Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
0
votes
2answers
351 views

Snapchat clone: How do I secure pre-downloaded notifications so that they cannot be opened outside of the app?

Say I'm making a snapchat clone app for Android and iOS. Let's say that I get a snapchat from Baz. I want to pre-download the audio for this snapchat. However, as the developer, I want to secure this ...
0
votes
1answer
164 views

Do we have any special design considerations for maintaining anonymity in an application?

This is an open-ended question which I am analysing while doing some fun projects in leisure. Websites like Google, Facebook do store user activities and perhaps sell them or use them for ...
0
votes
1answer
114 views

Possible holes in a spam-registration prevention approach?

I was thinking of creating some login code (probably to work with BrowserID so users don't need to store their passwords with my site while also ensuring the supplied email account belongs to them) ...
0
votes
1answer
666 views

Asp.Net MVC Windows authentication - vulnerabilities of http vs https?

I am developing an ASP.Net MVC 3 intranet site that will use Integrated Windows Authentication exclusively. What are the vulnerabilities of the challenge/response authentication traffic being sent in ...
0
votes
2answers
962 views

How does Facebook strip html/apostrophes for XSS but also display it?

I'm not quite sure if this is a question for programmers.se rather than stackoverflow, but here goes. So Facebook [or any other large company] when given something like an apostrophe or html, can ...
0
votes
1answer
825 views

MVP Pattern - Ways to restrict the user action based on security privilleges

In an MVP application, what should be the most appropriate way to implement restriction to some UI actions based on the current user's privileges? For example, in a role-based security, different ...
0
votes
1answer
265 views

Ria service security

I have a silverlight app that connects to a entity framework over WCF ria service. These calls have to be secure. What can I do so only valid users can call the ria service, and to make the call ...
0
votes
1answer
3k views

Should OAuth token be shared to implement SSO?

What's a commonly accepted way of implementing SSO using a third party OAuth provider? I have a server with user resources associated with server's user ID, the user ID also has a Facebook user ID ...
0
votes
1answer
214 views

Security aspects of an ASP.NET that can be pointed out to the client

I need to write several passages of text in an offer to the client about the security layer in ASP.NET MVC web solution. I am aware of security that comes along with MVC 3 and an improvements in MVC ...
0
votes
2answers
259 views

Assigning a local id to a user

I am creating a soap service where users will be able to interact with each other. They will have a contact list where people can be added. One of the security measures(others are in place, too) is to ...
0
votes
2answers
652 views

What is the best way to have security auditing done?

I have an authentication system(ASP.Net library) that I want to make sure is secure. What companies/resources can I use to make sure of this? Also, what should I make sure to do before sending it off ...
0
votes
0answers
23 views

How do I properly secure a Spring Boot app serving server-side rendered pages and API?

I'm wondering how do I properly secure this example app (https://github.com/brunodrugowick/spring-thymeleaf-vue-crud-example). The app is: A Spring (Boot) app with server-rendered pages via ...
0
votes
0answers
40 views

PHP preg_replace() vs filter_var()

I have seen numerous posts on this subject but none really answered my questions. I have some user input that is inserted into my DB and displayed back to the user later. Before inserting it into the ...
0
votes
0answers
44 views

Which authentication should be used for external users (not registered with the system)

I'm working with a project that uses ASP.NET Core 2.2. The main solution contains different projects, including APIs for a mobile application, APIs to integrate the system with third parties, a web ...
0
votes
0answers
37 views

Is it a good practice to store session in two different places?

I have a use case like this and I am wondering if this solution is a good practice or not. Say I have a website called dashboard.com and this is only for US region. When users login here, I am ...
0
votes
1answer
36 views

How to dynamically create and assign user permissions for a group based service

tldr: In building a platform where users can create private groups, and invite other people to those private groups, how is it be to secure those groups? I'm building a platform around private groups ...
0
votes
0answers
55 views

What is the correct way of setting and then differentiating between paid and free user in Firebase / Firestore?

I am developing a mobile application that will have both free and paid versions. The way I see how I could differentiate between what is a paid and free user is to set a property isPaid on their ...
0
votes
0answers
47 views

Prevent token sharing: chained single-use tokens VS a designated invalidation feature

Situation: A Client is requesting a resource from a Host multiple times, usually with minutes or hours between requests. The Client has a signed, verifiable token, which we'll call a Receipt, that ...
0
votes
0answers
18 views

W3C Reporting API - Mitigate spam/forged reports

I'm looking into the W3C Reporting API, which enables websites to instruct the client (browser) to send reports about: browser crashes, network errors, browser interventions etc. ouside the JS ...
0
votes
1answer
71 views

How to prevent angular 2 client from accessing privileged fields

I'm learning angular and have been reading about various backend solutions like direct db access, REST, and graphql. One thing I haven't seen addressed anywhere yet is how do you protect privileged ...
0
votes
0answers
36 views

How to restrict API endpoints which are deployed in AWS Application Load Balancer?

I created one webapi application which includes few modules like account, user etc and overall includes 10 or more endpoints. I deployed this in EC2 instances and configured in application load ...
0
votes
0answers
39 views

Which OAuth2 Flow?

