A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

learn more… | top users | synonyms (1)

15
votes
2answers
5k views

How should an application store its credentials

When developing desktop applications, you will occasionally have to store credentials somewhere to be able to authenticate your application. An example of this is a Facebook app ID + secret, another ...
2
votes
1answer
174 views

What are the security features of the Microsoft PasswordVault class?

There doesn't seem to be much information on the PasswordVault but it seems to provide for local encryption of credentials. There are references to it in this source code and this blog. The reason ...
14
votes
6answers
8k views

Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() “better” for Unicode Password hashing than traditional methods?

When is it appropriate to use RFC2898DeriveBytes versus a typical hash? Update I now understand that a KDF is typically used to create a symmetric key for possible use in encrypting a stream. I ...
0
votes
1answer
18 views

Want to verify confidentiality of GSS-SPNEGO SASL mechanism (LDAP)

I've been doing some research on LDAP supportedSASLMechanisms and am trying to assert whether or not there is confidentiality protection in play when using GSS-SPNEGO. My initial assessment is that ...
0
votes
1answer
34 views

How to check connectivity between raspberry pi and server [closed]

How to check connectivity between raspberry pi (which act as a client) and server using web-socket
1
vote
1answer
20 views

Using external OAauth Authentication Service, how to manage the users's relations

I'm trying to create an API and a website client for it. Lately I've been reading a lot about OAuth2 as a security mechanism and companies that offers authentication as a service such as auth0.com or ...
3
votes
2answers
50 views

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

My organization has a group policy that is applied to servers enforcing FIPS compliance (Windows AD policy). In .NET, HMACSHA1 is one of the encryption/hash algorithms that is FIPS compliant. I don't ...
1
vote
0answers
30 views

Create a signed file from the detached signature and the clear text file content

Assuming I have the following: data.txt data.ps7 (the detached signature) Can I generate the bundled signed file ? Any example would be great, using C#, Java or openssl or any other tool ?
1
vote
1answer
65 views

Should the salt of a bcrypt hashed password be stored separately

I'm replacing a password storage system. The current implementation uses TripleDES with the key stored in plaintext in both the binaries and the config (in-case one of them is not available for some ...
1
vote
0answers
37 views

How to acquire the RSACryptoServiceProvider from the existing key container?

The Key containers of "Microsoft Base Smart Card Crypto Provider" are enumerated by setting PP_ENUMCONTAINERS flag for the function CryptGetProvParam(). The enumerated key containers are set to the ...
2
votes
0answers
58 views

Mitm Proxy using c# SslStream issues when doing directly from host file [closed]

Im trying to create a local windows MITM proxy with C# to deal with a now unsupported application from a company that no longer exists. The Proxy has to only service one HTTPS domain which is being ...
4
votes
1answer
951 views

Encrypting/decrypting our license key

We need to provide a license key to customers for our application. The actual license is XML but we need to encrypt it and then in our program decrypt it. I think it is the following, but am asking to ...
1
vote
2answers
46 views

Is image uploading to a database secure if you resize the image first in raw bytes?

Please see the upload code below. the method is called within a try, catch. If the code for the image utilities is needed, just say. Basically, everything is handled in raw bytes and then stored to ...
3
votes
1answer
53 views

Membership.GeneratePassword

I am looking for a method to generate a onetime password for provisioning purposes in ASP.NET-MVC. I came across the Membership.GeneratePassword which is in the System.Web.Security namespace. Is this ...
1
vote
0answers
17 views

IX509Extension XCN encoding?

I understand from reading MSDN that the X509 v3 extensions must be handcrafted. This involves the CRL, AIA, name and policy constraints, policy mapping, private key usage period, and subject ...
0
votes
1answer
69 views

How does RSACryptoServiceProvider generate keys

The documentation for the constructor for RSACryptoServiceProvider states "If no default key is found, a new key is created. This constructor creates an Exchange key pair suitable to encrypt session ...
1
vote
3answers
348 views

How to prevent someone guessing the token in a reset password link

Currently I have the following set-up for handling users that forgot their password. A user types in his/her e-mail address and presses the forgot password button. I look up the user belonging to ...
3
votes
1answer
161 views

Is It OK If a Server Does Not Verify a Certificate?

