Validation (in contrast with verification) is assurance that a product, service, or system meets the needs of the stakeholders. It could contain the acceptance phase.

learn more… | top users | synonyms

13
votes
6answers
3k views

Filter user input before the database or upon display?

Given a web application where user data must be properly escaped to avoid XSS, is it better to try to remove the "bad stuff" before it enters the database, or is it best to allow it in the database ...
12
votes
5answers
4k views

Input Sanitization vs Output Sanitization [duplicate]

In the bits that I've searched about this, I've seen a few people declare as word-of-god that you should only sanitize outputs and not inputs. Why? Would it not be safer to cover both ends?
12
votes
5answers
2k views

Why are certificates limited in time?

If a certificate has a limited duration of, say 5 years, but it gets somehow compromised after 2 years, waiting the 3 remaining years for it to get invalid is not a real solution to the breach problem....
12
votes
2answers
2k views

When does iOS check validity of enterprise certificates?

Here is an article that should give a little more context (and see my comment on it, same username, for additional info). iOS developers are able to distribute apps outside of the App Store using an ...
11
votes
3answers
766 views

White list or black list sanitation for international input?

There seem to be so many ways to create nefarious input that white-listing what input is good usually feels like the safer, simpler option. For instance, one can fairly easily craft a white list ...
10
votes
5answers
3k views

Should a website limit characters that can be entered in its fields?

I got into a (somewhat heated) discussion with my colleague today about what characters our application should accept. This was prompted by the discovery that you can enter anything in the search box ...
10
votes
3answers
2k views

Should IP addresses be validated to prevent SQL Injection?

In PHP I retrieve a user's IP address ($_SERVER['REMOTE_ADDR']) to use it in some MySQL queries, but I do not validate them to be true IP addresses. Should I validate user IP addresses before using ...
9
votes
1answer
310 views

E-voting: receipt-free, verifiable, and anonymous

Background In response to a system design concept, a question was posed: How do you achieve electronic voting, anonymity, and verifiability at the same time? I was informed that most experts in ...
7
votes
3answers
660 views

What are the risk implications of not verifying referer header on login form?

Imagine a generic web application with a login form to access the application. Regardless of how the actual authentication is performed, what are the implications of not checking the referer header to ...
6
votes
2answers
943 views

Authentication: Username (email) and password hashed together in one database field

I am currently developping a platform with a PHP framework for our client. The head of the client's IT department wants us to handle authentication with one database field containing email+password+...
6
votes
5answers
8k views

XSS : Blacklist characters vs. whitelist

I have been studying to prevent my web app against XSS. I read about it on OWASP and other security channels, they all say that use ESAPI and similar library, and also do input filtering through ...
6
votes
2answers
5k views

Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?

we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
6
votes
3answers
218 views

Obtaining e-mail address at registration

In a registration form the user is asked for his e-mail address. The e-mail address will be validated for the correct format (e.g. at the least contains @) and I'm considering checking if it's already ...
6
votes
2answers
2k views

Canonicalization & Output Encoding

I'm reading OWASP's Secure Coding Practices Checklist and under their "Input Validation" section they have an item that reads: If any potentially hazardous characters (<>"'%()&+\\'\") ...
6
votes
1answer
107 views

Who can certify RNG according NIST SP800-22?

I have written my own random number generator as a C library and I tested it on NIST Statistical Test Suite. Now I would like to get a certification to have a formal proof that my C library generates ...
5
votes
3answers
10k views

What data should I validate when validating X.509 certificates using Java?

Well I began with PKI a year ago with RFID system at school. Now I'm asked to implement this in my job. I understand most part of the idea. The doubt is about the certificate validation. I know it ...
5
votes
2answers
624 views

Should you let users know if an email has been taken during registration validation? [duplicate]

In many web applications, email is required to be a unique field, and users aren't allowed to register an account if their email already exists in the database. When performing validation on the ...
5
votes
2answers
203 views

How can a certificate be valid in the Hybrid Model but not in the Chain Model?

All dates in European format! I am learning about validity models, but the solution for this assignment confuses me. Translation: The relevant data for the applicable certificates are shown ...
4
votes
3answers
2k views

SQL injection using letters and numbers?

I was wondering if it is at all possible for a hacker to perform an SQL injection attack using just letters and numbers. For example, let's take a look at this PHP code which uses regular expressions ...
4
votes
2answers
185 views

In practice, does crypto software accept a *.com or or even a *. certificate?

Assuming this will be done with your own PKI, and not a public trusted CA. Considering that *.sub.domain.com is valid, and so is *.domain.com is valid, is it technically possible to issue *.com and ...
4
votes
2answers
550 views

Server checking client's password without ever coming into possession of it

tl;dr: I am wondering what the best way is to check a password when the client does not trust the server. I know of two common ways servers can check if a user's password is correct: The server ...
4
votes
1answer
2k views

Is ASP.NET Event Validation completely secure?

I am currently testing a ASP.NET web application for its security. Doing so I came across the event validation mechanism. Is there some way to bypass it? How much assurance is there that it cannot be ...
4
votes
2answers
193 views

Email & Domain ownership?

Most hosting companies, such as mine (hostgator) give the following notice when providing a contact email: Email address that you can be contacted at. This should be an email address that is not ...
4
votes
1answer
104 views

Asking for Password After Email Validation?

I do not want to discuss the pros and cons of email validation, but want to know if there are any potential downsides (security and otherwise) to a user entering his password only after he has already ...
4
votes
1answer
63 views

Is it easy to protect against SSI injection?

