Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
1
vote
1answer
140 views

Porting security from Java/.NET to PHP

This probably a rather naive question given my limited knowledge in the code I've been looking at, but I want to get my head around it before I start diving into writing actual code myself. I'm ...
1
vote
2answers
1k views

Avoid data manipulation by user

I have a C# program (could be any programming language) that saves data to a file on a memory (hard disk, USB drive, etc.). The program uses this data for monitoring its operation time, but it could ...
1
vote
1answer
213 views

What is a simple, correct and secure way of executing code stored in database?, that is also sandboxed

Webhooks can be a very powerful thing when you try to automate or integrate software, however, handling their deployment in a controlled environment can suck in terms of security and deployment alone. ...
1
vote
1answer
112 views

How to store sensitive information (e.g. clients' credentials) accessibly for everybody inside?

I just discovered that we store sensitive information on our SharePoint. Since it's accessible by a password alone (and we all know that others click for the password/user name to be automatically pre-...
1
vote
2answers
272 views

Secure Rest api from authenticated user

Let's say that my Rest api is secured using OAuth 2. Let's say my client is a mobile App. Let's say that i have an Api call: @Post /increasePoints host:https://www.example.com/increasePoints amout=...
1
vote
1answer
701 views

Browser game played in an iframe - security concerns

I'm not sure if this counts as an Information Security or Webmasters question rather than Programmers, however I'll see how we go. I've been prototyping a help website for a particular browser game, ...
1
vote
1answer
119 views

Testing for Authentication loop holes / bugs

We've got a web application which is 99% complete prior to public beta, were currenlty securing the site from security perspective, locking down the server, db etc, one thing I'm concerned about but ...
1
vote
1answer
481 views

What Kind of Source Control Do High Security Projects Use? [duplicate]

I was just reading this slightly older post on choosing a good source control system when I started thinking about how different projects use source control. Where I work we've essentially moved ...
1
vote
2answers
637 views

Hide admin menu if no admin option is available

If you have a menu "Admin tasks" and different admin tasks (like 10) that you could separately assign to each user, but there are users who don't have any admin tasks, how would you deal with "Hiding ...
1
vote
1answer
1k views

Implicit OAuth2 endpoint vs. cookies

I currently have an app which basically runs two halves of an API - a restful API for the web app, and a synchronisation API for the native clients (all over SSL). The web app is completely ...
1
vote
1answer
1k views

Is it safe to generate client nonces using random number generator?

I am making HTTP calls on the client side and the server expects me to supply a client nonce. It needs to be 4 bytes long. I am planning to use this combination: base64(parts of the MAC address + ...
1
vote
1answer
81 views

Is this mini-DSL for hiding URI passwords compatible with the URI spec?

Passwords exposed in URIs An application stores URIs to be used for file transfers via SFTP, FTP, FTPS and SCP. Many of these URIs contain passwords, for example: sftp://someuser:sekrit@host....
1
vote
1answer
272 views

Creating deterministic key pairs in javascript for use in encrypting/decrypting/signing messages

So I have been searching everywhere and havn't been able to find anything with the sufficient information I need.. so Im a bit stumped on this one at the moment What I am trying to do is create a ...
1
vote
1answer
216 views

How to securely store user credentials from external website

I'm developing an application where I'd like to use credentials from external websites. This will be used to login with the website API and get information for the user. Example: I want to use the ...
1
vote
2answers
211 views

How can I limit access for automatically generated files to specific users in a MVC setup?

I have a typical MVC based website, and I'd like to give some registered users the abillity to extract data from the database (in a variety of formats). The workflow is very simple: User logs in, ...
1
vote
1answer
383 views

Books or guides regarding secure key storage and database encryption [closed]

I have an idea for a SaaS product I want to create, however, this product will store extremely sensitive data that needs to be encrypted at rest. The trouble is not so much the encryption, but the ...
1
vote
0answers
120 views

How to store relational data belonging to different client customers?

My users will be businesses with a small number of accounts each: e.g. Business #1 with 3 users, Business #2 with 5 users, etc. I am trying to determine the best way to organise the relation (on ...
1
vote
0answers
134 views

Is my microservices architecture in line with best practises? (STS/SPA/Frontend API/Backend services)

My goal is to make an application with a SPA front end that updates in real time, incorporating microservices architecture (and for solutions CQRS design patterns and eventing with Azure Service Bus). ...
1
vote
2answers
66 views

Securing e-commerce administrator panel with a VPN

I am developing the back-end of an e-commerce system, which has customer and administrator type accounts. These two roles do not overlap, administrators are there to do the back office work, while ...
1
vote
0answers
168 views

Storing File URI and Checksum to check if the file was changed in future

right now application is storing a file data in database and we are considering instead to store a link (http, ftp, etc) to the file and its checksum. We will only provide a service and the service ...
1
vote
0answers
248 views

Front-end-side encryption: Where to store password throughout session?

currently we're working on a small application where we store a bunch of JSON data coming from a JS-based graphing editor (think of a spiced-up version of this) in a Rails-based backend. We want to ...
1
vote
0answers
149 views

CORS headers for non-200 HTTP responses

I'm specifying an API for a REST service. The REST service will be primarily accessed by web browsers using XHR requests running code hosted from remote origins. Therefore, I'll need to add CORS ...
1
vote
0answers
48 views

How should I handle private key in decryption worker?

