203

A private URL is somewhat weaker than authentication with credentials, even if the bit size of the URL is the same as that of the credentials. The reason is the URL may more easily "leak". It is cached in the browser, logged on the server and so on. If you have outbound links, the private URL may show up in the referrer header on other sites. (It can also be ...


147

The problem is that #1 requires you effectively parse and interpret the entirety of the SQL variant you're working against so you know if it is doing something it shouldn't. And keep that code up to date as you update your database. Everywhere you accept input for your queries. And not screw it up. So yes, that sort of thing would stop SQL injection attacks,...


114

First and foremost here, the priority is to close the security holes. If you're working directly with the engineer who wrote this, document everything and give it to that engineer. If not, tell your employer the security issues are bigger than initially thought and that the site needs a lot of work. Ask to work with the main developer who's on the site, ...


100

Not only do you not want a copy of the production database, it may actually be illegal. For example, in the US, you cannot move production data out of the production environment if it contains regulated information like personal health data, financial data, or even data that could be used in identity theft. If you do, you could be fined, lose your compliance ...


95

I've been writing software for many years and 2 decades ago I used to think along the lines that you're describing and try and work out ways to protect my software. To answer your question: Software protection is done through encryption and obfuscation just like data protection. The shortfalls, as you described, is that much code is very difficult to ...


94

Consider the first case. Each client gets a random ID that lasts for the duration of the session - which could be several days if you like. Then you store the information relevant to that session somewhere server side. It could be in a file or a database. Let's suppose you pass the ID via a cookie but you could use the URL or an HTTP header. Session IDs/...


90

It's simple: any security mechanism that relies on the client to do only what you tell it to do can be compromised when an attacker has control over the client. You can have security checks on the client, but only to effectively act as a "cache" (to avoid making an expensive round-trip to the server if the client already knows that the answer will be "no"). ...


80

There's a difference between ignorance and incompetence. There was a time when you didn't know what SQL injection was either, and there's no reason to believe the original programmer isn't capable of fixing the problems once he is made aware of them. So tell them. Be specific and objective, and make yourself available to answer questions, provide examples ...


80

Because option 1 is not a solution. Screening and filtering means rejecting or removing invalid input. But any input might be valid. For example apostrophe is a valid character in the name "O'Malley". It just have to be encoded correctly before being used in SQL, which is what prepared statements does. After you added the note, it seems you are basically ...


74

I tend to build an application log, either in DB or in file, and log all such information to that. You can then give the user an error number, which identifies which log item the error is related to, so you can get it back. This pattern is also useful as you can follow errors even if the users don't bother raising them with you, so you can get a better idea ...


73

(1) What is so "bad" about checking Roles for access control? What benefits are gained by checking for permissions instead? At the moment of checking, the calling code only needs to know "does user X have permission to perform action Y?". The calling code does not care about and should not be aware of relationships between roles and permissions. The ...


72

Two easiest ways to get through CAPTCHA: Use human farms, i.e. ask for people to fill CAPTCHAs for money, just like ProTypers does. Use an OCR. There may also be a bug either in the CAPTCHA mechanism itself or the surrounding application, allowing someone to bypass the CAPTCHA. By the way, the W3C article Inaccessibility of CAPTCHA : Alternatives to ...


65

Try it like this: If the username exists, log "failed login attempt by username". If not, log "failed login attempt by IP 123.45.67.89" instead. That should take care of the problem of having passwords show up in the log accidentally.


64

If you are wanting to create a hash map from an unchanging dictionary, you might want to consider perfect hashing https://en.wikipedia.org/wiki/Perfect_hash_function - during the construction of the hash function and hash table, you can guarantee, for a given dataset, that there will be no collisions.


60

If you're trying to do string processing, then you're not really generating an SQL query. You're generating a string that can produce an SQL query. There's a level of indirection that opens up a lot of room for errors and bugs. It's somewhat surprising really, given that in most contexts we're happy to interact with something programmatically. For ...


60

This is a really good example of insecure authentication, justified on the basis that if the site is compromised it is not possible to identify the person. If that's the case, why do we even need a username? just give each student a secret access code. Here are some of the flaws: Scale of breach - The entire site will become compromised by someone ...


54

The purpose of access modifiers is to inform developers writing code about what is the public interface of a class. They are not in any way a security measure and they do not literally hide or secure any information.


50

You Can't. You can never verify an entity, any entity, be it a person, hardware client or software client. You can only verify that what they are telling you is correct, then assume honesty. For example, how does Google know it is I'm logging into my Gmail account? They simply ask me for a user name and password, verify that, then assume honesty because ...


50

No. Most applications from large developers with real, industrial grade copy protection appear in torrents, cracked, within days of release. It is extremely doubtful that a smaller developer can match that. Trying to will just waste your time, leaving less time for you to develop features/apps that make money. You may want to do trivial work to keep "...


49

The same origin policy is a wholly client-based restriction, and is primarily engineered to protect users, not services. All or most browsers include a command-line switch or configuration option to to turn it off. The SOP is like seat belts in a car: they protect the rider in the car, but anyone can freely choose not to use them. Certainly don't expect a ...


48

Note: A lot of people seem to be confusing a "private" URL with authentication. Also, there seems to be some confusion that sending the link via a trusted entity is an attempt at two-factor authentication. To be clear, we're talking about a publicly accessible resource, albeit one that is sufficiently hard to guess. When using a private URL, you ...


45

There are too many cases where using a literal is the right approach. From a performance standpoint, there are times that you want literals in your queries. Imagine I have a bug tracker where once it gets big enough to worry about performance I expect that 70% of the bugs in the system will be "closed", 20% will be "open", 5% will be "active" and 5% will ...


43

If you find Guid.NewGuid() == Guid.Empty you have won the hardest lottery on earth. Don't bother with any uniqueness or collision checking. Not having to do that is what guids are for. I will spare you the math, it's everywhere on the web. Also, Windows guids always have one "digit" equal to 4. There is some structure to guids. That code snippet you posted ...


42

Really, there is absolutely no reason to exempt developers from having anti-virus software on their machines. And overwhelmingly many reasons to require it. Most of the disadvantages you mention can be addressed by telling the anti-virus software that your development folder (the one tied to your code repository) is a trusted location. After we had done ...


42

If you care enough about rolling out the new hashing scheme to all users as quickly as possible (e.g. because the old one is really insecure), there is actually a way for instantaneous "migration" of every password. The idea is basically to hash the hash. Rather than waiting for users provide their existing password (p) upon next login, you immediately use ...


42

Also, as my users have to access the data anyway I will need to have a public key for the outside world somewhere in between. Exactly. Take the stateless HTTP, who would otherwise not know what resource it should request: it exposes your question's ID 218306 in the URL. Perhaps you're actually wondering whether an exposed identifier may be predictable? ...


42

In my opinion, before asking how, you should be asking whether it's needed and/or worth it. I think in many cases, it isn't. People are (understandably) quite paranoid about other people stealing their codez. But is this fear rational? I think it usually isn't. Is your app really so awesome that somebody would go to the trouble of reverse-engineering it? ...


41

The one reason to use anti-virus software on development machines that trumps all your arguments is: To comply with security audits. Banks, government agencies, large regulated firms with sensitive data don't have a choice on this matter.


40

I think you've done your part by pointing out the problem and suggesting an alternative. If they insist that you do things that expose them to a certain level of risk, you should make sure you have a paper trail (and back-ups of it) showing that they explicitly requested this, knowing the risks involved. If you're really concerned, you could tell them that ...


Only top voted, non community-wiki answers of a minimum length are eligible