206
votes
Accepted
Are private, unguessable URLs equivalent to password-based authentication?
A private URL is somewhat weaker than authentication with credentials, even if the bit size of the URL is the same as that of the credentials. The reason is the URL may more easily "leak". It is ...
- 56k
146
votes
Accepted
Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?
The problem is that #1 requires you effectively parse and interpret the entirety of the SQL variant you're working against so you know if it is doing something it shouldn't. And keep that code up to ...
- 108k
101
votes
Accepted
REST API security Stored token vs JWT vs OAuth
Consider the first case. Each client gets a random ID that lasts for the duration of the session - which could be several days if you like. Then you store the information relevant to that session ...
- 1,166
100
votes
Accepted
What is a good security practice for storing a critical database on developer's laptops?
Not only do you not want a copy of the production database, it may actually be illegal. For example, in the US, you cannot move production data out of the production environment if it contains ...
- 8,084
98
votes
Accepted
Is it a security vulnerability to declare class members as public?
Access modifiers like public/private/protected are not intended as a security boundary. And since C++ is not a memory-safe language, this cannot be a security boundary.
The laziest “attack” to access ...
- 129k
95
votes
What is the purpose of identifier-first login screens?
This is common with federated identity systems where a service authenticates users from many identity providers.
Your email address is used to look up which identity provider can authenticate you. ...
- 32.3k
91
votes
Accepted
Role vs Permission Based Access Control
(1) What is so "bad" about checking Roles for access control? What
benefits are gained by checking for permissions instead?
At the moment of checking, the calling code only needs to know "does user ...
- 1,946
79
votes
Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?
Because option 1 is not a solution. Screening and filtering means rejecting or removing invalid input. But any input might be valid. For example apostrophe is a valid character in the name "O'Malley". ...
- 56k
60
votes
Why did SQL injection prevention mechanism evolve into the direction of using parameterized queries?
If you're trying to do string processing, then you're not really generating an SQL query. You're generating a string that can produce an SQL query. There's a level of indirection that opens up a lot ...
- 1,610
59
votes
Is this scenario an exception to the rule of never storing passwords in plaintext?
This is a really good example of insecure authentication, justified on the basis that if the site is compromised it is not possible to identify the person. If that's the case, why do we even need a ...
- 9,875
54
votes
Is Reflection a disadvantage as private variables cannot be restricted?
The purpose of access modifiers is to inform developers writing code about what is the public interface of a class. They are not in any way a security measure and they do not literally hide or secure ...
- 56k
53
votes
What is the purpose of identifier-first login screens?
The purpose of this is to redirect to the account's identity provider. However the use case is not selecting between personal login providers such as Facebook or Google. It's to support organisational ...
- 972
50
votes
Accepted
Should I spend time preventing piracy of my app?
No.
Most applications from large developers with real, industrial grade copy protection appear in torrents, cracked, within days of release. It is extremely doubtful that a smaller developer can ...
- 14.7k
48
votes
Are private, unguessable URLs equivalent to password-based authentication?
Note:
A lot of people seem to be confusing a "private" URL with authentication. Also, there seems to be some confusion that sending the link via a trusted entity is an attempt at two-factor ...
45
votes
Is it worth even checking to see if Guid.NewGuid() is Guid.Empty?
If you find Guid.NewGuid() == Guid.Empty you have won the hardest lottery on earth. Don't bother with any uniqueness or collision checking. Not having to do that is what guids are for. I will spare ...
- 2,704
45
votes
Why not just make non-parameterized queries return an error?
There are too many cases where using a literal is the right approach.
From a performance standpoint, there are times that you want literals in your queries. Imagine I have a bug tracker where once ...
- 12.7k
39
votes
One of my team members committed SQL injection-vulnerable code; should I report it to the manager?
There are only two good reasons to report something like this to management: is if you believe that the coder who did this was malicious and attempting to sneak something through, or if you believe ...
- 81.7k
36
votes
Is there any reason not to go directly from client-side Javascript to a database?
It's probably not a great idea. And the first and strongest reason I can give is that a database server isn't designed to be a public web server. To the contrary, conventional wisdom says you should ...
- 13.2k
36
votes
Can you "stop" a C program from being reverse engineered?
It is impossible to prevent reverse engineering for any program that runs on your computer. But you can make steps that make it harder...
Program languages like Java and .NET are trivial to recreate ...
- 9,875
35
votes
One of my team members committed SQL injection-vulnerable code; should I report it to the manager?
This is the whole point of code review.
Mistake is written. Mistake is found and corrected in code review.
Do you want to tattle on your senior team member? This team member according to you has ...
- 12.1k
35
votes
How safe is it to compile a piece of source code from a random stranger?
It depends.
This piece of makefile could delete your home directory :
all:
rm -rf ~
So, if you need to use a tool (like cmake or makefile system), then it is not safe. It just depends how ...
- 13.9k
34
votes
Accepted
Is it worth even checking to see if Guid.NewGuid() is Guid.Empty?
I would suggest it's not worth checking for Guid.Empty. The docs for Guid.NewGuid for some reason mention that
The chance that the value of the new Guid will be all zeros or equal to any other Guid ...
- 456
33
votes
Accepted
JSON Web Token - why is the payload public?
You choose not to encrypt the payload for the same reasons that you choose not to encrypt anything else: the cost (however small it is) exceeds the benefit, and a lot of data simply doesn't need to be ...
- 197k
31
votes
Is Reflection a disadvantage as private variables cannot be restricted?
To quote Herb Sutter on class access rights:
"The issue here is of protecting against Murphy vs. protecting against Machiavelli... that is, protecting against accidental misuse (which the language ...
- 6,795
30
votes
Should I spend time preventing piracy of my app?
Should I spend time preventing piracy of my app?
You are asking the wrong question. Technical safeguards such as proguard are a must but are trying to solve the problem the hard way.
The first ...
- 6,912
30
votes
Is this scenario an exception to the rule of never storing passwords in plaintext?
"Never store passwords in plain text" is not a rule. It is a best practice based on common security breaches on naive implementations of password protections.
In that sense, the question:
Is this ...
- 2,708
29
votes
Accepted
Should UDP data payloads include a CRC?
The UDP protocol does not guarantee that messages are delivered in order or delivered at all, but it does ensure that those messages which do get delivered are complete and unchanged by automatically ...
- 23k
28
votes
Role vs Permission Based Access Control
In response to your first question, the biggest issue with checking that a user has a role rather than a specific permission, is that permissions can be held by multiple roles. As an example to this, ...
- 383
25
votes
Accepted
Kernel mode web servers: A clever optimization or a security nightmare?
Http.sys is not so much a web server as a proxy-forwarder. Its designed to allow many web servers co-exist on a Windows box, so you can have IIS running a web site, but also several WCF services ...
- 48.2k
24
votes
Which hashing algorithm is best for uniqueness and speed?
I know there are things like SHA-256 and such, but these algorithms are designed to be secure, which usually means they are slower than algorithms that are less unique.
The assumption that ...
- 4,708
Only top scored, non community-wiki answers of a minimum length are eligible