The tag has no wiki summary.

learn more… | top users | synonyms

0
votes
0answers
13 views

Java CertificateVerifier as a generic module [on hold]

Where can I get a CertificateVerifier like the one here as a generic versioning module (jar, preferable as maven dependency). I dont't want to copy and past the java class files.
10
votes
5answers
1k views

Input Sanitization vs Output Sanitization [duplicate]

In the bits that I've searched about this, I've seen a few people declare as word-of-god that you should only sanitize outputs and not inputs. Why? Would it not be safer to cover both ends?
5
votes
1answer
37 views

Who can certify RNG according NIST SP800-22?

I have written my own random number generator as a C library and I tested it on NIST Statistical Test Suite. Now I would like to get a certification to have a formal proof that my C library generates ...
0
votes
3answers
51 views

Should I be worried about SQL Injection for Internal Web Apps?

I've been working a lot lately with writing report generating forms at work. The reports sometimes require input provided by a drop-down list and sometimes require data to be entered by key. My ...
0
votes
1answer
16 views

Validating the ROA certificate

Suppose I have a system, where the server requires the clients to attach their ROA certificate to prove that they have the right to that IP Prefix. Now if the client attaches the ROA certificate ( ...
2
votes
1answer
79 views

How do I audit the effect of security policy on a computer?

I have developed different templates for local security policy. I have been using the program Nexpose to test the effects of those security policies but so far I am not able to detect the visible ...
2
votes
1answer
141 views

Exploiting mailto links

Supposing that the user has the power to include any content after mailto: snippet, are there any possible security vulnerabilities? Example: The user says their email address is foo. The link on ...
1
vote
2answers
173 views

Security issues on allowing Special characters in input field

I am building a web application, in which I am required to let user enter any character(even special characters - ~!@#$%^&*()_-+=|\{}[];:'"<,.>) in an input field. To mitigate the problems ...
1
vote
1answer
26 views

Expand user login in Path - Filter malicious values

I have a function that takes a pathname and substitutes every occurrence of '%u' with a given String. For my scenario this given String is the login that a user/attacker enters via ssh during ...
3
votes
1answer
62 views

User-friendly TLS certificate validation

I'm designing an application in which clients generate their own TLS certificates ad-hoc (there's no central authority). When two clients interact for a first time, I need for them to mutually check ...
10
votes
5answers
2k views

Should a website limit characters that can be entered in its fields?

I got into a (somewhat heated) discussion with my colleague today about what characters our application should accept. This was prompted by the discovery that you can enter anything in the search box ...
2
votes
1answer
130 views

Server side validations for file upload to prevent DoS on HTTP server

I am aware that client side validations can be easily bypassed by means like disabling javascript. I would like to know the things to be checked while doing a server side validation for file upload. I ...
5
votes
2answers
265 views

Should you let users know if an email has been taken during registration validation? [duplicate]

In many web applications, email is required to be a unique field, and users aren't allowed to register an account if their email already exists in the database. When performing validation on the ...
0
votes
1answer
98 views

How is PayPass/payWave secure when PIN is required after presenting the card to the contactless terminal?

The popular claim is that a chip-and-PIN payment card is more secure than a card with magnetic strip because the card data is hidden deep inside the chip and the ATM or POS terminal sends the entered ...
1
vote
3answers
123 views

Strong email validation. Is it really necessary?

I am working on one of my projects where users don't need to register or login to post an advert, but they have to provide email so that a confirmation link will be sent to their email address for ...
-1
votes
3answers
151 views

SQL Injection solutions [closed]

I'm editing my question to clarify what I'm trying to ask. In order to launch an SQL injection there should be someway to get input from the user (i.e. username and password) for instance. So I've ...
3
votes
2answers
2k views

Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?

we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
1
vote
1answer
66 views

What could happen if regex metacharacters using named capturing group are not encoded?

Let's say that a web application take a specific input from the user (e.g., search form), apply a Java regex with named caputring groups on it and use the final output to do other stuff (e.g., look ...
1
vote
3answers
157 views

Make all form inputs safe but allow any type of input including code

Pastebin allow you to (along with plenty of other sites) input code into there forms. I know that this can be a huge security threat if not done properly so I would like to know how they go about ...
12
votes
1answer
946 views

When does iOS check validity of enterprise certificates?

Here is an article that should give a little more context (and see my comment on it, same username, for additional info). iOS developers are able to distribute apps outside of the App Store using an ...
5
votes
2answers
792 views

Authentication: Username (email) and password hashed together in one database field

I am currently developping a platform with a PHP framework for our client. The head of the client's IT department wants us to handle authentication with one database field containing ...
1
vote
2answers
160 views

Should I validate authentication form inputs?

I've got a login page with a form where they can input their account's email address and password. I'm doing the following things before even attempting to authenticate a user: Validating the email ...
1
vote
0answers
100 views

Secure self-concealing symmetric encryption (non-verifiable decryption)?