I am currently learning a LOT about Azure, Azure Active Directory, and Azure Key Vault (AKV). To start with, please see this article: In particular, I am interested in this statement: When ...
8
votes
1answer
413 views

Are there any type safe languages with deterministic compilers?

This article about BIND9 concludes with the statement: The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in ...
0
votes
0answers
116 views

Is this c# digital signature implementation secure?

The code connects multiple clients to a server using TCP sockets asynchronously. I have added code to attach a digital signature to the outgoing messages from the server, to authenticate the message ...
10
votes
3answers
341 views

Is this a weakness of enveloped XML signature?

There might be a problem in many applications based on XML signature verification (provided I am not wrong, of course). Let's have a simple XML message with an enveloped XML signature: <?xml ...
3
votes
1answer
80 views

Could this piece of code be harmful ?

I just wrote these 2 functions in C#.net and it can get any user's system IP and MAC address. Isn't this harmful since I got help from microsoft documentation. Could these lead to potential damage or ...
1
vote
1answer
67 views

Storing credentials for desktop app

I have desktop application written in C# with three user roles and some predefined users. It is also possible to create another users or change passwords to predefined users. App has to work offline ...
1
vote
1answer
169 views

C# LDAP Injection

Will the C# DirectoryEntry class vulnerable to LDAP Injection from the parameters of it constructor? For example: DirectoryEntry de = new DirectoryEntry(path, username, txtPassword.Text, ...
3
votes
1answer
84 views

What is the best method for key exchange?

I have application working between server and client. All messages must be encrypted and decrypted. I use AES algorithm and I want method to hide the key. I found Diffie-Hellman algorithm, but my ...
1
vote
0answers
55 views

Token-based authentication for specific requirement

We have the following requirement for creating a token in .NET to be used in providing a challenge token and an actual authentication (auth) token. The auth token will then be used to authenticated ...
1
vote
3answers
164 views

Using HTTP GET instead of a POST request can leak source code?

Is it possible to leak the server-side code of a website if a GET request is sent instead of a POST request to a page? The idea is that if a POST request is made to a webpage e.g. http://<server ...
2
votes
2answers
65 views

Removing vulnerabilities from uploaded files

Our website has a form which allows users to upload image files (png,gif,jpeg and pdf). Once uploaded, the website sends the file (server to server) to the back office api, which then saves the ...
25
votes
11answers
4k views

Is obfuscation worth it [closed]

There are many tools to obfuscate .NET applications. The free ones do some basic obfuscation while commercial ones seem to promise more. My question is: Is it worth to use the commercial obfuscation ...
6
votes
2answers
258 views

Is there any reason to use AesManaged over DPAPI in this scenario?

I have a situation where my web application is going to be deployed on multiple web servers, and I'll be wanting to store some securely encrypted data on the DB servers (each web server has a DB ...
48
votes
9answers
12k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
1
vote
1answer
206 views

Level of security provided with (.NET) obfuscator tools

There are numerous tools that offer to obfuscate .NET code. (Dotfuscator etc.) Question is simple, those who are experienced with such tools, what it the level of protection such tools offer? Against ...
12
votes
1answer
1k views

Is Rfc2898DeriveBytes using HMAC SHA1 still considered “secure enough” for hashing passwords?

I've been told by a CISSP that the .NET class Rfc2898DeriveBytes would not pass a security audit today because it still uses SHA1. It's reliance on SHA1 - even with the iterations - leaves it too ...
3
votes
0answers
94 views

DPAPI Distributed key manager

I have a number of configuration files and binary data that needs to be stored encrypted on disk. Only the user who encrypted should be able to decrypt the information. So far, I have successfully ...
9
votes
5answers
1k views

Is it safe to binary-deserialize user-provided data?

