A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

learn more… | top users | synonyms (1)

-7
votes
0answers
54 views

How to spoof browser fingerprint? [on hold]

I need some JavaScript code to spoof the following browser information to make a fake fingerprint: Limited supercookie test Hash of canvas fingerprint Screen Size and Color Depth Browser ...
0
votes
1answer
21 views

Want to verify confidentiality of GSS-SPNEGO SASL mechanism (LDAP)

I've been doing some research on LDAP supportedSASLMechanisms and am trying to assert whether or not there is confidentiality protection in play when using GSS-SPNEGO. My initial assessment is that ...
0
votes
1answer
34 views

How to check connectivity between raspberry pi and server [closed]

How to check connectivity between raspberry pi (which act as a client) and server using web-socket
1
vote
1answer
22 views

Using external OAauth Authentication Service, how to manage the users's relations

I'm trying to create an API and a website client for it. Lately I've been reading a lot about OAuth2 as a security mechanism and companies that offers authentication as a service such as auth0.com or ...
3
votes
2answers
52 views

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

My organization has a group policy that is applied to servers enforcing FIPS compliance (Windows AD policy). In .NET, HMACSHA1 is one of the encryption/hash algorithms that is FIPS compliant. I don't ...
1
vote
0answers
31 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
1answer
66 views

Should the salt of a bcrypt hashed password be stored separately

I'm replacing a password storage system. The current implementation uses TripleDES with the key stored in plaintext in both the binaries and the config (in-case one of them is not available for some ...
1
vote
0answers
37 views

How to acquire the RSACryptoServiceProvider from the existing key container?

The Key containers of "Microsoft Base Smart Card Crypto Provider" are enumerated by setting PP_ENUMCONTAINERS flag for the function CryptGetProvParam(). The enumerated key containers are set to the ...
2
votes
0answers
62 views

Mitm Proxy using c# SslStream issues when doing directly from host file [closed]

Im trying to create a local windows MITM proxy with C# to deal with a now unsupported application from a company that no longer exists. The Proxy has to only service one HTTPS domain which is being ...
1
vote
2answers
47 views

Is image uploading to a database secure if you resize the image first in raw bytes?

Please see the upload code below. the method is called within a try, catch. If the code for the image utilities is needed, just say. Basically, everything is handled in raw bytes and then stored to ...
3
votes
1answer
54 views

Membership.GeneratePassword

I am looking for a method to generate a onetime password for provisioning purposes in ASP.NET-MVC. I came across the Membership.GeneratePassword which is in the System.Web.Security namespace. Is this ...
1
vote
0answers
18 views

IX509Extension XCN encoding?

I understand from reading MSDN that the X509 v3 extensions must be handcrafted. This involves the CRL, AIA, name and policy constraints, policy mapping, private key usage period, and subject ...
0
votes
1answer
70 views

How does RSACryptoServiceProvider generate keys

The documentation for the constructor for RSACryptoServiceProvider states "If no default key is found, a new key is created. This constructor creates an Exchange key pair suitable to encrypt session ...
3
votes
1answer
161 views

Is It OK If a Server Does Not Verify a Certificate?

I am currently learning a LOT about Azure, Azure Active Directory, and Azure Key Vault (AKV). To start with, please see this article: In particular, I am interested in this statement: When ...
0
votes
0answers
117 views

Is this c# digital signature implementation secure?

The code connects multiple clients to a server using TCP sockets asynchronously. I have added code to attach a digital signature to the outgoing messages from the server, to authenticate the message ...
3
votes
1answer
80 views

Could this piece of code be harmful ?

I just wrote these 2 functions in C#.net and it can get any user's system IP and MAC address. Isn't this harmful since I got help from microsoft documentation. Could these lead to potential damage or ...
10
votes
3answers
343 views

Is this a weakness of enveloped XML signature?

There might be a problem in many applications based on XML signature verification (provided I am not wrong, of course). Let's have a simple XML message with an enveloped XML signature: <?xml ...
1
vote
1answer
68 views

Storing credentials for desktop app

I have desktop application written in C# with three user roles and some predefined users. It is also possible to create another users or change passwords to predefined users. App has to work offline ...
3
votes
1answer
86 views

What is the best method for key exchange?

I have application working between server and client. All messages must be encrypted and decrypted. I use AES algorithm and I want method to hide the key. I found Diffie-Hellman algorithm, but my ...
2
votes
1answer
176 views

What are the security features of the Microsoft PasswordVault class?

There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials. There are references to it in this source code and this blog. The reason ...
1
vote
0answers
56 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
3answers
166 views

Using HTTP GET instead of a POST request can leak source code?

Is it possible to leak the server-side code of a website if a GET request is sent instead of a POST request to a page? The idea is that if a POST request is made to a webpage e.g. http://<server ...
2
votes
2answers
65 views

Removing vulnerabilities from uploaded files

Our website has a form which allows users to upload image files (png,gif,jpeg and pdf). Once uploaded, the website sends the file (server to server) to the back office api, which then saves the ...
25
votes
11answers
4k views

Is obfuscation worth it [closed]

There are many tools to obfuscate .NET applications. The free ones do some basic obfuscation while commercial ones seem to promise more. My question is: Is it worth to use the commercial obfuscation ...
1
vote
1answer
212 views

Level of security provided with (.NET) obfuscator tools

There are numerous tools that offer to obfuscate .NET code. (Dotfuscator etc.) Question is simple, those who are experienced with such tools, what it the level of protection such tools offer? Against ...
48
votes
9answers
13k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
4
votes
1answer
443 views

Is there an equivalent of nsp audit for nuget packages?

