Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
0
votes
2answers
96 views

How do I handle a spam server invalidating my tokens?

Our web application sends a one-time use generated token, in the form of an URL, to clients who forget their passwords. This works except for the case where the client is sitting behind another server ...
0
votes
2answers
9k views

A good tool for browser automation/client-side Web scripting [closed]

I'm interested in adopting a tool/scripting language to automate some daily tasks connected with fighting forum spammers. A brief overview of these tasks: analyze new registrations and posts on a ...
0
votes
3answers
183 views

How can a headless client securely know the API version of a multi-instance backend?

I'm working in a scenario where I have a backend (let's call it the server) and a frontend client app (let's call it the client). The client is entirely headless, and can connect to any instance of ...
0
votes
2answers
61 views

Allowing only users of the official client to upload media to my server. Possible?

I've been toying with a project idea for a while now but can't quite settle on one important detail. The plan is to write a client that can author and upload WebMs to a server for global viewing (...
0
votes
2answers
410 views

Preventing ip resolvers in a skype-like program

I'm currently in the process of creating a Skype-like program, that uses a hybrid peer to peer system to communicate between users (i.e. server contains all users IPs, a client that wants to connect ...
0
votes
3answers
153 views

User management data - the need for a username and password

I would have this asked on StackOverflow if it had code, but it's more on the idea/concept so I asked here. I am working on the UI of our inventory system when I found out that when registering a ...
0
votes
2answers
137 views

How do companies store private keys offline but still sign code with them?

I've heard that companies store their private keys offline "in a safe that will never be opened" and stuff like that (the context for this is a console developer like Microsoft keeping the Xbox ...
0
votes
1answer
59 views

Is X-Script an issue only for public web pages?

I'm struggling with X-Script attacks. I think I understand what they are but it's unclear if they only affect public facing web pages (which I will define better). The example I often see is where ...
0
votes
3answers
181 views

How far do you go in server-side validation of POST/GET requests?

Our application had a few vulnerabilities detected by AppScan and we had to add server-side validation to catch SQL injection attempts. But my question is, how far do you go in server-side ...
0
votes
1answer
368 views

Anonymous Controller/Action within Authorized Site

Say I have an MVC .net core website where 100% of the controllers/methods are behind [Authorize] attributes (complete with policies and all). Would it be taboo, to carve out a set of un-authorized/...
0
votes
2answers
1k views

Handling delay in entry of OTP for log in validation

There's an application, which accepts a user id and password to login. Validation of the id and password is processed by another system. Now after password validation, the application generates a One ...
0
votes
2answers
192 views

How can I solve this potential security exploit (concerning the saving of REST resources)?

I have a File database table with the following columns: Id (PK), Filename And a Document database table with the following columns: Id (PK), Name, Description, FileId (FK) When a user wants to "...
0
votes
3answers
1k views

How can I secure a request handler so I only respond to the correct clients?

Here's the scenario... I have a web site that has a generic handler written in asp.net (.ashx file) that accepts http requests, gets relevant data, converts the result into xml and then passes that ...
0
votes
1answer
4k views

How do PGP and PEM differ?

Email messages are sent in plain text which means that the messages I send to Derpina are visible to anyone who somehow gets access to them while they are in transit. To overcome this, various ...
0
votes
2answers
345 views

How to create secure desktop installer that doesn't trigger a virus alert for unknown exe?

When I created a c# desktop application and move the exe file to another computer that has anti virus security, the security program shows an alert as unknown exe. I want to create a desktop ...
0
votes
1answer
218 views

Why not put TLS certificate in DNS responses?

The security of a TLS connection relies on trusting the CA's certificate, which in turn, is usually actually a proof of DNS entry ownership. Even though the server operator may request a certificate ...
0
votes
1answer
67 views

Most appropriate HTTP code to issue a warning about insecure content

Most people as they surf the web would get a warning by their browser if they approach a website with an SSL certificate issued by an unnknown authority, or even known as malicious place. Now, ...
0
votes
2answers
679 views

Open source desktop application and security

I'm currently working on a desktop application in Java (using JavaFX). This application stores some user information, parts of which are sensitive. For example, if the user configures a proxy, it ...
0
votes
1answer
266 views

Shall I use low quality insecure software if I'm asked to?

