The tag has no wiki summary.

learn more… | top users | synonyms

12
votes
5answers
1k views

Why are certificates limited in time?

If a certificate has a limited duration of, say 5 years, but it gets somehow compromised after 2 years, waiting the 3 remaining years for it to get invalid is not a real solution to the breach ...
9
votes
3answers
1k views

Should IP addresses be validated to prevent SQL Injection?

In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses. Should I validate user IP addresses before using ...
7
votes
3answers
342 views

What are the risk implications of not verifying referer header on login form?

Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
6
votes
6answers
1k views

Filter user input before the database or upon display?

Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
6
votes
5answers
3k views

XSS : Blacklist characters vs. whitelist

I have been studying to prevent my web app against XSS. I read about it on OWASP and other security channels, they all say that use ESAPI and similar library, and also do input filtering through ...
6
votes
3answers
148 views

Obtaining e-mail address at registration

In a registration form the user is asked for his e-mail address. The e-mail address will be validated for the correct format (e.g. at the least contains @) and I'm considering checking if it's already ...
6
votes
1answer
388 views

White list or black list sanitation for international input?

There seem to be so many ways to create nefarious input that white-listing what input is good usually feels like the safer, simpler option. For instance, one can fairly easily craft a white list ...
5
votes
2answers
1k views

Canonicalization & Output Encoding

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: If any potentially hazardous characters (<>"'%()&+\\'\") ...
5
votes
2answers
156 views

How can a certificate be valid in the Hybrid Model but not in the Chain Model?

All dates in European format! I am learning about validity models, but the solution for this assignment confuses me. Translation: The relevant data for the applicable certificates are shown ...
4
votes
3answers
5k views

What data should I validate when validating X.509 certificates using Java?

Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation. I know it ...
4
votes
1answer
888 views

Is ASP.NET Event Validation completely secure?

I am currently testing a ASP.NET web application for its security. Doing so I came across the event validation mechanism. Is there some way to bypass it? How much assurance is there that it cannot be ...
4
votes
2answers
114 views

Could server honesty be audited by remote peers without said peers having sole (or any) control of the server?

Suppose for some reason, you and your peers absolutely positively have know that a server is acting honestly. Could the server behaviour be audited remotely through some mechanism of randomly ...
3
votes
3answers
929 views

SQL injection using letters and numbers?

I was wondering if it is at all possible for a hacker to perform an SQL injection attack using just letters and numbers. For example, let's take a look at this PHP code which uses regular expressions ...
3
votes
3answers
419 views

Is it ever safe to skip server-side validations?

I am working on a web app with a sign up form like below. The validations are all done client side using http://formvalidator.net/. I am well aware that client-side validations can be bypassed, but I ...
3
votes
2answers
159 views

In practice, does crypto software accept a *.com or or even a *. certificate?

Assuming this will be done with your own PKI, and not a public trusted CA. Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
3
votes
2answers
137 views

Valid Characters For Magnetic stripe

We bought some Magnetic stripe cards and I'm writing a program that will get talked to by a mag card reader. What I need help with is that I can't, for the life of me, find out what characters are ...
3
votes
2answers
197 views

Server checking client's password without ever coming into possession of it

tl;dr: I am wondering what the best way is to check a password when the client does not trust the server. I know of two common ways servers can check if a user's password is correct: The server ...
3
votes
2answers
169 views

Email & Domain ownership?

Most hosting companies, such as mine (hostgator) give the following notice when providing a contact email: Email address that you can be contacted at. This should be an email address that is not ...
3
votes
1answer
86 views

Server Certification Processes

We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
3
votes
1answer
80 views

Validating correctness amongst untrusted answers

I'm toying around a distributed computing project. The client application asks for a problem to solve. The server returns a problem description from a "problems pool". When the client finishes, it ...
2
votes
4answers
515 views

Bypassing Web Application input validation

A malicious user can use Base-64 or other encoding scheme to bypass web application input validation or to bypass some external Web application firewall. Since these encoding schemes are infinite how ...
2
votes
1answer
96 views

SSL certificate to protect spoofing of API server

I have a program written in Python that checks the validity of its license key with a remote server. Am I right that an SSL certificate would make it possible to prevent spoofing (host redirects for ...
2
votes
2answers
380 views

How to ensure an email address is not free webmail or ISP address?

