy of your software? [closed]

Is it still worth it to protect our software against piracy? Are there reasonably effective ways to prevent or at least make piracy difficult?
37
votes
5answers
24k views

How easy is it to hack JavaScript (in a browser)?

My question has to do with JavaScript security. Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a ...
34
votes
14answers
2k views

What if the client needs the ability to retrieve passwords?

I've currently inherited an application at work and to my dismay, I have realized that the user passwords stored in the database are encrypted using an in house encryption function, which also ...
33
votes
6answers
5k views

What is a good security practice for storing a critical database on developer's laptops?

We have a few givens: Developers need a replica of the production database on their machines. Developers have the password to said database in the App.config files. We don't want the data in ...
33
votes
4answers
6k views

Should MVC/REST return a 403 or 404 for resources belonging to other users?

When working with a resource-based site (such as an MVC application or REST service), we have two main options when a client tries to GET a resource that they don't have access to: 403, which says ...
33
votes
6answers
41k views

How secure is localstorage?

The question says it all really. I want to provide a service but I do not want to store any of the data myself in a database. With all the recent news of hacking etc it seems to me that it is nicer ...
32
votes
6answers
4k views

Updating password hashing without forcing a new password for existing users

You maintain an existing application with an established user base. Over time it is decided that the current password hashing technique is outdated and needs to be upgraded. Furthermore, for UX ...
31
votes
14answers
2k views

Is it ethical to teach teens about software viruses? [closed]

I volunteered to instruct an after school computer club at my son's middle school. There has been a lot of interest in computer viruses. I was thinking about showing them how to create a simple batch ...
31
votes
5answers
18k views

Best practices for execution of untrusted code

I have a project where I need to allow users to run arbitrary, untrusted python code (a bit like this) against my server. I'm fairly new to python and I'd like to avoid making any mistakes that ...
30
votes
8answers
8k views

Should I spend time preventing piracy of my app? [duplicate]

The title says it all, the more I do research about piracy and the tools used to crack an app the more I think it is just wasted time. My biggest threat is that my app is being cracked and uploaded ...
30
votes
3answers
11k views

JSON Web Token - why is the payload public?

I can't understand the reasoning for making the claims/payload of a JWT publicly visible after base64 decoding it. Why? It seems like it'd be much more useful to have it encrypted with the secret. ...
28
votes
3answers
4k views

Kernel mode web servers: A clever optimization or a security nightmare?

I was reading a Hacker News thread where one user posts a link from 2011 explaining that IIS is much faster than most other (*nix) web servers. Another user replies, explaining that IIS gets that ...
28
votes
1answer
1k views

If the spec is flawed, should it still be followed?

I have been assigned to develop an integration to one of my employer's applications to an external system developed by our client. Our client's specification for the integration that has some blatant ...
27
votes
4answers
6k views

Is it worth even checking to see if Guid.NewGuid() is Guid.Empty?

In one of the projects I'm working on the following pattern is seen on a fairly regular basis: var guid = Guid.NewGuid().ToString(); while (guid == Guid.Empty.ToString()) { guid = Guid.NewGuid()....
27
votes
5answers
17k views

What best practices should be employed in a PHP login script?

I am wanting to re-write my login scripts for clients websites to make them more secure. I want to know what best practices I can implement into this. Password protected control panels are in their ...
26
votes
6answers
3k views

How is major software protected? [duplicate]

I am a new software developer and I wish to sell my software. I recently realized that from C++ code we can not stop the user seeing parts of the code that are related to scripts or system commands. ...
26
votes
5answers
9k views

Is it possible to read memory from another program by allocating all the empty space on a system?

Theoretically, if I were to build a program that allocated all the unused memory on a system, and continued to request more and more memory as other applications released memory that they no longer ...
26
votes
5answers
8k views

Data input validation - Where? How much? [closed]

Data input validation always was quite an internal struggle to me. On the verge of adding a real security framework and code to our legacy application rewrite project (which so far pretty much keeps ...
26
votes
4answers
21k views

Web api authentication techniques

We have a asp.net MVC web service framework for serving out xml/json for peoples Get requests but are struggling to figure out the best way (fast, easy, trivial for users coding with javascript or OO ...
24
votes
5answers
9k views

How do web servers enforce the same-origin policy?

I'm diving deeper into developing RESTful APIs and have so far worked with a few different frameworks to achieve this. Of course I've run into the same-origin policy, and now I'm wondering how web ...
24
votes
11answers
2k views

Should I accept to write unsecure code if my employer requests me to do so? [closed]

My employer asked me to implement a feature that would require storing passwords in clear text in a database (or using an obscure encrypt/decrypt function stored in a binary, which is a bit better, ...
23
votes
19answers
30k views

Use of pirated/cracked software for development [closed]

Disclaimer: I by no means condone the use of pirated software. Have you ever witnessed the use of pirated software for development purposes? May be a company didn't have enough money to buy a piece ...
23
votes
11answers
2k views

Source code stolen\hacked by rival company

On some companies I've worked for, managers have spent quite a lot of money on it-security consultants. Primarily because they're afraid we're gonna get the source code stolen by a rival company. ...
23
votes
5answers
7k views

How to implement a safe password history

Passwords shouldn't be stored in plain text for obvious security reasons: you have to store hashes, and you should also generate the hash carefully to avoid rainbow table attacks. However, usually ...
23
votes
7answers
11k views

Is obscuring/obfuscating public-facing database ids really a “best practice”?

I've heard people lecture here and there on the internet that it's best practice to obscure public facing database ids in web applications. I suppose they mainly mean in forms and in urls, but I've ...
22
votes
4answers
3k views

Why not just make non-parameterized queries return an error?

SQL injection is a very serious security issue, in large part because it's so easy to get it wrong: the obvious, intuitive way to build a query incorporating user input leaves you vulnerable, and the ...
22
votes
1answer
530 views

What is best practice for handling PRs addressing security vulnerabilities in public repo?

How should an open source project with a public repository best handle pull requests (PRs) that address securely reported but not yet publicly disclosed security vulnerabilities? I'm involved in an ...
21
votes
4answers
12k views

Predicting the output of PHP's rand()

I've read in numerous sources that the output of PHP's rand() is predictable as its a PRNG, and I mostly accept that as fact simply because I've seen it in so many places. I'm interested in a proof-...
21
votes
5answers
22k views

Where to store the private key?

Say I want some parts of my software to be encrypted. For example, the credentials for a database, etc. I need to store those values somewhere, but doing so in cleartext would make it easy for an ...
21
votes
4answers
5k views

Programmers' concerns about export restrictions from the United States

Which aspects do I need to consider when designing and publishing software that must meet the US export restrictions for cryptographic software? Wikipedia says that there are various categories which ...
20
votes
9answers
2k views

Is an 'if password == XXXXXXX' enough for minimum security?

If I create a login for an app that has middle to low security risk (in other words, its not a banking app or anything), is it acceptable for me to verify a password entered by the user by just saying ...
20
votes
7answers
455 views

Citations for inadvisability of globally unique password

I am having a disagreement with someone (a client) about the user identification/authentication process for a system. The nub of it is that they want each user to have a globally unique password (i.e....
19
votes
6answers
4k views

What makes a hashing algorithm “secure”?

After reading this interesting question, I felt like I had a good idea of which insecure hashing algorithm I'd use if I needed one, but no idea why I might use a secure algorithm instead. So what is ...