A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

learn more… | top users | synonyms (1)

0
votes
1answer
19 views

Security benefits to have IP-filter in HttpModule instead of Page-Load in asp.net pipeline?

I'm working on implementing an IP-filter which blocks all requests by machines outside our IP-range. This is for an asp.net project (written in c#). I've read on multiple forums that the safest way ...
0
votes
1answer
25 views

Security of applications on .net platform

On .net we use SecureString class to keep our applications variables in memory, safely. Microsoft says: Represents text that should be kept confidential. The text is encrypted for privacy when ...
0
votes
1answer
32 views

The security of dll files in a Client/Server application in .net [closed]

I'm going to write a Client/Server application. There are some ambiguous concepts in this that I was not able to get answer to after many hours of searching. As we all know one of the major caveats ...
1
vote
1answer
51 views

Is the security of this .net application flawed?

Ok, I know that every obfuscated .Net application can be reverse engineered. And I know that it is better if I go the open source way if possible. But unfortunately I cannot because there is no ...
1
vote
1answer
36 views

Are there any known breaches of the .NET AppDomain isolation?

.NET AppDomains provide several levels of isolation for untrusted or partially trusted code. The AppDomain sandbox is widely deployed in ASP.NET and Silverlight, although only the latter of these is ...
1
vote
2answers
52 views

Is Ignoring SslPolicyErrors while doing SSL Pinning Secure?

I am implementing SSL pinning as a security requirement for a project and the HTTPS endpoint is giving me SslPolicyErrors. The following errors occur, RemoteCertificateChainErrors ...
2
votes
0answers
34 views

How to use IIS ssl certificate(CNG) for data encryption

I want to use RSA to encrypt/decrypt some data using IIS's ssl ceritifcate, from within a web service(WCF). I've managed so far to do this by using .NET security ...
1
vote
2answers
212 views

SSL Authenticated SOAP Request works in SoapUI but not through code

I am connecting to a SOAP webservice that requires SSL authentication. I (the web service client) have a .pfx file and provided the public certificate for that file to the company whose web service I ...
0
votes
1answer
206 views

RSA key sizes v/s public key sizes

I am new to cryptography. I have an api provided by a bank. The banks says that they are using RSA algorithm with 2048 bits. We used this api first to get the public key. Here is the sample public ...
4
votes
1answer
59 views

Is the ProtectedData class still an acceptable method to store passwords?

I'm writing a piece of software which will have to store a users password to allow authentication with a 3rd Party service. Unfortunately, this service currently requires the use of a password rather ...
4
votes
0answers
48 views

Is there any reason to use AesManaged over DPAPI in this scenario?

I have a situation where my web application is going to be deployed on multiple web servers, and I'll be wanting to store some securely encrypted data on the DB servers (each web server has a DB ...
1
vote
1answer
52 views

How Secure is my Application?

I have created a little application in .NET that serves as a loader for my other applications. Essentially, when opened, this app will get a list of available applications, and when an option is ...
2
votes
1answer
45 views

Are compiler options relevant to C# security? If so, which options?

It is normal to list some extra-secure compiler options to prevent attacks on C and C++. However, I have not found any similar recommendations for C#. Are compiler options simply not relevant to C# ...
2
votes
1answer
419 views

SSL communication between a C# Server and an Android Client App

I'm using a C# server and a C# tcp client example I extracted from the MSDN and I have created a self signed certificate using makecert.exe. I have got this to communicate with one another and it ...
4
votes
2answers
742 views

Best place to store authentication tokens client side

When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
4
votes
2answers
251 views

How to bypass .Net 4.5 request validation, for an XSS attack?

.Net has a feature called request validation which detects malicious inputs and blocks the request. By its nature, request validation is not a precise science. OWASP clearly recommend to only rely on ...
1
vote
1answer
94 views

Correct auth method using oAuth 2.0?

Been trying to wrap my head around oAuth 2.0, but I'm struggling figure out the correct way to implement it for our system, as there are so many different approaches. Our specifications are: Secure ...
1
vote
0answers
30 views

Securing customer assets in .NET

We are rethinking our security and came on an interesting issue. How can me make a generic security implementation for customer owned assets. Does every asset need a direct-indirect relation to a ...
0
votes
1answer
52 views

generate certificate at runtime and validate

I have a project that require client application to register and then use the services. I would like to do the following: A client app sends a request with IP, domain name, etc. to my REST service ...
1
vote
0answers
92 views

Why do we need salt and RFC in generating AES encrypted message

I'm not very familiar with encryption and new to this, I'm just learning it right now by code review of one of the class we have in an application to encrypt a password using AES. Would anyone explain ...
0
votes
1answer
76 views

Exposing Model to POCO in MVVM Entity Framework Application

To start with, I am dangerously bad at security. I am aware of this, which is why I'm asking for help to figure this out. I have a POCO object, which is exposing an ICollection of a model object, so ...
1
vote
1answer
234 views

Is there a way to verify a signed XML in Java

.NET has this great way to sign and then verify the signature of an XML file. Is there a way in Java to verify an XML file that .NET has signed this way? thanks - dave
0
votes
2answers
135 views

Key Management/storage system

In my firm we have a couple of thousand hardware devices, installed externally, that all send back data to a central server. They send back data about every hour. Each of these hardware devices ...
-1
votes
1answer
83 views

Measures that must be taken to protect online banking website [closed]

I building an online banking service in ASP.NET and my objective is to implement all possible security measures. Currently at database level I am using RES 2048 bit encryption to encrypt database ...
5
votes
3answers
3k views

How can I detect a VPN connection (even just in some cases) to get the real location of the user

I'm creating a web site, I would like to allow people to sign-up only from their "real" physical location (not using a VPN). I was thinking maybe comparing local and server time... what else...? ...
0
votes
2answers
852 views

Difference Between MD4 and MD5 encryption

During coding, I have used both MD4 and MD5 encryption techniques. But there hasn't been any noticeable security difference between either of them. And yet, most of them prefer MD5, in fact specify ...
3
votes
4answers
198 views

Lock a website login to a certain computer

I've got a web based system where a specific site only shall be available on a certain computer. On that computer I have a desktop application. The desktop application and the website communicate ...
1
vote
1answer
128 views

Is there any advantage in encrypting a password hash in my database?