I notice security companies such as Rapid 7 prevent people signing up with either free email accounts, or accounts provided by ISPs: ...
2
votes
2answers
102 views

Using External Certificates on a network that doesn't permit outbound HTTP/S access

Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data I can guess that issues with signature validation occur ...
2
votes
1answer
93 views

Finding the type of SSL certificate with cURL

This is a part of curl's verbose output when connecting to the HTTPS site of Google. * Server certificate: * subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com * ...
1
vote
5answers
1k views

Is it secure to use jQuery on the server-side for user input validation?

I'm thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied ...
1
vote
2answers
59 views

Is php DOMDocument::loadXML completely secure?

Our application is using loadXML extensively to recieve data(input) from the users. Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using ...
1
vote
3answers
554 views

Validate hmac with hashed stored key

What if an HMAC is correctly generated and sent with the data to the server, so far I know the server needs to know the original data with which the MAC was created in order to re-create the MAC and ...
1
vote
2answers
40 views

Can I save & store a user's data in a way that proves that the information has not been altered, and that the timestamp is accurate?

There are many situations where the validity of the timestamp attached to a certain post (submission of information) might be invaluable for the post owner's legal usage. I'm not looking for a service ...
1
vote
1answer
36 views

Application Security Input Validation: Validating Environment Variables and Config files

I am watching a training video called "Creating Secure J2EE Code". The video makes this statement: Perform all validation in a secure context on the server. Do not rely on client-side validation ...
1
vote
1answer
42 views

Issues of using HOTP w/ iteration window

I am using HOTP to generate OTP to validate a request, in order to prevent replay attacks. I'm thinking about using a window of 10 (or so) iterations to accommodate a possible mismatch in the counter ...
0
votes
1answer
46 views

Should content from database be sanitized again

Suppose I save content into the database after sanitizing it. Is there still a need to sanitize it again when retrieving it? If yes, why?
0
votes
1answer
460 views

Behavior when validating an expired certificate chain

I have the following situation: A server certificate (CServ) is signed by self-signed certificate (C0) A client certificate (CCli) is signed by CServ Client's trust-store contains C0, so the client ...
0
votes
1answer
49 views

Verify external data files for an application

I have a C++ application with an algorithm, whose usage I want to protect. The application needs several input data files to work (those may change for each client). My goal is to allow only ...
0
votes
2answers
59 views

Prevention from cross site scripting in different scenerio?

I could not validate malicious characters like ' .< > etc because these characters are required in my application. Also I could not encode characters because user supposed to enter HTML tags in my ...
0
votes
2answers
157 views

Is there an open source runtime enforcement tool?

I have been looking for open source runtime enforcement tools that I can use my own policies to prevent input validation vulnerabilities, in web applications. The web applications that I want to ...
0
votes
0answers
47 views

Public/Private key validation

Suppose I have this scenario: User --> Inputs License Key --> I validate it --> If success, good, move onto main window. If not, prompt the user to reenter the license key. The license key will not ...
0
votes
0answers
38 views

Why allow access without an access token but deny access with an invalid access token?

I encountered a data storage service with rather weird access policies. There're "folders" with "files" and each "folder" can have either of the following permissions: anyone in the world can ...
-1
votes
1answer
146 views

Mac app purchase validation

How do I sell a mac app off of my website without somebody being able to copy-and-paste the app to some friends after he buys it, etc.. I understand that you can use receipt validation when selling ...
-2
votes
1answer
447 views

ESAPI: Input and output validation [closed]

I am new to IT Security and I have been tasked with coming up with input and output validation for ESAPI. So for input validation, so far I got: Data Type Name Email ...