Tagged Questions
0
votes
2answers
93 views
How to allow only the public key owner to submit requests to my site? And what is this type of security called?
This was probably asked many times here, but I'm not finding any because I'm not sure what to look for.
I'm developing a simple payment gateway, where partners (consumers) can submit requests so ...
2
votes
3answers
80 views
How good is validating source with request.referer than checksum?
I have 2 portals(both are under my control & domain names are different)
In 1st portal, there is a link on click of which User can directly get logged into 2nd portal.
Link which will be hit in ...
2
votes
4answers
234 views
Is it safe to allow users multiple login at different browsers & computers?
We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example ...
6
votes
3answers
558 views
Is there any SQL injection for this PHP login example?
I want to write a login form, and I got one example from the web.
I want to know, if there is any SQL injection for this code? If there is, what could the exploit's web form entry look like?
This is ...
2
votes
1answer
99 views
User Authentication API
I'm developing a web API for a user database that will be used to verify a given username / password combination is valid.
I'm just looking for comments / criticism on the following method that I'm ...
1
vote
1answer
141 views
Basic Authentication with WebAPI and HTML/JS Client?
I just purchased Badri L's Pro ASP.NET Web API Security in an attempt to learn the least-expensive means to securing my WebAPI, in terms of time-to-implement. I have zero experience with security and ...
6
votes
3answers
194 views
What is the value in asking for a second password for sensitive operations?
When a user has logged in to a system using their primary password, is there any value in asking for a distinct second password when performing sensitive functions?
Does it provide any benefit over ...
10
votes
2answers
139 views
Preventing Voter Fraud on a Social Media Contest
I'm creating a contest that will allow users to login using their Facebook & Twitter accounts and submit votes on videos. My clients concern is that users will game the system by logging into ...
3
votes
1answer
133 views
Will using external OAuth providers for authentication protect users better than custom authentication?
On StackExchange we have the ability to choose to use our existing credentials with external OAuth providers such as Facebook or Google. This is convenient for users, but does it also have potential ...
0
votes
3answers
248 views
What do I need to do to secure log-in and registration for my website?
What security features do I need to have in-place to ensure that my website log-in and registration forms are secure?
1
vote
1answer
51 views
Java applet authenticity problem
I implemented an applet in java to authenticate users at my website by the usage of MIFARE cards and everything is working good. However I am concerned about the applet's authenticity, in other words, ...
7
votes
1answer
361 views
What possible use does an iFrame have for security?
I'm looking at code for an old login form I'm redesigning. It's a simple table with two input fields for username and password.
But just before the end </table> tag there's a blank iFrame which ...
0
votes
2answers
97 views
Senario:SSL Enabled Online Banking Application. Question: Should card numbers be provided back to a user un-masked, when there is a failed login?
For an online banking application with SSL enabled, should card numbers be provided back to the user unmasked, when there is a failed login.
Would this be a violation of PCI DSS 3.3 or not as the ...
10
votes
3answers
427 views
How much information about the reason for an unsuccessful login should a web application give?
After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application ...
2
votes
4answers
264 views
When logging out of a website is anything else required then destroying the session?
In PHP, I'm not sure if I should start the session before destroying it when a user wants to log out.
session_start();
session_destroy();
Is there anything else that needs to be done?
EDIT: I ...
2
votes
7answers
235 views
How to provide security for passwords stored in Database? [duplicate]
Passwords of end Users are stored in Database which is encrypted (using one way hash like MD5). Apart from me, there are 'other' people belonging to other teams who have access to Database which means ...
3
votes
4answers
385 views
How to “demonstrate” man-in-the-middle attack?
I'm TAing a particular course on system security. A specific example is transitting the password in plain text when developing a web application (as part of a class project).
Over the years a bunch ...
-2
votes
1answer
110 views
When logging into a web page what exactly happens when a user types the wrong password?
I have two related questions as to what happens when a user tries to log in to a website
If the entered password is wrong what should happen?
I have two ideas:
Redirect to a page saying "wrong ...
0
votes
2answers
57 views
How can I set up signed downloads?
Scenario
I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
1
vote
1answer
44 views
Should Framebusting be used (not used) on an IdP login page?