I work for a finance startup managing the technical stuff. The COO decided to create a new web site using a contract developer and the owner of the company paid for it ($9k). I'm asked to use the new ...
0
votes
2answers
87 views

Validating requests to API have come from a valid source

I am currently working on a project where I am developing a library which will do HTTP POSTs to a backend service on my server. The data that the backend service receives is processed and stored in a ...
0
votes
2answers
131 views

Should I use unknown code from a third party? [closed]

I am looking to build and host a website for a client. Their existing site has a facility that allows customers to make donations and they want the new site to have it too. My manager has told them ...
0
votes
1answer
425 views

safely executing arbitrary code

I have a program that can get code from a user as input (This question is language-agnostic, though I am primarily interested in answers for Java and Python). Usually, this code is going to be useful, ...
0
votes
1answer
572 views

Is it possible to secure a REST API and validate the integrity of each requests?

I am trying to design a public facing website and would like to experiment with a WebAPI backend and one of the popular front end javascript frameworks. Now, this application is not going to require ...
0
votes
1answer
284 views

How to secure my authentication code?

I'm working a PHP project where I need to authenticate users to a portal. Just wanted to get your opinion on the code, statistics of the website show some strange behaviour with the login form. ...
0
votes
2answers
230 views

How does Google manage their Google Images SSL certificate?

When an SSL certificate is installed on a website, but the page also calls content from another website without an SSL certificate, the SSL certificate icon will turn grey instead of green: instead ...
0
votes
1answer
4k views

Zend framework 2 authentication - only storing the user ID in session

I've just put together my first app using Zend_Authenticate. According to some tutorials I've read they store the user's "email" column. Is this recommended? I've read to store the ID only, then on ...
0
votes
3answers
701 views

VB stand alone application or ASP web application

I have experience developing software and web applications and I have decided to do some freelance work on the side. Well, I met with my first client and they are requesting a relatively simple, ...
0
votes
2answers
90 views

How ensure secure two cloud services can only talk to each other?

Question Given two cloud services, Sender A & Receiver B, communicating over HTTPS, what options do I have to ensure that Receiver B only response to Sender A? For the purposes of Background ...
0
votes
1answer
578 views

Storing escaped mysqli characters in database but outputting them correctly with htmlspecialchars()

I have a database sanitizing function that I use when the user enters some data into my website. I escaping the mysqli characters with mysqli_real_escape_string(), but I wish to also output the ...
0
votes
2answers
233 views

What is the logic behind filtering/sanitizing input?

I have always found it more logic to validate input instead of filtering it. How to appropriately filter data depends on the situation, so IMO it should be done in output or when saving to a database. ...
0
votes
1answer
169 views

Multiplayer Game Listen Servers: Ensuring Integrity

I'm making a simple multiplayer game of Tic Tac Toe in Python using Bridge (its an RPC service built over a message queue - RabbitMQ) and I'd like to structure it so that the client and the server are ...
0
votes
1answer
2k views

How is JavaScript insecure, and what are the main methods used to deal with that? [closed]

I just read about Caja, which is a "sanitized" version of JavaScript. But I'm wondering - what is the big problem with JavaScript(it seems so widely used )? Just how dangerous is it?
0
votes
2answers
72 views

Marking services for secure handling; Annotation or inheritance?

We have a lot of services, some that demand some security, some that don't. We want an easy way of telling, in code, if a service will be secure or not. What would be the better way: Annotation or ...
0
votes
1answer
53 views

Check that a POST request is the origin of the application and not of a user

Hello, I want to secure access to a POST request so that the user cannot forge it via software such as postman. Let’s say a player plays a game and gets a score. At the end of the game, the score is ...
0
votes
1answer
75 views

Is it a bad thing to delegate a callout to an external system, given that my current one can't do it?

