The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
18
votes
13answers
8k views

Is using ELSE bad programming? [closed]

I've often come across bugs that have been caused by using the ELSE construct. A prime example is something along the lines of: If (passwordCheck() == false){ displayMessage(); }else{ ...
17
votes
9answers
7k views

Can you “stop” a C program from being reverse engineered? [duplicate]

I'm sure that many of the middle to high level languages can be reverse engineered. But if a C program can be reverse-engineered, and turned back into editable source code, how do I discourage such a ...
17
votes
5answers
6k views

“Forgot Password” - How to handle this?

I read this answer and found a comment insisting not to send password by email: passwords should not be able to be retrieved by email, I hate that. It means my password is stored in plain text ...
17
votes
2answers
13k views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
17
votes
1answer
2k views

Is there an official standard regarding user password storage practices?

I recently used a government service that I had an account for from years ago. I couldn't remember my password for the service so I used the "forgot password" link and was astonished to see that this ...
16
votes
6answers
7k views

What would truly happen if java.lang.String weren't final?

I'm a long time Java developer and finally, after majoring, I have time to study it decently in order to take the certification exam... One thing that has always bothered me is String being "final". I ...
16
votes
9answers
11k views

How much database access should developers have? [closed]

So I've worked in many different workplaces as a developer and my level of access to the database has been varied. I typically don't have production db access. Most of the time I have access to the ...
16
votes
2answers
5k views

Should UDP data payloads include a CRC?

For a company I used to work for, I had to implement a socket receiver that mostly took data in UDP form over a local connection from some specialized sensor hardware. The data in question was a well-...
16
votes
4answers
8k views

Why do certain sites prevent spaces in passwords?

It seems less common with newer websites, but many websites I need an account on (like for paying bills, etc.) prevent me from creating a password with spaces in it. This only makes things more ...
16
votes
1answer
8k views

REST API security: HMAC/key hashing vs JWT

I just read this article that is a few years old but describes a clever way of securing your REST APIs. Essentially: Each client has a unique public/private key pair Only the client and the server ...
15
votes
6answers
722 views

Discovered large security hole in someone elses website… What to do? [duplicate]

A chap I'm bidding to do some development for has a social network he wrote himself. Not the next facebook by any stretch. But a few thousand local users. I went to have a look at it to see what ...
15
votes
6answers
1k views

How does a large company make rookie mistakes which leave security holes? [closed]

Sony was recently hacked with a SQL injection and the passwords of their user's was stored in plain text. These are rookie mistakes. In such a large company, how does this pass QA? How do they not ...
15
votes
6answers
1k views

How to assure users that website and passwords are secure [closed]

On reliable websites I always see claims such as "All data is encrypted" or "All passwords are encrypted using 128bit encryption" and etc. However I have never come across a claim such as "All ...
15
votes
7answers
4k views

What special considerations are needed when designing databases to hold financial records?

I hope this question isn't too broad. In the future I may need to add some accounting and financial-tracking systems to some applications (mostly web-based applications, but my questions pertains to ...
15
votes
2answers
5k views

Which http response do you return to a hit from a blacklisted ip?

I have been using the http:BL to block bad IP's from accessing my site. If a malicious IP (comment spammer) trys to hit the site I just exit the web script which implicitly returns a 200 OK response. ...
15
votes
4answers
7k views

How to securely implement auto-login

I've read many, many, many posts on how "you're probably storing passwords wrong". They are always referring to storing passwords on a server into which a user is logging; they basically rehash (pun ...
15
votes
7answers
3k views

Why isn't SSL/TLS built into modern Operating Systems?

A lot of the basic network protocols that make up the infrastructure of the Internet are built in to most major Operating Systems. For example, TCP, UDP, and DNS are all built into Linux, UNIX and ...
15
votes
1answer
17k views

What are the best practices to secure a web API?

I need to build a web service API for our mobile app to interact with our server & database (in ASP.Net MVC 4, but that's hardly relevant). Wile most actions do not need users to be registered ...
14
votes
6answers
6k views

Is Reflection a disadvantage as private variables cannot be restricted?

The private modifier is used to restrict access outside the class, but using reflection other classes can access private method and fields. So I am wondering how we can restrict accessibility if it ...
14
votes
12answers
2k views

How important is an SSL certificate for a website?

I'm bootstrapping my own project, it has a registration/login area (via devise with RoR, properly hashed and salted of course). As I'm using subdomains and I need to access them with iframes (it's ...
14
votes
3answers
10k views

Is it a good practice set connection strings in a web config?

Recently I have a discussion with some of my colleagues at my work because they said that it's better have in a .DLL a string connection encrypted. And I said why just don't use the string connection ...
14
votes
5answers
2k views

Why do we need method level security?

In the real world , why do we need to implement method level security ? We either have a web application or a desktop application , where the user accesses the user interface (and therefore directly ...
14
votes
4answers
482 views

Should internal code be shared with non-developers in an organisation?

Where I work, we have a lot of developers and an awful lot of code running our proprietary applications used by staff & customers alike. We also have a lot of smart support staff that like to ...
14
votes
5answers
6k views

Authorization and authentication system for microservices and consumers

We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
14
votes
3answers
6k views

Safe iPhone app ↔ server communication

What would be the best approach to achieving private communication between my iOS app and its server component? Is having a single unchanging “secret key” baked into the app source enough, or do I ...
14
votes
2answers
4k views

Should I keep email addresses as plaintext in database?