I'm working on a couple of large .NET web apps and would like to audit the packages used in them. For node projects I've use nsp audit. This checks whether your npm packages or their dependencies have ...
3
votes
0answers
94 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
-1
votes
1answer
155 views

Unable to open port on Windows 7 [closed]

The scenario is as follows: while a PC was connected to our company's network, a specific application was able to open another process on a predefined port. It worked as expected. But now, this PC ...
1
vote
1answer
169 views

C# LDAP Injection

Will the C# DirectoryEntry class vulnerable to LDAP Injection from the parameters of it constructor? For example: DirectoryEntry de = new DirectoryEntry(path, username, txtPassword.Text, ...
5
votes
1answer
528 views

GPG (PGP) decryption speed issue

We are new to using GPG and we have a very strange issue with decryption speed when using RSA keypairs, which are generated by using different tools (GPG for Windows, DidiSoft OpenPGP Library for .NET ...
32
votes
3answers
6k views

Is using the username encrypted with the password as key a good password storage scheme?

On web applications I build I don't hash the passwords. Instead I symmetrically encrypt the username using the user's password and store the result in the password field. I use RijndaelManaged on ...
1
vote
2answers
473 views

Differences between Cookie vs Session Variable to sensitive data

I am doing my own login authentication system, and I want to do a robust system. I want to decide which direction I should take to keep the user logged in. I have put a question for each way, and also ...
1
vote
3answers
357 views

How to prevent someone guessing the token in a reset password link

Currently I have the following set-up for handling users that forgot their password. A user types in his/her e-mail address and presses the forgot password button. I look up the user belonging to ...
1
vote
1answer
130 views

Is HttpUtility.HtmlAttributeEncode considered for single-quotes attributes?

MSDN: The string result from the HtmlAttributeEncode method should be used only for double-quoted attributes. Security issues might arise when using the HtmlAttributeEncode method with ...
-2
votes
5answers
906 views

Asymmetric encryption: Is it possible to share private key and hide public key?

I know that normally it's the public key to be shared and the private key to be kept secret (hence the names) in asymmetric encryption. I have a special case that I want to encrypt some files and let ...
0
votes
0answers
56 views

How to prevent injection attacks powerscript scripts when dealing with user made variables

I have a large number of scripts with code looking like this: task "$argument" Which is then called by: powershell.Runspace.SessionStateProxy.SetVariable(argument, UserMadeValue); ...
8
votes
1answer
413 views

Are there any type safe languages with deterministic compilers?

This article about BIND9 concludes with the statement: The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in ...
2
votes
0answers
405 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as ...
1
vote
0answers
86 views

Distribution of a public key with a dotnet client application?

I have a pretty good understanding of X509 cryptography etc, from my career in the smart card industry. So I know that the card scheme (e.g. Visa, MasterCard) is the highest level of trust - they sign ...
2
votes
2answers
104 views

Authenticated encryption (Symmetric encryption) for .NET applications [closed]

Is there an implementation of Authenticated encryption for .NET applications? The AES API from .NET does not include mode such as GCM. In the documentation, I can only see insecure modes (ECB, CBC, ...
3
votes
2answers
196 views

Guid salt - string vs bytes[]

Recently I got into passwords hashing (SHA256, HMAC-SHA1, PBKDF2, etc.) and one "statement" I've been reading over and over again, stuck in my mind and I can not find a satisfying answer. "When we ...
2
votes
0answers
98 views

OAuth2 Authorization and Resource server certificates

I'm implementing a custom IAuthorizationServerHost using DotNetOpenAuth library. Example implementation uses two certificates for CreateAccessToken (see Listing 6): public AccessTokenResult ...
2
votes
1answer
222 views

How to encrypt columns in a database and be able to easily change encryption key

I have several fields in a database table I would like to encrypt, but I would like to do it in a way that would allow me to easily change the encryption key every n months for security reasons. My ...
1
vote
0answers
66 views

authentication model using oAuth

I am planning to use facebook authentication for my website window.fbAsyncInit = function() { FB.init({ appId: 'APPID', cookie : true, xfbml : true, version : ...
5
votes
1answer
307 views

ECDH BouncyCastle KeyAgreement length

I am attempting to obtain a shared secret using BouncyCastle's ECDH methods in C#, however I am receiving a shared key which is much shorter than the 48 bytes I expect it to be. I have a trusted ...
12
votes
1answer
1k views

Is Rfc2898DeriveBytes using HMAC SHA1 still considered “secure enough” for hashing passwords?

I've been told by a CISSP that the .NET class Rfc2898DeriveBytes would not pass a security audit today because it still uses SHA1. It's reliance on SHA1 - even with the iterations - leaves it too ...
3
votes
4answers
109 views

How to avoid web service spam?

How can I restrict users from spamming my web service by sending thousands of requests? My web service is actually protected by a validation token only accessible through authentication, but I still ...
1
vote
1answer
254 views

Getting multiple key matches on plaintext/ciphertext pairs in double DES

I'm trying to implement a Meet-in-the-Middle attack and just to test it out I've done some hardcoding of values, which is simply this block of simple code: byte[] key1 = new byte[] { 0x20, 0x00, ...
6
votes
3answers
590 views

Random URL string: What kind of attack is this, and what can be done to stop it?

EDIT: It's been a little while since this was posted, but I'm here to report that this does NOT appear to have been some sort of attack after all. Rather, this particular URL string indicates a ...