AppHarbor has a blog post containing sample C# code which reads data from an unsigned cookie and passes it through .Net binary serialization. Is that safe? Obviously, the data is completely ...
5
votes
1answer
524 views

GPG (PGP) decryption speed issue

We are new to using GPG and we have a very strange issue with decryption speed when using RSA keypairs, which are generated by using different tools (GPG for Windows, DidiSoft OpenPGP Library for .NET ...
4
votes
1answer
442 views

Is there an equivalent of nsp audit for nuget packages?

I'm working on a couple of large .NET web apps and would like to audit the packages used in them. For node projects I've use nsp audit. This checks whether your npm packages or their dependencies have ...
9
votes
4answers
13k views

Best place to store authentication tokens client side

When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
3
votes
3answers
467 views

Windows Authentication to protect API

One of my colleagues has a web api call that is checking that the user is logged in and his token matches what is in session (thanks to all of you for your help). Let's say this is layer blue. After ...
-1
votes
1answer
148 views

Unable to open port on Windows 7 [closed]

The scenario is as follows: while a PC was connected to our company's network, a specific application was able to open another process on a predefined port. It worked as expected. But now, this PC ...
6
votes
3answers
586 views

Random URL string: What kind of attack is this, and what can be done to stop it?

EDIT: It's been a little while since this was posted, but I'm here to report that this does NOT appear to have been some sort of attack after all. Rather, this particular URL string indicates a ...
32
votes
3answers
6k views

Is using the username encrypted with the password as key a good password storage scheme?

On web applications I build I don't hash the passwords. Instead I symmetrically encrypt the username using the user's password and store the result in the password field. I use RijndaelManaged on ...
1
vote
2answers
473 views

Differences between Cookie vs Session Variable to sensitive data

I am doing my own login authentication system, and I want to do a robust system. I want to decide which direction I should take to keep the user logged in. I have put a question for each way, and also ...
4
votes
1answer
327 views

Anyone use the International Domain Name (IDN) security mitigation API's? Is there a wrapper for .NET?

The International Domain Name mitigation API's are available here for download. Has anyone used them since they were first published in 2006? Are there any pending updates to them (I can't find a ...
2
votes
1answer
214 views

How to encrypt columns in a database and be able to easily change encryption key

I have several fields in a database table I would like to encrypt, but I would like to do it in a way that would allow me to easily change the encryption key every n months for security reasons. My ...
-2
votes
5answers
903 views

Asymmetric encryption: Is it possible to share private key and hide public key?

I know that normally it's the public key to be shared and the private key to be kept secret (hence the names) in asymmetric encryption. I have a special case that I want to encrypt some files and let ...
1
vote
1answer
130 views

Is HttpUtility.HtmlAttributeEncode considered for single-quotes attributes?

MSDN: The string result from the HtmlAttributeEncode method should be used only for double-quoted attributes. Security issues might arise when using the HtmlAttributeEncode method with ...
0
votes
0answers
56 views

How to prevent injection attacks powerscript scripts when dealing with user made variables

I have a large number of scripts with code looking like this: task "$argument" Which is then called by: powershell.Runspace.SessionStateProxy.SetVariable(argument, UserMadeValue); ...
1
vote
0answers
86 views

Distribution of a public key with a dotnet client application?

I have a pretty good understanding of X509 cryptography etc, from my career in the smart card industry. So I know that the card scheme (e.g. Visa, MasterCard) is the highest level of trust - they sign ...
2
votes
0answers
404 views

Is XSP suitable for Internet facing, production hosts? (either self hosted, as an Apache plugin, or FastCGI)

XSP is portable version of ASP.NET that allows for operation on OSX, Linux, and Windows. It's an alternative to IIS, and hosts its own web server, or can plug into existing web servers such as ...