Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
0
votes
1answer
51 views

Allowing a dynamic list of IP addresses to access a specific port in an AWS EC2 Instance

The problem I am trying to solve today is DDoS. I am working on a game project which is hosted on a TCP port (7777). The game is known to have a community full of idiots (pardon the language) that do ...
0
votes
1answer
45 views

Managing encryption keys in an application with add-on components

I am developing a product that uses custom hardware with accompanying software. It requires additional components which are sold separately to make the overall application work. Using these ...
0
votes
1answer
511 views

Are there any JSON based notations for Access Control Lists? (Alternative to S-Expression)

I'm looking for a notation that is familiar to modern developers and can supersede s-Notation. (additional insight into Rivest's proposal of s-Expression is here) Is there any Swagger, JSON or other ...
0
votes
0answers
47 views

Client application and secure data exchange without ssl/tls

I have my own home server and port 80/443 is blocked from my ISP provider. I want to create a Qt gui application that saves my data on my server using REST (using port 8080 or something) using nginx/...
0
votes
0answers
39 views

Detecting web proxy security

Various online resources offer proxy lists claiming that they offer various levels of anonymity. I'm trying to find out how this can be programmatically tested. I suspect the answer lies in headers. ...
0
votes
0answers
419 views

Passing Data Between Tiers in 3-Tier Architecture

Assuming we are talking physical tiers, my understanding is that in order to pass data from say the data tier to the business logic tier the JSON format is used (or XML), so say I have an ORM (...
0
votes
0answers
100 views

Implement taxometer paywall

I need to add a paywall to my site. According to this article, I want to implement a taxometer system. The easiest and least secure way would be tracking the number of viewed articles using secure ...
0
votes
1answer
165 views

Personal Digital Signatures in Web Applications [closed]

In order to sign data with personal digital signature in a web application, server side languages like PHP can do the whole job, but that would require that the user uploads his private key, lets say ...
0
votes
1answer
94 views

Secure Form Submission

This is probably a no brainer, but I've not been able to find an answer that is definitive. I have a Codeigniter site running on Apache with mod_rewrite (to get rid of index.php) and mod_ssl for ...
0
votes
0answers
706 views

Security in Transversal Layer in Domain Driven Design

I'm building a solution based on Domain Driven Design, I'm trying to implement the security system (authentication, authorization, roles, system configuration, connection strings, etc..) in a ...
0
votes
2answers
367 views

secure offline PC storage accessible through javascript

I'm attempting to build a browser-based HTML5 application that has the ability to store data locally on a PC (not mobile device) when offline. This data is sensitive and must be secure. Of course the ...
0
votes
1answer
313 views

How to provide data to a web server using a data warehouse?

We have data stored in a data warehouse as follows: Price Date Product Name (varchar(25)) We currently only have seven products. Once every business day, seven new data points are added ...
0
votes
0answers
37 views

Login to a Web App using PKI Certs [duplicate]

I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
0
votes
0answers
350 views

How to protect own software from copying [duplicate]

Possible Duplicate: How do you prevent the piracy of your software? Is possible to protect some file from copying if you are administrator of machine? I heard some story about some behavior: one ...
0
votes
1answer
257 views

Web page accessing local system via localhost HTTP API

I have seen this pattern that allows web pages to interact with local system resources through a HTTP interface and I have a couple questions about it: What is this pattern called? What ...
0
votes
1answer
364 views

Secure communication between a mobile app and a microcontroller

I have a MCU-based design that essentially controls other hardware and this MCU is controlled through an app. I was hoping someone could help me figure out how to secure this communication between the ...
-1
votes
7answers
570 views

My very first serious project and I'm concerned about security [closed]

I'm making a small social networking web site for a specific university's students (where I study) and I'm concerned about security (access to the database). What should I do? What I have to check for ...
-1
votes
3answers
184 views

Situations that require protecting files against tampering when stored on a users computer

I'm making a 'Pokémon Storage System' with a Client/Server model and as part of that I was thinking of storing an inventory file on the users computer which I do not wish to be edited except by my ...
-1
votes
1answer
160 views

How can I make sure that people changes his IP or not

I want to check that people who registrates in my site and check in country box , for example, Argentina is really living in Argentina. How can I make sure that people is really living in that country ...
-1
votes
5answers
223 views

Computer security expert using pre-made tools or own? [closed]

As a digital security consultant when is it 'ok' to use tools someone else made (dumb to reinvent the wheel, right?) and when should I make my own?
-1
votes
2answers
176 views

Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()?

Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()? Wouldn't this be a very simple way counter attack web spam bots? Or ...
-1
votes
2answers
251 views

How to manage your personal ssh keys? [closed]

I understand that ssh keys are a cryptographically secured way of authenticating yourself to a service or to another person, but beyond that I'm frankly at a bit of a loss. What confuses me is that I ...
-1
votes
1answer
44 views

Buffer Overflows and Out-of-bounds Writes [closed]

What is the difference between buffer overflows and out-of-bounds writes? Are buffer overflows a kind of out-of-bounds writes?
-1
votes
2answers
262 views

How to process a login form data?

I have created a login form for my website, but the issue is how to process the data provided in the form by the uses. You see, I can't just write a basic function like this one - myfunction(){ if(...
-1
votes
1answer
371 views

In what way does programming help towards cyber security [closed]

I've been studying the cyber security field with great interest. I understand how networking can help cyber security but I am not sure how advanced programming knowledge can help fight cyber crime or ...
-1
votes
1answer
3k views

Can someone please explain reverse look up tables? [closed]

Im finding it difficult to understand reverse look up tables and how it works, and the concept of hash chains. This is apart of a computer security model i am taking. So i understand that brute force, ...
-1
votes
2answers
2k views

Whats the best way to build a HTML/AJAX site that requires login? [closed]

Let's say that hypothetically you wanted to build a website that delivered content to the visitors entirely using HTML and Javascript (AJAX to fetch server side data). The site would require login for ...
-1
votes
3answers
978 views

What is the Best Practice for creating a secure login in a client - server appllication?

