Skip to main content
OverflowAI is here! AI power for your Stack Overflow for Teams knowledge community. Learn more
208 votes
Accepted

Are private, unguessable URLs equivalent to password-based authentication?

A private URL is somewhat weaker than authentication with credentials, even if the bit size of the URL is the same as that of the credentials. The reason is the URL may more easily "leak". It is ...
JacquesB's user avatar
  • 59.7k
148 votes
Accepted

Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?

The problem is that #1 requires you effectively parse and interpret the entirety of the SQL variant you're working against so you know if it is doing something it shouldn't. And keep that code up to ...
Telastyn's user avatar
  • 109k
98 votes
Accepted

Is it a security vulnerability to declare class members as public?

Access modifiers like public/private/protected are not intended as a security boundary. And since C++ is not a memory-safe language, this cannot be a security boundary. The laziest “attack” to access ...
amon's user avatar
  • 134k
95 votes

What is the purpose of identifier-first login screens?

This is common with federated identity systems where a service authenticates users from many identity providers. Your email address is used to look up which identity provider can authenticate you. ...
Greg Burghardt's user avatar
79 votes

Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?

Because option 1 is not a solution. Screening and filtering means rejecting or removing invalid input. But any input might be valid. For example apostrophe is a valid character in the name "O'Malley". ...
JacquesB's user avatar
  • 59.7k
60 votes

Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?

If you're trying to do string processing, then you're not really generating an SQL query. You're generating a string that can produce an SQL query. There's a level of indirection that opens up a lot ...
Joshua Taylor's user avatar
59 votes

Is this scenario an exception to the rule of never storing passwords in plaintext?

This is a really good example of insecure authentication, justified on the basis that if the site is compromised it is not possible to identify the person. If that's the case, why do we even need a ...
Michael Shaw's user avatar
  • 9,945
59 votes
Accepted

SQL sanitizing in code with no user input

If there is never any user input at all, or the program is only used internally, the importance of sanitizing should be reduced. But there are still a few possible reasons to always do so If all ...
JonasH's user avatar
  • 5,489
54 votes

Is Reflection a disadvantage as private variables cannot be restricted?

The purpose of access modifiers is to inform developers writing code about what is the public interface of a class. They are not in any way a security measure and they do not literally hide or secure ...
JacquesB's user avatar
  • 59.7k
53 votes

What is the purpose of identifier-first login screens?

The purpose of this is to redirect to the account's identity provider. However the use case is not selecting between personal login providers such as Facebook or Google. It's to support organisational ...
Wes Toleman's user avatar
48 votes

Are private, unguessable URLs equivalent to password-based authentication?

Note: A lot of people seem to be confusing a "private" URL with authentication. Also, there seems to be some confusion that sending the link via a trusted entity is an attempt at two-factor ...
Charles D Pantoga's user avatar
46 votes

Is Password Hashing Bad?

This is a reasonable point being justified using incorrect claims. The issue here isn't about having users enter passwords. How do you think they're going to log in to Google/Facebook/any other third ...
Flater's user avatar
  • 51.7k
41 votes

SQL sanitizing in code with no user input

Parameterised queries should be your standard approach to all SQL. If you are trying to find reasons why you don't have to use them, then you are doing yourself a disservice. In your example you have ...
Ewan's user avatar
  • 76.3k
35 votes

SQL sanitizing in code with no user input

By using parameterized queries your SQL server doesn't have to recalculate the query execution plan each time you use a query. This can improve performance for queries ran often.
Pieter B's user avatar
  • 13.2k
31 votes

Is Reflection a disadvantage as private variables cannot be restricted?

To quote Herb Sutter on class access rights: "The issue here is of protecting against Murphy vs. protecting against Machiavelli... that is, protecting against accidental misuse (which the language ...
Nemanja Trifunovic's user avatar
30 votes

Is this scenario an exception to the rule of never storing passwords in plaintext?

"Never store passwords in plain text" is not a rule. It is a best practice based on common security breaches on naive implementations of password protections. In that sense, the question: Is this ...
ianmandarini's user avatar
  • 2,818
25 votes

Authentication and authorisation for people with intellectual disabilities

Users don't care. Mental disorder or not users simply don't care as much as you do about security. You could set up two factor, OTP, even physical keys and users will still wander off to the bathroom ...
candied_orange's user avatar
24 votes

Which hashing algorithm is best for uniqueness and speed?

I know there are things like SHA-256 and such, but these algorithms are designed to be secure, which usually means they are slower than algorithms that are less unique. The assumption that ...
sacundim's user avatar
  • 4,786
21 votes

How to safeguard a REST API for only trusted mobile applications

To anyone interested, on Android you CAN verify that the request you have gotten was sent from your app. In short, when you upload your app to google you sign it, with a unique key that known only to ...
ndori's user avatar
  • 327
21 votes
Accepted

Authorization and authentication system for microservices and consumers

Authentication and authorization are always good topics I will try to explain to you how we deal with authorizations in the current multi-tenant service that I am working. The authentication and ...
José María's user avatar
21 votes

Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?

It helps that option #2 is generally considered a best practice because the database can cache the unparameterized version of the query. Parameterized queries predates the issue of SQL injection by ...
JasonB's user avatar
  • 339
20 votes

Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?

Simply said: They did not. Your statement: Why did SQL Injection prevention mechanism evolve into the direction of using Parameterized Queries? is fundamentally flawed. Parameterized queries ...
TomTom's user avatar
  • 545
20 votes
Accepted

Difference between 'aud' and 'iss' in jwt

These are intended for scenarios where you have a token issuing authority that is not the same as the application that is the intended recipient. This may not be different for your application. But ...
Paul's user avatar
  • 3,317
18 votes

Is Password Hashing Bad?

The specific claim: "Password hashing is bad" is somewhat odd. If you are supporting passwords, hashing is pretty important. The more interesting and more contentious (based on the other ...
JimmyJames's user avatar
  • 27.4k
17 votes

Authentication and authorisation for people with intellectual disabilities

Two obvious things. One, there's an inadequate specification of who the security measures need to resist, and/or who stands to gain from unauthorised access. No system is wholly resistant to ...
Steve's user avatar
  • 8,913
16 votes
Accepted

Log off system on all devices

Note: I'm not claiming this is how Facebook or Twitter does it, I'm merely providing a general-purpose way of accomplishing 'Logout on all devices'-functionality. Generally speaking, authentication ...
Falgantil's user avatar
  • 339
16 votes
Accepted

Should we store JWTs in database?

The positives/pro I can see of storing the JWT token in our database would be that even after assigning the token we will have the power to invalidate or deactivate the existing the tokens even before ...
guest's user avatar
  • 176
15 votes

Which hashing algorithm is best for uniqueness and speed?

Use SipHash. It has many desirable properties: Fast. An optimized implementation takes around 1 cycle per byte. Secure. SipHash is a strong PRF (pseudorandom function). This means that it is ...
Demi's user avatar
  • 826
15 votes

If passwords are stored hashed, how would a computer know that your password is similar to the last one if you try resetting your password?

One way to implement this is if you reset password, you are usually asked to enter your old password as well. You can simply just use regular string similarity comparison in that situation because you ...
Lie Ryan's user avatar
  • 12.4k
14 votes

Why is it more unsafe to store your password in the URL of a git repo?

It's unsafe because it exposes your password a number of different ways. Any user can see it in the output of programs like top and ps aux -www. They don't need to be root to see your processes. It ...
Charles D Pantoga's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible