A runtime, architecture, and libraries for Microsoft Windows used for creating applications.
2
votes
1answer
369 views
Are .NET WebServices vulnerable to CSRF?
While developing TeamMentor I implemented a number of WebServices (consumed via jQuery) and now on its final push for release I want to double check that they are not vulnerable to CSRF.
There isn't ...
2
votes
3answers
251 views
What are the best security practices to install a C# Web App on client servers?
We would like to install a Web App written in C#/.NET4 on client servers, not ours. I would like to know what are the best security practices to implement for avoid the following:
Authority ...
0
votes
1answer
920 views
windows security alert windows firewall has blocked some features of this program message coming for every new build of my application
I made an application which uses ftp so windows shows windows security alert windows firewall has blocked some features of this program message for every new version of my application any idea how to ...
2
votes
2answers
566 views
C# Encrypting string in DES 3 CBC mode
Is it normal that when I use Double DES secret key to encrypt a string in DES3 CBC mode then I always get the same cipher text? For testing I'm using IVC=0.
3
votes
3answers
100 views
Identifying and preventing execution of “any” function via Late-Bound commands
The Command Pattern is widely used to create a robust, salable applications. However I see guidance in this MSDN article that could allow a caller to invoke a late-bound command... enabling the ...
2
votes
3answers
781 views
AES for key encryption
Is AES a good choice for protecting a key stored on the computer of a user of my application? I have seen threads on hashing passwords that suggest using slow algorithms for defending against brute ...
10
votes
4answers
942 views
Using computer random number generators to produce keys, it is secure?
Does generating an encryption key using the random number generator on one's computer present a security risk? If so how might that risk be mitigated, specifically when generating RSA key pairs in ...
3
votes
1answer
573 views
Peer review of C# cryptography for Azure Table security
Edit: Update - I am researching how to implement AES with authentication in an efficient way for this project. If you have the time I'd appreciate your skill in finding the best implementation for ...
4
votes
2answers
3k views
Diffie Hellman c# implementation
Hallo all,
For a test project I have tried to implement the (famous) Diffie Hellman algorithm for safe key exchange.
Now I have written this in C#:
using System;
using System.Collections;
using ...
2
votes
2answers
296 views
What is the correct way to assess and compare Certicom's products to the alternatives?
I'm investigating Certicom's API because they are "free" with the Blackberry implementations, and have come to realize that I have several alternatives for implementing crypto such as BouncyCastle, ...
4
votes
2answers
1k views
Reference implementation of C# password hashing and verification
Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java?
Ideally,I'd like to see something that includes a ...
1
vote
1answer
431 views
Tutorial for SecurityCritical SecurityTransparent and new .NET 4 feature: Level 2
I need a primer for both the legacy (Level 1) .NET 2.0 security attributes and the new .NET 4 (Level 2) ones.
I'm not familiar with the implications of controlling LinkDemand, stack walks, ...
4
votes
1answer
86 views
Does the compiler feature of Closures decrease member variable security?
Based on this discussion, closures in C# promote private variables to public variables at compile time.
Suppose a closure was implemented on a Username or Password string. Would there be any ...
3
votes
1answer
153 views
When does one need to be concerned with leaking timing information in .NET?
According to this post, Dominick Baier was comparing two HMACSHA256 signatures and was leaking timing information upon an unsuccessful comparison.
When working with .NET crypto classes, when should ...
4
votes
1answer
504 views
Why does Bouncy Castle have a separate download for the IDEA algorithm?
I'm looking at downloading the C# binary for Bouncy Castle and see two downloads with source code. One has the IDEA algorithm, the others presumably not.
http://www.bouncycastle.org/csharp/
Why ...
3
votes
1answer
2k views
How do I use C# to encrypt/decrypt data where the private key is on a smartcard, hardware security module, TPM chip etc
Is anyone aware of a C# code sample to interact with smartcard, hardware security module, TPM chips (etc), that will allow me to encrypt and decrypt data?
My goal is to allow my application to ...
4
votes
1answer
197 views
Anyone use the International Domain Name (IDN) security mitigation API's? Is there a wrapper for .NET?
The International Domain Name mitigation API's are available here for download:
http://www.microsoft.com/downloads/en/details.aspx?FamilyID=ad6158d7-ddba-416a-9109-07607425a815&displaylang=en
...