From what I observed using standard encryption tools such as OpenSSH and GPG, the decryption only succeeds when the correct password/key is provided (or at most a few others, in case of collision). ...
9
votes
1answer
227 views

E-voting: receipt-free, verifiable, and anonymous

Background In response to a system design concept, a question was posed: How do you achieve electronic voting, anonymity, and verifiability at the same time? I was informed that most experts in ...
0
votes
1answer
70 views

Should content from database be sanitized again

Suppose I save content into the database after sanitizing it. Is there still a need to sanitize it again when retrieving it? If yes, why?
0
votes
0answers
108 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
1
vote
0answers
50 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
1
vote
2answers
214 views

Is php DOMDocument::loadXML completely secure?

Our application is using loadXML extensively to recieve data(input) from the users. Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using ...
1
vote
1answer
101 views

Application Security Input Validation: Validating Environment Variables and Config files

I am watching a training video called "Creating Secure J2EE Code". The video makes this statement: Perform all validation in a secure context on the server. Do not rely on client-side validation ...
1
vote
2answers
109 views

Can I save & store a user's data in a way that proves that the information has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
12
votes
5answers
2k views

Why are certificates limited in time?

If a certificate has a limited duration of, say 5 years, but it gets somehow compromised after 2 years, waiting the 3 remaining years for it to get invalid is not a real solution to the breach ...
1
vote
1answer
67 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
2
votes
1answer
175 views

Finding the type of SSL certificate with cURL

This is a part of curl's verbose output when connecting to the HTTPS site of Google. * Server certificate: * subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com * ...
0
votes
1answer
55 views

Verify external data files for an application

I have a C++ application with an algorithm, whose usage I want to protect. The application needs several input data files to work (those may change for each client). My goal is to allow only ...
2
votes
1answer
164 views

SSL certificate to protect spoofing of API server

I have a program written in Python that checks the validity of its license key with a remote server. Am I right that an SSL certificate would make it possible to prevent spoofing (host redirects for ...
0
votes
2answers
65 views

Prevention from cross site scripting in different scenerio?

I could not validate malicious characters like ' .< > etc because these characters are required in my application. Also I could not encode characters because user supposed to enter HTML tags in my ...
3
votes
4answers
1k views

Is it ever safe to skip server-side validations?

I am working on a web app with a sign up form like below. The validations are all done client side using http://formvalidator.net/. I am well aware that client-side validations can be bypassed, but I ...
3
votes
2answers
291 views

Valid Characters For Magnetic stripe

We bought some Magnetic stripe cards and I'm writing a program that will get talked to by a mag card reader. What I need help with is that I can't, for the life of me, find out what characters are ...
2
votes
2answers
603 views

How to ensure an email address is not free webmail or ISP address?

I notice security companies such as Rapid 7 prevent people signing up with either free email accounts, or accounts provided by ISPs: ...
3
votes
1answer
87 views

Validating correctness amongst untrusted answers

I'm toying around a distributed computing project. The client application asks for a problem to solve. The server returns a problem description from a "problems pool". When the client finishes, it ...
4
votes
2answers
132 views

Could server honesty be audited by remote peers without said peers having sole (or any) control of the server?

Suppose for some reason, you and your peers absolutely positively have know that a server is acting honestly. Could the server behaviour be audited remotely through some mechanism of randomly ...
-2
votes
1answer
878 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...
4
votes
3answers
2k views

SQL injection using letters and numbers?

I was wondering if it is at all possible for a hacker to perform an SQL injection attack using just letters and numbers. For example, let's take a look at this PHP code which uses regular expressions ...
4
votes
2answers
338 views

Server checking client's password without ever coming into possession of it

tl;dr: I am wondering what the best way is to check a password when the client does not trust the server. I know of two common ways servers can check if a user's password is correct: The server ...
6
votes
3answers
169 views

Obtaining e-mail address at registration

In a registration form the user is asked for his e-mail address. The e-mail address will be validated for the correct format (e.g. at the least contains @) and I'm considering checking if it's already ...
7
votes
3answers
498 views

What are the risk implications of not verifying referer header on login form?

Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
2
votes
4answers
1k views

Bypassing Web Application input validation

A malicious user can use Base-64 or other encoding scheme to bypass web application input validation or to bypass some external Web application firewall. Since these encoding schemes are infinite how ...
3
votes
1answer
93 views

Server Certification Processes

We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
1
vote
1answer
691 views

Behavior when validating an expired certificate chain

I have the following situation: A server certificate (CServ) is signed by self-signed certificate (C0) A client certificate (CCli) is signed by CServ Client's trust-store contains C0, so the client ...
5
votes
2answers
186 views

How can a certificate be valid in the Hybrid Model but not in the Chain Model?

All dates in European format! I am learning about validity models, but the solution for this assignment confuses me. Translation: The relevant data for the applicable certificates are shown ...