It's clear to everyone (I hope) that storing passwords without at least salting/hashing them is a terrible idea. What about emails? Let's say you keep the subscription email address, if you encrypt ...
13
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
13
votes
7answers
929 views

Are all security threats triggered by software bugs?

Most security threats that I've heard of have arisen due to a bug in the software (e.g. all input is not properly sanity checked, stack overflows, etc.). So if we exclude all social hacking, are all ...
13
votes
3answers
902 views

Is reliance on parametrized queries the only way to protect against SQL injection?

All I have seen on SQL injection attacks seems to suggest that parametrized queries, particularly ones in stored procedures, are the only way to protect against such attacks. While I was working (back ...
13
votes
2answers
638 views

What to do when you find a security hole in your company's site

I have found a major security hole in one of my company's public facing site. This is our first public facing site that was converted from an intranet site. I brought this issue up to my boss and they ...
13
votes
4answers
966 views

What to do when your company doesn't encrypt passwords

Background I'm been contracted to help a company maintain their server. I work on some minor PHP projects but also look over performance issues and recently, scan logs for hackers. These guys have ...
13
votes
1answer
748 views

Should microservices be users?

We are trying to determine the best way to authorise users in a microservice architecture, while ensuring microservices have limited permissions. Our architecture uses a central authorisation service ...
12
votes
10answers
6k views

Login using email or username?

Is registration login using email a better idea than username to identify the user?
12
votes
5answers
756 views

Should you ever release something that you yourself could hack?

Being the creator of a program, you are probably in a better position than anyone to be aware of security vulnerabilities and potential hacks. If you know of a vulnerability in a system you wrote, is ...
12
votes
6answers
2k views

Why do most sites require email activation [closed]

Most popular applications nowadays require account activation by email. I've never done it with apps that I've developed so am I missing some crucial security feature? By email activation I mean when ...
12
votes
6answers
4k views

Why do websites restrict the number & choice of characters in a password? [duplicate]

Registering on an insurance company's website right now, and my password is 16 characters long, using a nice variety of letters, numbers, special characters, etc. However, here's their list of ...
12
votes
2answers
38k views

How to prevent my executable being treated from AV like bad or virus?

I'm creating a piece of software, that will run on windows and will act like launcher for the game, to serve as an auto-updater and file verifier in client side PC. One thing I don't understand, why ...
12
votes
6answers
4k views

Where should salt hash values come from?

When adding salt values to a hash value for something like a password that cannot be stored in plain text, what is the best place to get the salt values come from? For context, let us suppose this is ...
12
votes
7answers
6k views

How do you handle database security from a desktop application?

For about 10 years I've worked on various in-house desktop client applications with SQL Server data stores. Rarely did I start these projects - most are takeover work. One thing that seemed constant ...
12
votes
5answers
9k views

Best practices for web application Authentication/Security (Any Platform)

I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many ...
12
votes
1answer
18k views

API Authentication, One time token VS Dynamic tokens

We are working on a new project, we are two lead developers and got on a crossroad on how to use a token to secure the communication between the server and the client. First Suggestion: (The one time ...
12
votes
1answer
7k views

Software architecture for authentication/access-control of REST web service

I am setting up a new RESTful web service and I need to provide a role-based access control model. I need to create an architecture that will allow users to provide their username and password to get ...
11
votes
5answers
808 views

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password?

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password? Wouldn't the two passwords be totally different since one is ...
11
votes
10answers
2k views

Should security restrictions cause a service to return null or throw an exception? [closed]

I'm in a bit of a disagreement with a more experienced developer on this issue, and wondering what others think about it; our environment is Java, EJB 3, services, etc. The code I wrote calls a ...
11
votes
5answers
15k views

Allow Administrator users to login as other users

Do you think it's a good practice to implement a possibilty to allow an administrator user to login in as another user, by-passing password? This could by implemented by a master password or a ...
11
votes
3answers
2k views

How did desktop applications communicate with remote server before webservices?

I don't have lot of expierence with desktop applications, but if I had to create a client server desktop app, the data access would be done through a webservice. I believe data access through a ...
11
votes
7answers
601 views

What information must never appear in logs? [closed]

I'm about to write the company guidelines about what must never appear in logs (trace of an application). In fact, some developers try to include as many information as possible in trace, making it ...
11
votes
4answers
9k views

What are the security risks/vulnerabilities every C programmer must be aware of? [closed]

There are many security risks coming from having close contact to the hardware as opposed to using well-tested and proved APIs from high level programming languages. It is much easier to cause a ...
11
votes
7answers
1k views

Why do modern websites still insist on archaic username/password requirements? [duplicate]

I was signing up for a website last night, and once again was greeted with the fact that my username cannot contain certain characters (including spaces), and neither could my password. Is there a ...
11
votes
1answer
439 views

During account creation, is it better to generate the password automatically and send it to the user, or to let the user create his own password?

This question came up today while discussing with a colleague about the 'create account' page for the website we're working on. My colleague's opinion is that we should make the registration as quick ...