It's been a while I have been thinking on what could be the best scenario for creating a secure login in a client-server application running on internet or any other networks ! So I became with the ...
-1
votes
1answer
140 views

How to secure my browser application against malicious requests?

I'm working on an application which can be added to third party websites. This means that this app runs in the browsers of the users of a third party and I don't have control over what runs in their ...
-1
votes
2answers
640 views

should F12's request headers show session id as cookie?

I'm trying to educate myself on potential web attacks. I just found a site (which will rename anonymous) where it shows me what looks to be like the php session id inside the cookies section of the ...
-1
votes
1answer
76 views

Does Policy-Based authentication remove refactoring security?

I understand Role Based Security. I have read about Policy Based. I have read what others call Activity Based. What I want to know is if I do Policy-Based, am I avoiding what Role-Based requires and ...
-1
votes
1answer
2k views

python login form vulnerability?

<HTML> <HEAD><TITLE>Login Page</TITLE></HEAD> <BODY> <CENTER> <FORM method="POST" action="http://yourserver/cgi-bin/login.py"> <paragraph> Enter ...
-1
votes
0answers
12 views

User Provisioning, how to find a good strategy to use

I am trying to build an application that have upon user registration it will provision a space and Create a database structure reserved only for that user. So technically I will be allocating ...
-1
votes
2answers
905 views

External User ID to Internal User ID

There is an internal API, REST client over DB, all of which methods require User ID as parameter. User ID is an integer value - numeric PK in User table. Also there is an public API, that is like a ...
-1
votes
1answer
185 views

Cookie name security

Is it a security hole to name each session with the username of the user currently logged in? example: //Alice has login sessions_name('Alice'); sessions_start(); //Alice has login //When Bob Logs ...
-1
votes
1answer
26 views

How to implement linkedin authentication/data sharing with multi party?

Hi I am working on application 2. My application interacts with application 1 and 3. Clients of application 1 need to be to share their linkedin profile information with application 3. I have ...
-1
votes
2answers
558 views

Do people modify open source code to hack? [duplicate]

I am trying to create an authentication client and server for my project, and I am trying to think of ways on how a potential hacker could modify my code and use it to hack the servers. Do people ...
-2
votes
2answers
199 views

How much damage can a rogue PHP developer do?

It's often convenient to hire a remote contractor for front-end development. Frameworks, like Laravel, use PHP to render front-end so it would make sense to give the front-end developer rights to edit ...
-2
votes
3answers
241 views

Is there any way to build a tamperproof forum like Reddit? [closed]

Following the recent incident on reddit (viz https://www.reddit.com/r/The_Donald/comments/5ekdy9/the_admins_are_suffering_from_low_energy_have/dad5sf1/) where the CEO of Reddit changed content of ...
-2
votes
2answers
268 views

Protecting application against piracy [closed]

Can I somehow protect a source available (you can see the source, but you don't have rights to use it) application against piracy? Is it even theoretically possible? Not all of the application has to ...
-2
votes
3answers
193 views

Is authentication equally important to encryption?

I am thinking how to implement the login of a new web application and as I search the net, most search result as about authentication instead of encryption. Assumption: The web application is ...
-2
votes
2answers
116 views

How do I ensure my product is correct the first time? [closed]

I am working on a product that will not be able to be updated once released. Furthermore, if the product malfunctions, the results may include death, serious bodily harm, or major financial setbacks. ...
-2
votes
1answer
306 views

What technical documentation to share and not to share to a wide public?

I work as a backend developer in a financial organisation and the organisation has demanded that we migrate all our technical documentation (e.g. info about batches like the names and their scheduling ...
-2
votes
1answer
55 views

Web API interacting with local application [closed]

Situation I have a Desktop Application and a Web Application. I need the 2 to interact with each other. Such though that when a button is clicked on the Web App the Desktop App activates and ...
-2
votes
2answers
123 views

Tables vs. Booleans: Which of the two are more secure for setting admin roles in an app? [closed]

I'm currently in the process of setting up roles where there are regular users, admins, and super admins, each of which have special permissions. I deferred to this post on how to do so. It ...
-2
votes
3answers
336 views

How to handle security of temporary data on web server?

I'm primarily an ASP.NET developer but this question really applies regardless of language. So obviously it is a good idea to prevent external attacks that arise from session hijacking and csrf ...
-2
votes
1answer
556 views

How @RolesAllowed annotation is workin in Java [closed]

I know that @RolesAllowd annotation can be used to provide role-based access control to REST endpoints and I am currently using that with RestEASY. I need to know how it is working behind the scenes....
-2
votes
2answers
45 views

Security of data viewed and altered by a web app

I am working on a system that needs to keep the data safe and not accessible to people without authorized access. The client is a web app that communicates with the servers via APIs. This is what I ...
-2
votes
1answer
69 views

How to let users send to a link

I'm building for a client's service that allows developers to build client side forms, similar to formspree.io, etc. Basically, developers can set an action to their HTML forms which send the POST ...
-2
votes
1answer
397 views

Program to look at the first say 5 characters of a word and return a string if that string is actually the first 5 characters of a word?

For example, say I have a string and it has the letters: RDNAL This is not an actual English word or it doesn't start an actual english word, so the program would skip this string and would avoid it....