Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
11
votes
3answers
14k views

Securely storing secret data in a client-side web application

I have this web application that is going to be all client-side technology (HTML, CSS, JavaScript/AngularJS, etc...). This web application is going to be interacting with REST API in order to access ...
10
votes
2answers
673 views

How can I prevent programmers from capturing data entered by users?

I'm developing a web application with a strong focus on security. What measures can be taken to prevent those who work on the application (programmers, DBAs, quality assurance staff) from capturing ...
10
votes
4answers
409 views

Could developers learn anything from studying malware? [closed]

Malware uses interesting techniques for hiding themselves from anti-malware software and more. They can "polymorph" themselves: practically change the code while it continuing to mean pretty much the ...
10
votes
3answers
531 views

What do programmers at security firms do?

I have heard of security firms who consult on the security of a clients systems. All of the people I know in this field are network engineers, but I know programmers get involved in security as well. ...
10
votes
2answers
370 views

Weaknesses of 3-Strike Security

I've been reading some literature on security, specifically password security/encryption, and there's been one thing that I've been wondering: is the 3-strike rule a perfect solution to password ...
10
votes
2answers
4k views

Is masking really necessary when sending from Websocket client

The current Websocket RFC requires that websocket clients mask all data within frames when sending (but server is not required to). The reason the protocol was designed this way is to prevent frame ...
10
votes
7answers
1k views

Is the use of security conditionals in a view a violation of MVC?

Often what's displayed to a user (e.g. on a web page) will be based partly on security checks. I usually consider user-level / ACL security to be part of the business logic of a system. If a view ...
10
votes
5answers
437 views

What are unique aspects of a software Lifecycle of an attack/tool on a software vulnerability?

At my local university, there is a small student computing club of about 20 students. The club has several small teams with specific areas of focus, such as mobile development, robotics, game ...
10
votes
3answers
12k views

OAuth2 flow - does the server validate with the Auth server?

I've been reading a lot on OAuth2 trying to get my head around it, but I'm still confused about something. I understand that the client authorises with the OAuth provider (Google for example) and ...
9
votes
9answers
4k views

What is a reasonable and secure password requirement for user registration?

This is the password policy I just got from UPS (just for package status checking): Your password must be between 8 and 26 characters long. It must contain at least three of the following ...
9
votes
11answers
733 views

Do you actively think about security when coding?

When you're coding, do you actively think about your code might be exploited in ways it wasn't originally meant to do and thus gain access to protected information, run commands or something else you ...
9
votes
2answers
2k views

How do CDNs protect failover sites from DDoS attacks?

I'm in the design process for a Java web app that I will probably end up deploying to Google App Engine (GAE). The nice thing about GAE is that I really don't have to worry about fortifying my app ...
9
votes
3answers
548 views

When should an IT consultant use full disc encryption?

In what circumstances should an IT Consultant encrypt their hard drive to protect their code/data of their clients? I am thinking that if it does not add much to your work load you might as well use ...
9
votes
2answers
19k views

How to avoid unauthorized use of an API?

I have to design a "widget", a script that partners will embed in their websites to display some UI and make calls to our API. Basically it will display our data on these sites based on some IDs they ...
9
votes
3answers
2k views

How to separate sensitive data in database(MySql)

I need to design a database that will contains information about personal disease of users. What can be the approach in order to implement the columns of the DB's tables: encrypt the information, ...
9
votes
2answers
3k views

Should access permissions and roles be included in payload of JWT?

Should information about the permissions and roles of the client be included in JWT? Having such information in JWT token will be very helpful as everytime a valid token comes, it would be easier to ...
9
votes
1answer
8k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
9
votes
1answer
7k views

Permissions/right model/pattern for .NET application

I need to implement flexible AND simple (if such thing exist) and at the same time utilize built-on means if possible So far I have MembershipProvider and RoleProviders implemented. This is cool but ...
9
votes
2answers
726 views

Imitating Exchange Server's “RBAC AuthZ” in my own application… (is there something similar?)

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user. (Image source) This is a great & flexible model ...
8
votes
6answers
2k views

What are the cases where keeping source code secret is justified?

When I worked as a freelancer, I encountered lots of cases where customers were protecting their ideas and source code of their projects (such as web applications) as much as possible, no matter how ...
8
votes
5answers
5k views

Security issue about making my code public in GitHub

I'm developing a big community/forum website and I'd like to upload my code to GitHub to have at least some sort of version control over it (because I have nothing other than a .rar file as a backup, ...
8
votes
4answers
269 views

Avoiding “double” subscriptions

I am working on a website that requires a bit of marketing; let me explain. This website is offering a single, say, iTunes 50$ voucher to a lucky winner. To be entered in the draw, you need to ...
8
votes
3answers
1k views

What is the best policy for allowing clients to change email?

We are developing a web application with a fairly standard registration process which requires a client/user to verify their email address before they are allowed to use the site. The site also ...
8
votes
6answers
751 views

How to refuse to give an access to passwords to a customer without being unprofessional or rude?

Let's say you're creating a website for a customer. This website has its own registration (either combined with OpenID or not). The customer asks you to be able to see the passwords the users are ...
8
votes
3answers
2k views

Is it a security flaw to log the class and method name when an exception occurs?

I have the following : public class doCheck(){ public void performCheck(){ try { perform all checks...... } catch(Exception e){ logger.error("...
8
votes
4answers
728 views

How do you go about checking your open source libraries for keystroke loggers?

A random person on the internet told me that a technology was secure(1), safe to use and didn't contain keyloggers because it is open source. While I can trivially detect the key stroke logger in ...
8
votes
3answers
1k views

What is the best way to learn how to develop secure applications?