I own the development of a Sidekiq worker that decrypts thousands of gpg encrypted CSVs and loads them into the database. While not necessary, I'm using a gem to interact with the gpg/GnuPG binary. ...
1
vote
0answers
248 views

User registration web service

I'm planning on making a web app that'll use MySQL as the database, Java/Grails as the backend and JavaScript/VueJS as the frontend and then they'll communicate using only RESTful JSON APIs (that way ...
1
vote
0answers
317 views

How to create a licensing system for a software

I'm building a chrome extension that I would like to offer for free for a given trial period and then the users buys a registration key on our website for a forever version . I've built software ...
1
vote
0answers
46 views

Securing an Azure Service Bus topic and subscriptions

We are working on a solution that will publish messages on an Azure Service Bus topic but we don't know yet which other team or even third party might be interested in subscribing to those messages in ...
1
vote
0answers
47 views

Correlating Search Classifiers in a Database Scan for Sensitive Information

Problem Description I am working on an enterprise data discovery project that is designed to scan databases for sensitive information. The basic search unit is called a classifier and covers things ...
1
vote
0answers
643 views

Generate a fixed length number hash from a number

Let say I've a fixed length number, e.g. 6 digit: 837493, I want to apply some process (with a salt), and generate a new number of another 6 digits, e.g. number = 837493 another = hash(number + ...
1
vote
0answers
144 views

'HMAC style' design example for a shared secret

I'm looking to secure an API based on a shared key and a given username and datetime. The API gives access to trusted third parties and does not require the input from a user in order to access their ...
1
vote
0answers
122 views

How safe is returning a password from a function? [duplicate]

Is returning sensitive data like a password from a function safe, and what attack vectors exist? (Personally, it is regarding PHP, but is a general question.) function returnDBPass(){ $pass="...
1
vote
1answer
167 views

Personal Digital Signatures in Web Applications [closed]

In order to sign data with personal digital signature in a web application, server side languages like PHP can do the whole job, but that would require that the user uploads his private key, lets say ...
1
vote
0answers
300 views

How to validate information on server without using database or session

Each user has multiple sites they can access reporting data for in an application I am working on. To prevent having to go to the database on every single request, I validate that they have access to ...
1
vote
0answers
47 views

Online error reporting without network access

I have developed an application for android requiring no permissions, but the biggest downside of this is that I don't have error reporting. So, I was playing around for the past week with any ...
1
vote
0answers
83 views

Domain security involving domain logic

Together with my application's domain logic I am trying to outline the security model. I am stuck with a requirement that prevents me from considering security just a cross-cutting concern over my ...
1
vote
0answers
199 views

Validating time-limited HMACs

I'm exploring using HMAC style secret-key authentication with timestamp expiry, but am struggling to get my head around how you validate the timestamp portion. On the client side you would do: ...
1
vote
1answer
95 views

Securely changing system configuration from a web application

I need to write a web application that acts as a configuration interface for some system services. Meaning it will probably change some kind of configuration file and has to restart (linux) system ...
0
votes
4answers
800 views

Why are computer systems still insecure? [closed]

After 50 years of software engineering, why are computer systems still insecure? I don't get it. Two questions: (i) What's so hard about just denying or restricting networked access to bad actors who ...
0
votes
5answers
273 views

How to handle the problem of modified encrypted files [closed]

I have a simple encryption/decryption application that I am testing to learn more about security. I found out that if the user modifies the encrypted file, then decryption fails because the hashing ...
0
votes
2answers
194 views

Resetting vs. re-sending forgotten passwords

When a user forgets their password, is it better practice to reset the password and email that to the user or just to email the current password to the user's email address.
0
votes
5answers
522 views

Hiring Developers - Securing Source Code [duplicate]

I have a popular web-based app, and now suddenly my main developer has disappeared. Although I've found other great developers but I don't want to distribute the source code to everyone. Is there any ...
0
votes
5answers
4k views

Entire webpage obfuscation

I want to obfuscate all the webpages of my website. I Googled through some free tools like HTML and Javascript obfuscation but don't know how effective they are. First of all, does it makes sense to ...
0
votes
4answers
229 views

Are security exploits a fatality? [closed]

I'm asking this here and not on the security related site because this one is a question about "software architecture" and "development methodologies", which are both covered by the FAQ. EDIT: I'm ...
0
votes
4answers
1k views

How does using #define for loop and condition bounds in C increase security?

My program uses the following define statements: #define LOWEST_PATIENT_ID 10000 #define HIGHEST_PATIENT_ID 99999 #define LOWEST_CRITICAL_STATUS 1 #define HIGHEST_CRITICAL_STATUS 100 used in this ...
0
votes
2answers
1k views

How do I access databases from a mobile device securely?

I have been doing some research on accessing a DB from mobile devices. There are so many different ways of doing it. There are also multiple ways to make it secure. What is a good way to access a ...
0
votes
3answers
113 views

Preventing information leakage while returning an error message

Say my website contains 2 functions: Allow a user to change their own password Allow an administrator to change a user's password (the user must change again before they login) Now let's say that ...
0
votes
2answers
119 views

Should a “secret access code” use the same security as a normal password? [closed]

Obviously, when you store a password, you should use something similar to bcrypt before you store it in in the database. But I have a client who wants to add the ability to add a "secret code" to ...
0
votes
1answer
92 views

Sending Out Functions To Return Or To Die

Which is preferable for both solid technique and secure coding? Example #1: function_one() blah; function_two() blah; print blah; exit; ... Example #2: ...
0
votes
1answer
842 views

Can HTML injection be a security issue?

I recently came across a website that generates a random adjective, surrounded by a prefix and suffix entered by the user. For example, if the user enters "123" for prefix, and "789" for suffix, it ...
0
votes
5answers
1k views

Standards & compliances for secure web application development?

I am working with developers right now that write code the way they want and when i tell them to do it other way they respond that its just matter of preference how to do it and they have their way ...
0
votes
3answers
182 views

Is there any risk in creating a SSL certified site?

I was hired to program a basic, plain text site for a local business that amongst other things, provides basic pricing quotes through a Javascript Applet. For obvious reasons, it seemed unnecessary to ...