I'm just getting into OAuth2 and I'm a tad confused (you've probably heard that before)! I am writing a small independent service which will expose a basic REST API enabling client applications to ...
0
votes
1answer
133 views

Custom ACL Implementation

I have been trying to figure out an ACL solution for my application which should manage API endpoint's access rights dynamically. Some said that I have an option of Spring Security ACL. I checked it ...
0
votes
1answer
45 views

Managing encryption keys in an application with add-on components

I am developing a product that uses custom hardware with accompanying software. It requires additional components which are sold separately to make the overall application work. Using these ...
0
votes
0answers
47 views

Client application and secure data exchange without ssl/tls

I have my own home server and port 80/443 is blocked from my ISP provider. I want to create a Qt gui application that saves my data on my server using REST (using port 8080 or something) using nginx/...
0
votes
0answers
39 views

Detecting web proxy security

Various online resources offer proxy lists claiming that they offer various levels of anonymity. I'm trying to find out how this can be programmatically tested. I suspect the answer lies in headers. ...
0
votes
0answers
453 views

Passing Data Between Tiers in 3-Tier Architecture

Assuming we are talking physical tiers, my understanding is that in order to pass data from say the data tier to the business logic tier the JSON format is used (or XML), so say I have an ORM (...
0
votes
0answers
100 views

Implement taxometer paywall

I need to add a paywall to my site. According to this article, I want to implement a taxometer system. The easiest and least secure way would be tracking the number of viewed articles using secure ...
0
votes
1answer
94 views

Secure Form Submission

This is probably a no brainer, but I've not been able to find an answer that is definitive. I have a Codeigniter site running on Apache with mod_rewrite (to get rid of index.php) and mod_ssl for ...
0
votes
0answers
722 views

Security in Transversal Layer in Domain Driven Design

I'm building a solution based on Domain Driven Design, I'm trying to implement the security system (authentication, authorization, roles, system configuration, connection strings, etc..) in a ...
0
votes
2answers
368 views

secure offline PC storage accessible through javascript

I'm attempting to build a browser-based HTML5 application that has the ability to store data locally on a PC (not mobile device) when offline. This data is sensitive and must be secure. Of course the ...
0
votes
1answer
337 views

How to provide data to a web server using a data warehouse?

We have data stored in a data warehouse as follows: Price Date Product Name (varchar(25)) We currently only have seven products. Once every business day, seven new data points are added ...
0
votes
0answers
37 views

Login to a Web App using PKI Certs [duplicate]

I understand PKI reasonably well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of ...
0
votes
0answers
353 views

How to protect own software from copying [duplicate]

Possible Duplicate: How do you prevent the piracy of your software? Is possible to protect some file from copying if you are administrator of machine? I heard some story about some behavior: one ...
0
votes
1answer
373 views

Web page accessing local system via localhost HTTP API

I have seen this pattern that allows web pages to interact with local system resources through a HTTP interface and I have a couple questions about it: What is this pattern called? What ...
0
votes
1answer
385 views

Secure communication between a mobile app and a microcontroller

I have a MCU-based design that essentially controls other hardware and this MCU is controlled through an app. I was hoping someone could help me figure out how to secure this communication between the ...
-1
votes
7answers
571 views

My very first serious project and I'm concerned about security [closed]

I'm making a small social networking web site for a specific university's students (where I study) and I'm concerned about security (access to the database). What should I do? What I have to check for ...
-1
votes
3answers
184 views

Situations that require protecting files against tampering when stored on a users computer

I'm making a 'Pokémon Storage System' with a Client/Server model and as part of that I was thinking of storing an inventory file on the users computer which I do not wish to be edited except by my ...
-1
votes
1answer
160 views

How can I make sure that people changes his IP or not

I want to check that people who registrates in my site and check in country box , for example, Argentina is really living in Argentina. How can I make sure that people is really living in that country ...
-1
votes
5answers
226 views

Computer security expert using pre-made tools or own? [closed]

As a digital security consultant when is it 'ok' to use tools someone else made (dumb to reinvent the wheel, right?) and when should I make my own?
-1
votes
2answers
177 views

Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()?

Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()? Wouldn't this be a very simple way counter attack web spam bots? Or ...
-1
votes
2answers
262 views

How to manage your personal ssh keys? [closed]

I understand that ssh keys are a cryptographically secured way of authenticating yourself to a service or to another person, but beyond that I'm frankly at a bit of a loss. What confuses me is that I ...
-1
votes
1answer
48 views

Buffer Overflows and Out-of-bounds Writes [closed]

What is the difference between buffer overflows and out-of-bounds writes? Are buffer overflows a kind of out-of-bounds writes?
-1
votes
2answers
314 views

How to process a login form data?

I have created a login form for my website, but the issue is how to process the data provided in the form by the uses. You see, I can't just write a basic function like this one - myfunction(){ if(...
-1
votes
1answer
382 views

In what way does programming help towards cyber security [closed]

I've been studying the cyber security field with great interest. I understand how networking can help cyber security but I am not sure how advanced programming knowledge can help fight cyber crime or ...
-1
votes
1answer
3k views

Can someone please explain reverse look up tables? [closed]

Im finding it difficult to understand reverse look up tables and how it works, and the concept of hash chains. This is apart of a computer security model i am taking. So i understand that brute force, ...
-1
votes
2answers
2k views

Whats the best way to build a HTML/AJAX site that requires login? [closed]

Let's say that hypothetically you wanted to build a website that delivered content to the visitors entirely using HTML and Javascript (AJAX to fetch server side data). The site would require login for ...
-1
votes
3answers
988 views

What is the Best Practice for creating a secure login in a client - server appllication?

It's been a while I have been thinking on what could be the best scenario for creating a secure login in a client-server application running on internet or any other networks ! So I became with the ...
-1
votes
1answer
75 views

How can I securely store and process user data?

I am creating a Discord Bot in Discord.Net. So first, of course this bot is not a professional project, but I still want it to look as professional as possible. And a huge part is the storage and ...
-1
votes
1answer
1k views

How @RolesAllowed annotation is workin in Java [closed]

I know that @RolesAllowd annotation can be used to provide role-based access control to REST endpoints and I am currently using that with RestEASY. I need to know how it is working behind the scenes....