Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
7
votes
4answers
10k views

Best practices for connecting from ASP.NET to SQL Server? [closed]

There are several different ways to connect to SQL Server from an ASP.NET application. I'm working on rebuilding an ASP.NET / SQL Server environment right now and I'm trying to figure out which ...
7
votes
5answers
2k views

How can I keep a production Python environment secure?

Most of my work is creating websites in Django (a Python web framework) and deploying them to my own or clients' servers. I work from a virtualenv to separate site from system packages and have ...
7
votes
3answers
537 views

How will writing the transaction part in Java benefit the security of the application, when all other parts are being written in PHP?

A friend of mine while working on a PHP application asked me to write one part of the application in Java. The part that involved transactions. He said it will be better to write this portion in Java. ...
6
votes
8answers
2k views

Are you obliged to provide old employers with access to protected resources? [closed]

Firstly, a disclaimer. This question is not because I'm a disgruntled employee planning to hide some malicious code which I can later blackmail my employer with. I actually quite like the people I ...
6
votes
5answers
4k views

What is the rationale behind entering email twice for registration? [duplicate]

Many web sites ask users to enter their email address twice, sometimes taking the trouble to disable copy-pasting. What is the logic behind this? Is this e.g. a security measure?
6
votes
6answers
1k views

What would you define as sensitive user data?

A recent previous question of mine had an answer that sparked a different and unrelated question in my mind: Customer wants to modify the .properties files packaged in our WAR file The question that ...
6
votes
4answers
726 views

Public-key cryptography security given NSA resources

I was wondering how secure public private key encryption methods are. If two individuals were sending emails back and forth forever, where each person would encrypt the body of the email they were ...
6
votes
3answers
2k views

Are buffer overflows no longer a threat these days?

After following buffer overflow examples and reading on them in various books/websites it seems there are lots of preventative measures in place to protect against them these days. ASLR, /GS flag ...
6
votes
2answers
383 views

Is there any risk of web browsers spying away localhost applications on an Internet-connected PC?

Despite what it might look like this is a serious question. After that story with Android OS and Chrome browser submitting to Google the details of the WiFi access points they see in the neighborhood ...
6
votes
1answer
3k views

How can we protect the namespace of an object in Javascript?

Continuing from my previous question: Javascript simple code to understand prototype-based OOP basics Let's say we run into console this two separate objects(even if they are called child and parent ...
6
votes
2answers
4k views

I need advice developing a sensitive data transfer/storage/encryption system

I got closed on SO and told to post this here as it's about general application design as opposed to specific code. Intro I'm currently working on a project which involves the daily extraction of ...
6
votes
3answers
33k views

How to open a desktop application through browser without a Java applet?

We run a cloud-based medical software, and a very important part of the program is bridging to an imaging software straight from our website, passing information through command line arguments. We ...
6
votes
1answer
5k views

Any ASN.1 parsers written completely in managed code & safe from buffer overflows

ASN.1 is a data format used on HTTPS certificates, and various other critical pieces of infrastructure. I need to analyze some potentially hostile ASN.1 data, and want to ensure my code is safe from ...
6
votes
4answers
4k views

Development of a bot/web crawler detection system

I am trying to build a system for my company which wants to check for unusual/abusive pattern of users (mainly web scrapers). Currently the logic I have implemented parses the http access logs and ...
6
votes
5answers
1k views

Is it safe to display information about old passwords on login failure?

When I changed my Facebook password yesterday, by mistake I entered the old one and got this: Am I missing something here or this is a big potencial risk for users. In my opinion this is a problem ...
6
votes
2answers
1k views

Right way to spread secret keys between microservices

I have a few services that sign some data with an asymmetric cryptography algorithm (like RSA). I need to spread some secret (private) keys between all instances of the service. I've found a few ways ...
6
votes
2answers
6k views

Security in Authentication in single page apps

What's the most secure method of performing authentication in a single paged apps? I'm not talking about any specific client-side or server-side frameworks, but just general guidelines or best ...
6
votes
2answers
394 views

Would I be able to use code hosting services to host malware code?

Let me start by saying that I am a computer security researcher. Part of my job is to create malware to deploy on a controlled environment in order to study or evaluate several aspects of computer ...
6
votes
3answers
307 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
6
votes
1answer
118 views

How does one request / handle personal or financial information?

I would like to create a budget app for Android. Obviously, to be competitive, I would need to allow users to get data from their bank. For [huge] security reasons, this stuff is not just freely given ...
6
votes
1answer
5k views

Are PGP keys as good for certificates as X.509 keys?

I'm working on a decentralized transaction processing system that needs both authentication and general encryption, and I have a design decision to make: should I use PGP or X.509 certificates? While ...
6
votes
4answers
10k views

How to store Role Based Access rights in web application?

Currently working on a web based CRM type system that deals with various Modules such as Companies, Contacts, Projects, Sub Projects, etc. A typical CRM type system (asp.net web form, C#, SQL Server ...
6
votes
1answer
3k views

How do you protect your WCF service?

sometimes a programmer comes up with a brilliant idea to protect his/her webservice created with Windows Communication Foundation. I would like to hear from you guys, which techniques do you use to ...
6
votes
2answers
452 views

How do you handle JWT expiration for long running calls?

Currently we are debating over securing our multiple micro-services. The major concern is that the JWT token provided to us will expire before the call is finished. (This is in the synchronous design) ...
6
votes
3answers
4k views

How to securely implement roles in a Windows Form application?

As an ISV, what is considered best practice for implementing application role based security? In other words, only allow users to access certain features in the application based on what roles they ...
6
votes
1answer
5k views

Is it possible to protect json api scraping using random tokens?