Custom code written for the Salesforce platform is incapable of making a PATCH request to an external server (PUT and POST are okay though), and I need to make a PATCH request to an external service (...
0
votes
1answer
74 views

How to manage model(s) between web client (DMZ) and web API?

I have this web API project which handle all database access via entity framework. I have another web client reside in DMZ to call those APIs (via ajax or c#) in the web API project. When I make API ...
0
votes
1answer
112 views

Programatically normalizing role based security systems

Role based security is a very common model for software nowadays. It is very powerful but requires careful configuration to leverage the benefits of shared roles. It is easy for a mess to be made for ...
0
votes
3answers
97 views

What should I be aware of when allowing user comments on my website?

I have a portfolio website and i'm planning on allowing comments as a sort of "guestbook" feature. What are some things i should consider before starting? I don't want to get screwed over by a ...
0
votes
1answer
146 views

What is the right way not to put passwords into end user program in java?

In the simplest form, our (near future) project consists of a end user program, that directly connects to databases and apis. This is obviously bad as then the end user program consists of sensitive ...
0
votes
1answer
2k views

How can I safely expose web API endpoints for user-private data?

I'm building a web application wherein users CRUD their own private data. Can I safely expose API endpoints? Despite years in-industry and endless web-research, I'm not clear on the best ...
0
votes
2answers
242 views

Are all code signing certificates cross-platform?

I have an application, that can run on both Windows and macOS. I want to apply a digital signature to its binaries. I have already got a Thawte certificate (with private key) for Windows. Can I use ...
0
votes
1answer
127 views

Data structures and algorithms for event correlation

What data structures and algorithms are suitable for event stream correlation? Specifically, I am looking at these two use cases: X occurrences within t seconds grouped by some variables (v1,v2). For ...
0
votes
1answer
627 views

Is it necessary to use inline JavaScript with React? Would React therefore get blocked by default by Content Security Policies (CSPs)?

According to https://www.quora.com/What-are-the-key-difference-between-ReactNative-and-NativeScript/answer/Valentin-Stoychev , "ReactNative as using the notation found in React for inlining the UI ...
0
votes
1answer
84 views

Extensible web application where users can upload client-side code

I have a simple web application built with Angular which fetches some state from a web server and shows it to the user. Additionally I want to implement a feature where users are able to customize the ...
0
votes
1answer
854 views

Eclipse plugins - safe to install? [closed]

I've seen a few useful plugins for Eclipse such as jshint-eclipse. However, I'm a bit leery of installing third-party code. Is it generally safe to install Eclipse plugins without worrying about my ...
0
votes
2answers
536 views

What is the value of encoders with decoders currently present

Can you tell me the value of using PHP encoder (ioncube, phpshield) with currently present service like decry.pt (http://www.decry.pt/) that can easily decode source codes. I have tried decry.pt's ...
0
votes
3answers
395 views

Making internal search engine return results that adhere to local permissions on an internal web application

I have an ElasticSearch search engine and an internal web application. Prior to applying the security model, search results were very fast. The security model restricts some users from accessing ...
0
votes
2answers
72 views

Hashing + security as it pertains to a theoretical file sharing site

These days it's possible to hash a file client-side, send the hash to the server, and have the server check whether or not that file is already uploaded. If it is, we can skip the file upload and make ...
0
votes
1answer
290 views

Browser security and payments

I've been finding a lot of blog posts claiming JS encryption is unsafe, here's a couple of detailed ones: http://www.matasano.com/articles/javascript-cryptography/ http://rdist.root.org/2010/11/29/...
0
votes
1answer
105 views

Encyption for passwords in config file? [closed]

I was wondering, if it makes sense to encrypt passwords for external services stored in my config file with an symmetric encryption algorithm? On the one hand I think, if someone gets access to the ...