Questions tagged [security]

For questions relating to cryptography and IT security. This can be computer, network, or database security.

Filter by
Sorted by
Tagged with
5
votes
3answers
5k views

Is there a better way of handling access control logic instead of it being in the UI?

Through most of my dev experience, I've never had to deal with much variety of access control architectures. They've all been pretty straight forward: Group [Create, Update, Delete] - User 1 ...
5
votes
1answer
137 views

Hardware key removal on a test system

One of my company's applications still requires a hardware key to run, but we're currently in the process of removing that requirement and replacing it with an online check. The issue we are having ...
5
votes
1answer
1k views

Online compilers and repls - not one big security hole?

There are plenty of compilers and REPL services on the web. For example: Fay ide. I find that implementing some similar technology would be very interesting. But it seems like a major security hole. ...
5
votes
4answers
222 views

How do I report software vulnerabilities found in an open source library that are widely used but have a dilapidated team structure?

For most open source project, there is a well-founded project team and corporate sponsorship, and a lot of active contributors. The procedure for filing bug reports are clearly documented. However, ...
5
votes
2answers
4k views

Is setting “permanent” persistent login cookies a bad practice?

I realized that in Rails there is a built in permanent method for its persistent login cookies (aka. "remember me" cookies) method to give the client a cookie that expires in 20 years: cookies....
5
votes
2answers
3k views

How to prevent third party misuse of what is intended to be a private api (avoiding what happened to Snapchat)?

I have never used Snapchat and do not intend to but I have been reading up about what happened to them with respect to the recent media coverage about pictures being leaked especially because I am ...
5
votes
3answers
1k views

Is blocking java applets a necessary security measure?

Chrome 11 is now asking user permission to run both signed and unsigned Applets (yes, for signed applets the user is asked twice). Chromium team decided that this measure is needed even when the user ...
5
votes
1answer
157 views

How to configure HTTPS for deployments without a host name

I currently am in charge of networked linux based hardware that exposes HTTP connections. I want to be able to connect to these through HTTPS, but the hardware deployment has 1000's of installations. ...
5
votes
2answers
1k views

Should I be using a JavaScript SPA designed when security is important

I asked something kind of similar on stackoverflow with a particular piece of code however I want to try to ask this in a broader sense. So I have this web application that I have started to write in ...
5
votes
1answer
791 views

CSRF Protection with codeigniter

I have very little knowledge in application security. I have often seen to protect your application from csrf attacks developers use tokens and pass these tokens with request to validate. I want to ...
5
votes
2answers
474 views

Web application development security best practices [closed]

I am looking for the current, state of the art, coding standards for web development (mostly PHP). Since I do not want to reinvent the wheel I would like to reuse libraries written by people much ...
5
votes
2answers
2k views

Using Facebook to authenticate, how to link to user record in my app? Email?

I'm using Facebook to authenticate users. We also have conventional username/ password login and registration form too. Anyway, when a user chooses to login with Facebook, we use the following ...
5
votes
1answer
2k views

Means for (legit) cross-site scripting

Are there good means for allowing scripts from two or more domains to collaborate in the same browser page? I want to create an extensible platform, where I provide the model and some views, but also ...
5
votes
3answers
190 views

VPN or TLSv1 for securing a programs protocol from field device to mainframe

I am working on a product that requires devices to exists anywhere in the world hooked up to the internet though cell modems or on WLAN lines which communicates to a server(s) that exists elsewhere in ...
5
votes
4answers
5k views

What is the “correct” way to store functions in a database?

Note: Yes, I know that storing functions in databases should be punishable by law. We are developing a financial web application using PostgreSQL, Sinatra and AngularJS. As you may have guessed, a ...
5
votes
1answer
81 views

OAuthv2 authorization grants

I just read this excellent tutorial on OAuthv2 but am still missing some important concepts regarding authorization grants. I'm fundamentally not understanding the necessity for the two request/...
5
votes
1answer
598 views

Safest way to use and store User's third party credentials

I'm working on an add-in that will integrate git into the VBA IDE. I'm using the LibGit2Sharp library under the hood, which supports User name and password credentials, but not SSH Keys. I would use ...
5
votes
2answers
1k views

Is a PHP file secure enough on a GoDaddy Server to hard code an AES salt into the file?

So I am creating a web api for an app I am making. The data is sanitized before it is sent to my web api and then encrypted before it is stored in my MySql server. The phone app sanitizes then ...
5
votes
1answer
3k views

Best practices for expiration of tokens in a Security Token Service (STS)

When creating a Security Token Service (STS) for a claims based security model, it seems appropriate that tokens are generated in such a way that they expire after some duration, as suggested here. ...
5
votes
0answers
110 views

What To Do If I've Found a Vulnerability In a Possible Future Employers Site? [duplicate]

I've been self employed for a long time now and have recently decided that PHP development within a company is the route I'd like to go down. I had an initial interview/meeting yesterday with a ...
4
votes
2answers
1k views

One of my team members committed SQL injection-vulnerable code; should I report it to the manager? [closed]

One of my team members committed a huge mistake; a clear SQL injection-vulnerability. It obviously didn't pass my peer review and I made very clear that this is unacceptable. I never saw this ...
4
votes
4answers
3k views

Why must API keys be kept private?

I have worked with public API's in only one small project, but I recently learned that if one were to distribute a project with API keys inside this is a security risk. So I have two questions: What ...
4
votes
4answers
4k views

Storing credit card information: Looking for a creative solution

I recently found the need to do recurrent billing. I am extremely averse to storing people's credit card information and I refuse to take risks in that area. I am stuck between a rock and a hard ...
4
votes
3answers
369 views

Is my app version a sensitive information

To make maintenance and versions tracking easier, I would like to expose the app version of each of the applications I develop on all my environnements. Can the app version and the last deploy ...
4
votes
3answers
456 views

How to implement better security in Linux?