I have built a restful json api for an online store using Laravel. I now wish to create an AngularJS app to run the front-end web application. Product prices for my store need to update every second, ...
6
votes
1answer
171 views

Development-led security vs administration-led security in a software product?

There are cases where you have the opportunity, as a developer, to enforce stricter security features and protections on a software, though they could very well be managed at an environmental level (...
6
votes
3answers
589 views

Are two database trips reasonable for a login system?

I am designing a login system for a project, and have an issue about it requiring two trips to the database when a user logs in. User types in username and password Database is polled and password ...
6
votes
1answer
3k views

Token or ASP.NET Identity based security in ASP.NET Web API 2

Background I have a Web API 2 project, without any extension of ASP.NET MVC or ASP.NET projects. The API will only be used to communicate between the server and Windows 8, Windows Phone 8.1 and iOS ...
6
votes
1answer
2k views

Implementing Digitally signed data in a Web Application

I understand PKI well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of Transactions or ...
5
votes
6answers
3k views

How can I prevent users from creating multiple accounts on a web site?

I'm building a site that needs to guarantee user reputation scores are accurate by preventing users from creating more than one account, at the cost of decreased user signups. So far, the only ...
5
votes
4answers
242 views

Are there languages that make it easier to understand secure coding principles?

I'm interested in expanding my knowledge of security issues: things like buffer overflows, format string vulnerabilities, etc. I'd like to be able to go through a language and understand its security ...
5
votes
4answers
507 views

Steps after SQL Injection detected

I've come across SQL injection vulnerabilities on my companies ecommerce page. It was fairly poorly put together. I believe I have prevented future attempts however we are getting calls about ...
5
votes
3answers
454 views

How to store / not to store passwords

I am building an web site which will allow users to aggregate the information stored in their online profiles ("data feeds") in one place. I am wondering - what is the accepted (from a secureness ...
5
votes
3answers
239 views

Name for sanitizing at the right time?

Recently we had an issue on our site where someone attempted SQL injection via a cookie (we'll call it lastID). NOC was in a frenzy and angry about how the cookie as an attack vector could be ignored....
5
votes
5answers
1k views

Is it possible to insert the hash of an executable into the executable itself without changing the resulting hash? What's the best alternative?

I've been thinking about this problem recently and it really doesn't seem like it's possible, but I figured that I'd ask just in case. Assume a simple program, in pseudocode: run hash on an ...
5
votes
1answer
209 views

Log off system on all devices

On websites like Facebook and Twitter, you've got a function to log off on all devices. How does it work? Does it work with IP addresses or something? What happens when you login on a device and use ...
5
votes
2answers
306 views

Why applications don't have constraint-based security?

In almost any security system I've ever seen, what is controlled is that which person has access to which part. However, in real life, in many situations, security systems also consider when and ...
5
votes
3answers
2k views

Learning about security and finding exploits [closed]

First things first: I have absolutely no interest in learning how to crack systems for personal enrichment, hurting other people or doing anything remotely malicious. I understand the basis of many ...
5
votes
4answers
381 views

Keeping a connection string secure when working with others

Say you've started an open source project and are posting it on a public repository. (like I have, using Codeplex.) One of the key files just makes the connection to the database, contains the login/...
5
votes
4answers
256 views

How can we track how well we're preventing and avoiding security vulnerabilities?

It's pretty easy to track when we fix security vulnerabilities in existing code. But to make sure the whole team is staying on their toes about writing secure code, I'd like to also track how well we ...
5
votes
2answers
2k views

How do you log potentially sensitive data?

I'm working on a web application where the server side makes calls to a foreign server's web service API. The data passed to this API could contain sensitive data (like a user's password) as part of ...
5
votes
3answers
3k views

Did I understand the website “autologin” feature right?

I'm developing an authentication library (*) for a website and I realized that maybe I'm not completely understanding what an "autologin" feature is, and how to develop it. While gathering infos and ...
5
votes
2answers
5k views

Should we store JWTs in database?

While creating/assigning the JWTs to users, should we also store them in our databases? The negatives/cons of storing tokens in database would be, that all the data in the payload of the JWT token is ...
5
votes
1answer
2k views

Security Risks of Unsigned ClickOnce Manifests

Using signed manifests in ClickOnce deployments, it is not possible to modify files after the deployment package has been published - installation will fail as hash information in the manifest won't ...
5
votes
3answers
5k views

Is there a better way of handling access control logic instead of it being in the UI?

Through most of my dev experience, I've never had to deal with much variety of access control architectures. They've all been pretty straight forward: Group [Create, Update, Delete] - User 1 ...
5
votes
1answer
137 views

Hardware key removal on a test system

One of my company's applications still requires a hardware key to run, but we're currently in the process of removing that requirement and replacing it with an online check. The issue we are having ...
5
votes
1answer
1k views

Online compilers and repls - not one big security hole?

There are plenty of compilers and REPL services on the web. For example: Fay ide. I find that implementing some similar technology would be very interesting. But it seems like a major security hole. ...
5
votes
4answers
219 views

How do I report software vulnerabilities found in an open source library that are widely used but have a dilapidated team structure?

For most open source project, there is a well-founded project team and corporate sponsorship, and a lot of active contributors. The procedure for filing bug reports are clearly documented. However, ...
5
votes
2answers
3k views

How to prevent third party misuse of what is intended to be a private api (avoiding what happened to Snapchat)?

I have never used Snapchat and do not intend to but I have been reading up about what happened to them with respect to the recent media coverage about pictures being leaked especially because I am ...