I would like to get into computer security in my career. What are the best ways to learn how to program securely? It seems to me that, besides textbooks and taking classes in the subject, perhaps ...
8
votes
2answers
7k views

What are the reasons for sealing a .jar and how would I verify that?

I have created a sealed jar, but I don't see difference compared to using a non-sealed one. What tests I can perform to verify the jar is sealed? What reason we could have to prefer using a sealed ...
8
votes
3answers
3k views

REST API authorization strategies

There are a lot of questions on here that deal with the mechanics of authentication and authorization of RESTful APIs but none of them appear to go in to details of how to implement secure services at ...
8
votes
1answer
9k views

How frequent should the Token Updation in CSRF security be?

To start with the background, this post is what Jeff Atwood says about CSRF tokens. In this very page, he goes on to say: An even stronger, albeit more complex, prevention method is to leverage ...
8
votes
2answers
814 views

Best practice for sensitive information in source control

I know this topic has been covered quite a lot but I can't find an answer to my specific situation. Currently, I'm using .gitignore to exclude sensitive content and keeping it (config files, etc) ...
8
votes
1answer
16k views

What security is used by default in WSHttpBinding (service side) or the WCF Test client (client side)?

I recently moved a service from BasicHttpBinding to WSHttpBinding (i.e. SOAP 1.1 -> SOAP 1.2). In WCF, using WSHttpBinding() makes it start using some default security settings. I presume the same ...
8
votes
2answers
326 views

Data encryption/protection - where to find info about high-level best practices [closed]

I feel that no one in the group I work in, myself included, really groks encryption and security, or the reasons behind making certain decisions. For example, we recently had a conversation regarding ...
8
votes
2answers
934 views

Is this solution RESTful and secure?

Our product registers new players on our service, and we've chosen to host it on Azure (we're using .NET) and we wanted it to be stateless (for scalability) and relatively secure. Since this is the ...
8
votes
1answer
3k views

Token-based authentication using access and refresh tokens

I am implementing a token-based authentication system for a REST API using a short-lived access token and a long-lived refresh token. This is an abstract overview of the relevant API endpoints (HTTPS ...
8
votes
1answer
373 views

Securely sandboxing user scripts in a C++ program

I've been working on a personal project in C# whose purpose is more or less to allow the user to execute scripts written by other users and restrict the permissions of that script. My program compiles ...
8
votes
1answer
279 views

Securely sending data from shared hosted PHP script to local MSSQL

I'm trying to add data from a webhook (from a web cart) to a local Microsoft SQL Server. It seems like the best route for me is to use a PHP script to listen for new data (POST as json), parse it, ...
7
votes
3answers
460 views

Converting a 1,000,000 rows database

If I have a database that stores the login credentials of 1,000,000 users in PLAINTEXT, how much effort will it take me to md5 hash these passwords?
7
votes
4answers
4k views

What type of Password Reset/Forgot Password (verification) mechanism would you recommend

I am looking for ways to verify the user in order to reset their passwords. 2 commonly used ones: Email verification Secret question I wonder which will you recommend? I am trying to avoid having to ...
7
votes
10answers
687 views

In what situations would it be technically 'impossible' to release a system as open source?

While there are certainly many economic, social and practical decisions to be made when deciding whether a system should be open source, are there any situations in which it is impossible, purely from ...
7
votes
2answers
5k views

Where can I safely learn about computer security? [closed]

I find it really hard to find resources about computer security. I asked questions on message boards about key loggers and viruses and I got negative assumption from people assuming the the worse. ...
7
votes
1answer
223 views

Why is it more unsafe to store your password in the URL of a git repo?

As a comment on a response to this question, someone says: It is not advisable to put the password in the URL for this file is saved on the .git/config . Is not safe, it is better to use ssh key ...
7
votes
1answer
3k views

Naming in Security Protocols: Alice, Bob and Eve [closed]

Among computer scientists and programmers, there's the common habit of naming people in the context of security protocols e.g. Alice, Bob or Eve. Descriptions of more elaborate attack vector sometimes ...
7
votes
3answers
337 views

How to explain to my customer that the hosting provider is terrible, security-wise?

As a freelance developer, I sometimes have to access the administration panels of hosting providers of my customers. It is an astonishingly frightening experience. Below are some points I noticed when ...
7
votes
7answers
2k views

How to make security usable in a web application?

I'm in the planning stages of developing a web application that I want to make as secure as possible. I'm pretty clear about how to do that from a technical point of view, but there is one massive ...
7
votes
4answers
6k views

Storing sort code / account number on website. Security?

People in the UK will probably better understand what a sort code is and how sort code & account numbers are used for transfers etc, but the question is relevant to anyone I'm sure. Just to ...
7
votes
5answers
6k views

What approach to use to prevent multiple requests to API which is exposed to public

I have an api where visitor can send an email through subscription: /api/subscribe To prevent massive load due to public exposure, how can I secure this endpoint? Do I have to use database or can I ...
7
votes
2answers
289 views

Do you apply a code of conduct on accepting jobs, projects or requirements?

When writing software for yourself, your company or third parties, do you always consider certain principles, values, standards, or rules of behavior that guide the decisions, procedures and systems ...
7
votes
2answers
8k views

Why is Google blocking users from accessing their local file system in Chromium? [closed]

The question is based on this issue in Chromium. It is marked as Won't Fix. Do you see any reason to block a local html file from accessing another local html file located in the same folder?
7
votes
2answers
3k views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...