SSI injection is, to the best of my understanding, the process of injecting commands into user input fields, e.g. &lt;!--#exec cmd="ls" --&gt; to get the files in the current directory. ...
4
votes
2answers
138 views

Could server honesty be audited by remote peers without said peers having sole (or any) control of the server?

Suppose for some reason, you and your peers absolutely positively have know that a server is acting honestly. Could the server behaviour be audited remotely through some mechanism of randomly ...
3
votes
5answers
2k views

Is it secure to use jQuery on the server-side for user input validation?

I'm thinking about using jQuery on the server-side (node.js) to validate user input (filter tags, remove every attributes except href, rel, target & style, modify css rules which are applied ...
3
votes
4answers
1k views

Is it ever safe to skip server-side validations?

I am working on a web app with a sign up form like below. The validations are all done client side using http://formvalidator.net/. I am well aware that client-side validations can be bypassed, but I ...
3
votes
4answers
2k views

Bypassing Web Application input validation

A malicious user can use Base-64 or other encoding scheme to bypass web application input validation or to bypass some external Web application firewall. Since these encoding schemes are infinite how ...
3
votes
2answers
491 views

Valid Characters For Magnetic stripe

We bought some Magnetic stripe cards and I'm writing a program that will get talked to by a mag card reader. What I need help with is that I can't, for the life of me, find out what characters are ...
3
votes
1answer
383 views

Exploiting mailto links

Supposing that the user has the power to include any content after mailto: snippet, are there any possible security vulnerabilities? Example: The user says their email address is foo. The link on ...
3
votes
1answer
94 views

Server Certification Processes

We are considering a certification process for new internal server builds before they are allowed to be placed into production. That is, the system administration team will send the server up to the ...
3
votes
2answers
869 views

How to ensure an email address is not free webmail or ISP address?

I notice security companies such as Rapid 7 prevent people signing up with either free email accounts, or accounts provided by ISPs: https://www.rapid7.com/products/metasploit/metasploit-pro-...
3
votes
1answer
89 views

Validating correctness amongst untrusted answers

I'm toying around a distributed computing project. The client application asks for a problem to solve. The server returns a problem description from a "problems pool". When the client finishes, it ...
2
votes
1answer
218 views

SSL certificate to protect spoofing of API server

I have a program written in Python that checks the validity of its license key with a remote server. Am I right that an SSL certificate would make it possible to prevent spoofing (host redirects for ...
2
votes
2answers
50 views

IP Restricted OTP like Web Admin Authentication Safe or Not

I created a web admin panel with the following security implementation. It is located on a sub directory of the web, which will trigger a 404 Error when tried to access (just like the link is ...
2
votes
1answer
125 views

How do I audit the effect of security policy on a computer?

I have developed different templates for local security policy. I have been using the program Nexpose to test the effects of those security policies but so far I am not able to detect the visible ...
2
votes
1answer
76 views

User-friendly TLS certificate validation

I'm designing an application in which clients generate their own TLS certificates ad-hoc (there's no central authority). When two clients interact for a first time, I need for them to mutually check ...
2
votes
1answer
320 views

Server side validations for file upload to prevent DoS on HTTP server

I am aware that client side validations can be easily bypassed by means like disabling javascript. I would like to know the things to be checked while doing a server side validation for file upload. I ...
2
votes
1answer
59 views

Explain OWASP Data Validation best practice example

I'm looking at the OWASP Data Validation page trying to figure out what they mean with the "Best Method" for "business rule validation". I quote them here: Example - Scenario You are to ...
2
votes
2answers
191 views

Using External Certificates on a network that doesn't permit outbound HTTP/S access

Some highly secure networks and DMZs prevent all communication to outside hosts. This can cause issues with validating externally signed data I can guess that issues with signature validation occur ...
2
votes
0answers
11 views

Signtool validation fails when signing and validating are done in different machines

I am signing an exe from a machine using a cer file. Then when I validate the EXE using the signtool.exe from the same machine, it succeeds. But when I try to validate it using the same .cer installed ...
2
votes
1answer
274 views

Finding the type of SSL certificate with cURL

This is a part of curl's verbose output when connecting to the HTTPS site of Google. * Server certificate: * subject: C=US; ST=California; L=Mountain View; O=Google Inc; CN=www.google.com * ...
1
vote
3answers
284 views

Strong email validation. Is it really necessary?

I am working on one of my projects where users don't need to register or login to post an advert, but they have to provide email so that a confirmation link will be sent to their email address for ...
1
vote
1answer
102 views

Certificate expiry validation - in what stage?

I'm implementing certificate expiry validation for a client. I'm not sure about the following. Is there a standard/popular implementation regarding the order of validation- Check if the ...
1
vote
1answer
78 views

Should content from database be sanitized again

Suppose I save content into the database after sanitizing it. Is there still a need to sanitize it again when retrieving it? If yes, why?
1
vote
2answers
351 views

Is php DOMDocument::loadXML completely secure?

Our application is using loadXML extensively to recieve data(input) from the users. Other than the usual checks for SQL injections and XXS, are there any known risks in parsing the xml file using ...
1
vote
1answer
915 views

Behavior when validating an expired certificate chain

I have the following situation: A server certificate (CServ) is signed by self-signed certificate (C0) A client certificate (CCli) is signed by CServ Client's trust-store contains C0, so the client ...
1
vote
3answers
2k views

Validate hmac with hashed stored key

What if an HMAC is correctly generated and sent with the data to the server, so far I know the server needs to know the original data with which the MAC was created in order to re-create the MAC and ...
1
vote
2answers
46 views

form validation [closed]

To what degree of concern should I take when validating a form? What should be the general line to say enough? Currently, I'm checking form token submit value = match internal hard code input name =...