I'm just investigating the security and control of the Linux platform in comparison to Android. In Android there seems to be a huge development around security - Applications are required to ask for ...
4
votes
2answers
255 views

Why should you prevent a search engine from indexing your development server?

I've heard that you shouldn't let search engines index your development server. The reasons given were: Duplicate content penalties Customers making purchases from an unsecured domain (if eCommerce) ...
4
votes
3answers
379 views

Preventing in database record tampering?

My question regards the best practice / industry standards to prevent rogue users/admins from directly logging into the database console and updating sensitive information such as financial info / ...
4
votes
3answers
312 views

Possible hack aftermath [closed]

After being hacked companies often give numbers and details on how much of their data was compromised e.g "13K user and passwords". After a possible intrusion how do you know what the hacker did in ...
4
votes
4answers
352 views

What security practices should you be aware of when writing software? [closed]

What different types of security do there exist? Why and when should they be implemented? Example: SQL Injection Prevention
4
votes
2answers
422 views

Is security a real argument for centralized version control?

I'm trying to understand if security is a real concern, or if distribution actually does a better job with security. See, the access to the main source repository could be layered and inherently ...
4
votes
2answers
316 views

Isn't it unsafe that any program can access cookies of a browser?

For example, for Firefox the cookies are kept as an SQLite DB in user's folder. Any program can read these cookies. So, for example, can't an .exe program read the contents of a cookie and pretend to ...
4
votes
2answers
266 views

Having an discussion about security concerns with another software engineer [closed]

Background: The company I work for uses different systems to hold their insurance data which is customer related. They want to have an app for their customers where they can find their insurance ...
4
votes
1answer
3k views

How to manage environment variables in local development

I'm in the process of writing a development philosophy document for a small groups of developers (6.5 developers to be specific), but it's ideally a document that will set down the company's best ...
4
votes
2answers
423 views

Polymorphism and the potential security issues

I just read an article on MSDN about reasons for declaring classes as sealed. In the last paragraph, Eric Lippert says: 4) Secure. the whole point of polymorphism is that you can pass around ...
4
votes
1answer
327 views

How can social security numbers be safely stored in databases and retrieved?

How can personal information that needs to be retrieved at a later date be stored securely in a database? For instance when companies store social security numbers and use them for taxation purposes. ...
4
votes
1answer
279 views

How do large corporations store API keys?

When FaceBook or Google give me an API key, are they just storing it in a database? Unlike a password, where you can hash and salt it before putting it in the database, it seems to me that a key ...
4
votes
2answers
1k views

Making sure database connection information is secured

This is the first time that I am working on a web application. I was going through the question What technical details should a programmer of a web application consider before making the site public? ...
4
votes
2answers
2k views

user security pattern recommendation/best practice

I'm looking for good reference on patterns that apply to user security and ACLs for multi-user network applications. I'm re-writing a fairly large application from scratch. Now I'm looking at the ...
4
votes
2answers
1k views

Is exposing a public API that calls a private API a good practice?

This is more about architecture question. I will be developing microservice in Lumen or Slim, it will not be accessible from the public. The private microservice will be dealing private stuff. ...
4
votes
2answers
354 views

Are there any widely accepted sets of standards/practices for secure coding? [closed]

The title should be fairly self-explanatory. We need to update our coding standards, and as part of this process we've been asked to try and follow an industry standard from a recognised/...
4
votes
3answers
4k views

Is it possible to check a client side application identity from server side? [duplicate]

Assume there is a web service which is visible publicly but it must be just responsive to a specific client application. Is there any mechanism to check client side application identity to prevent ...
4
votes
2answers
2k views

Secure an Application/Software by expiration with Date?

I have been working on some software application and I update them every 6 months. Currently, the way I track the date is by extracting the date from the system when the user installs the application, ...
4
votes
1answer
1k views

Using a public username as a login username

It has just dawned on me, that a system I am developing exposes a users username in the URI. This is a problem, since some of the users pages are public. Therefore people will know their username. I ...
4
votes
1answer
2k views

Is sending username via custom HTTP header good idea?

I have a route in a RESTful API where I need to pass a single username (email address) but not password. The route is designed to have GET method, so my options are either query parameters or a custom ...
4
votes
4answers
227 views

How to prevent data-scanning via public API?

Our customer (a bank) needs to publish a web-service API for use by 3rd party applications. The security is going to involve OAuth2 and JWT (JSON Web Token). The problem is that the customer is afraid ...
4
votes
1answer
1k views

API Gateway security (for microservice architecture)

we have started with microservices recently, but we have some problems with implementing the Security layer. The idea is that the request comes to Gateway, the Gateway looks to authorization header, ...
4
votes
3answers
91 views

Should authorized users be allowed to add autocomplete suggestions to the list of symptoms?

I am developing an online medical website (similar to a HIS) whose users are hospitals specifically hospital administrators, doctors, and other staff authorized by the hospital to use the system. ...
4
votes
3answers
5k views

How to store uploaded client documents securely in webapplication

A small company without any IT skills wants to run a web application where customers can enter various bits of data and upload pdfs. The documents regard product specifications and have to be kept ...
4
votes
1answer
404 views

Is it wise to include something like OpenSSL or GnuTLS with a project in a repository?

I am currently working on a project that makes use of the OpenSSL library for secure communications. Since this library is a requirement for building the project, I am considering including it in the ...
4
votes
4answers
251 views

System that splits passwords across two servers

I stumbled upon this news article on BBC, RSA splits passwords in two to foil hackers' attacks tl;dr - a (randomized) password is split in half and is stored across two separate servers, to foil ...

1 3 4 5 6 7 16