I am hashing and storing the salt:hash of each user's password in our database. The web server is ASP.NET and the connection string to the database in web.config is encrypted using the IIS config ...
3
votes
1answer
180 views

Does encrypting a setting in web.config actually provide security?

Does encrypting a value in the web.config file actually provide any real protection? It seems to me that any web app can read that setting. Yes that's more work than just reading the web.config file, ...
0
votes
1answer
3k views

How do I hash a password in C#? [duplicate]

I assume that the best way to handle passwords for a website is I create a hash of the password and save that hash in my database. Then when someone tries to login, I do a hash of the password they ...
4
votes
1answer
500 views

Encrypting/decrypting our license key

We need to provide a license key to customers for our application. The actual license is XML but we need to encrypt it and then in our program decrypt it. I think it is the following, but am asking to ...
0
votes
1answer
107 views

How to identify hackers based on ip addresses and the pages that were accessed

I saw some suspicious errors being generated on my site based on pages that were requested. My error is logging the path that the user is trying to access. Because of these errors (and the paths that ...
1
vote
1answer
91 views

Developer Security Training .NET / JAVA [closed]

Hello my team is tasked to perform security focused training for developers (.NET and JAVA). I have used WebGoat to demonstrate OWASP Top 10 type security vulnerabilities and am looking for a similar ...
2
votes
1answer
136 views

Basic Website Protection (XSS,SQL-inject,hashing)

I have a very simple app that does allow unauthenticated users to leave comments (maybe later I will incorporate a capatcha). The app then stores the comments in a mysql db. I do my best to filter out ...
0
votes
0answers
97 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
3
votes
3answers
214 views

What are the (practical) dangers of writing your own login method?

I have always been told that writing your own login method (e.g. validate user given the username and password) is bad practice, and that one should reuse existing libraries for that. I have always ...
1
vote
0answers
76 views

SSRS custom assembly security issues

I want to invoke a custom assembly that uses protected services (like DirectoryServices, etc...) with reporting Services. On the web, I see a recurring example of configuration (inspired by this ...
1
vote
1answer
178 views

Are “Certificate Templates” used only as a “Template” or do they validate a certificate request?

I'm trying to learn how Microsoft Certificate Templates interact with a certificate request, and can only guess that they take on one of the two/three forms: They simply help the client create a ...
1
vote
1answer
162 views

Advice on using encryption and hashing

I'm going to rephrase a question I asked earlier, as I don't think anyone understood what I meant. Bascially I'm writting a web based password locker, which can have multiple accounts; so that users ...
1
vote
1answer
87 views

Using encryption and hashing

I'm writing a project to securely store and share passwords between users, I've been doing tons of research into encryption algorithms, CSPRNGs, hashing algorithms, key stretching etc... I just want ...
0
votes
0answers
42 views

RSA, SSLStream - KeyExchange

I'm using sslstream to communicate a client and a server, and i need to use RSA encryption, i have made some tests with a brute keyexchange, using sslStream.write(modulusPublicKey). And receiving like ...
3
votes
2answers
120 views

Authenticating AD user over TCP socket

I have a server that communicates with clients over a .NET socket. I want the server to authenticate the connection in an SSO kind of style by checking that the current user is in a certain group. ...
0
votes
2answers
203 views

Programming languages for security? [duplicate]

I am a computer science student interested in the field of security and just had a few questions. What are the pros and cons for using C# for security purposes, I had assumed applications programmed ...
2
votes
2answers
2k views

Ways to inject malicious DLLs to exe file and run it

I'm trying to find all vulnerabilities in my given system. Assume a malicious user has the executable (.exe file) of my .NET application (C#), and a malicious DLL he or she created. Can the DLL be ...
3
votes
2answers
491 views

How to securely use Process.Start?

I am using Process.Start in a Windows Service I created to execute an exe that I have on my server that is used for audio conversion. I am passing some user input as a parameter to this exe. The ...
0
votes
2answers
115 views

How to handle data-dependent Claims?

This question is about Claims-Based Authorization and Windows Identity Foundation (unfortunately I lack the priviledge to create a tag for this). Consider the following simple use case: I have a ...
2
votes
1answer
246 views

Challenge Response Login Authentication with Password Salt

I want to implement a challenge-response login authentication for my web application. My understanding is that the server has to send back the password salt for the user so that the user can ...
1
vote
3answers
209 views

How can I add a layer of security to cleartext passwords and SSL?

I'm creating a web API in .Net for a web application. I'm wondering what the industry standard for login authentication is. I know that most people believe that sending cleartext username/passwords ...
0
votes
2answers
204 views

Encrypting files in .NET?

I am in a situation where I would like to encrypt audio and text files for an application I am working on. I did some looking around and from what I have seen the Rijndal encryption algorithm would ...
1
vote
0answers
155 views

Login Authentication with SSL and HMAC

My question is pretty similar to : http://stackoverflow.com/questions/5487757/using-hmac-sha1-for-api-authentication-how-to-store-the-client-password-secure. Basically, I want to write an API for my ...