I'm trying to understand when Framebusting should and shouldn't be used. At first brush I'd want to apply that to all pages in my site and generating exceptions as necessary.
On the other hand, if I ...
1
vote
1answer
114 views
Exporting data beyond a cryptographic boundary
Scenario
We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
3
votes
3answers
130 views
Is it safe to mix authentication methods?
Is it a good idea to "combine" authentication methods?
Example we can use username/password method to authenticate a user from a server.
What if we used this as a first authentication step to get ...
2
votes
6answers
203 views
Protecting an admin area from the public
We are about a month away from launching a pretty important site, which comes with an admin console to help us manage the site.
Now I'm not very interested at just leaving the admin out in the open ...
0
votes
2answers
115 views
OpenID without SSL certificate
Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed?
Just to make things clear, ...
1
vote
1answer
173 views
Picking an encryption algorithm for auth tokens passed via AJAX
I'm looking for a low CPU intensive encryption algorithm, to pass around session authentication tokens.
As an example:
The user will login in to the website (via OAuth, whether by the site as ...
3
votes
4answers
172 views
Securing opensource web application
I have an open source website. I need to add an admin section to the website which is accessible to only one person. To make it secure, I was thinking about providing a login page which checks if the ...
1
vote
3answers
145 views
Should WS-Fed, Mozilla's Persona or OpenID ever be used with a Banking application?
Most banking sites I've seen use a sign in process that is proprietary, or otherwise won't integrate with an external IDP.
Should banks offer integration with services like OpenID, WS-Fed, or ...
1
vote
2answers
245 views
UNION SQL Injection
I'm trying to demo SQL Injection with a UNION query but I'm not getting results.
This is the C# code and the database is SQL Server 2008 R2:
string cString = "server=.\\sqlexpress; ...
1
vote
1answer
628 views
Wifi login redirect applications
This may sound a bit naive questions as i am a beginner. But I do my best to put it into words.
You may have experience when sometimes you want to use the internet in a cafe for example (with your ...
3
votes
1answer
328 views
How does a CSRF token prevent an attack, and how can I safely use/avoid it for my JSON API?
I'm trying to make an iOS app communicate with a Ruby on Rails website using JSON. While trying to post a login to create a user session, I discovered I was missing a CSRF token. I had no idea what ...
1
vote
2answers
152 views
Authentication without saving password
Are there any security problems with following authentication protocol?
when user creates hers account, she provides her username and password. I store the username and blowfishEncrypt(toEncrypt = ...
6
votes
4answers
356 views
Banking application login leaks information
My question is regarding the online banking application of a large credit card organisation. The login process for this application works as follows:
User visits the homepage of the bank.
User ...
1
vote
1answer
140 views
Public web server and AD- based Kerberos authentication
I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses ...
17
votes
6answers
1k views
Why do we ask for a user's existing password when changing their password?
In a web applications context, when a user wants to change their current password, generally they would have to enter their current password first. However at this point, the user has already been ...
0
votes
1answer
167 views
Protect database resources from fake data inputs via web forms
Scenario:
I'm working on a project that needs to accept large amounts of data (customer data) from its users. So it can be normal to have a user trying to add 10,000 or 100,000 records at a time. In ...
7
votes
2answers
677 views
Keeping user session alive - security considerations
We have recently developed some functionality for our web app to allow a user to remain logged in indefinitely, and are interested in knowing the security ramifications of doing so. The goal of this ...
3
votes
2answers
150 views
Secure login across two web apps
I have an requirement to implement cross-domain login for two web apps (APP1 and APP2) so that a user can access APP2 once they have logged into APP1.
APP2 needs to know an ID of the user who is ...
3
votes
4answers
118 views
Strong authentication over insecure links
Let's begin by assuming that we're operating in either a corporate or Governmental environment where SSL man-in-the-middle interceptions are a given and that *all* traffic on the network between the ...
4
votes
1answer
227 views
Secure web user authentication even after server-side database compromise
By now, we should all know to use bcrypt or scrypt to store salted password hashes with a sufficient number of rounds. (See, e.g., https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet) The ...
7
votes
4answers
846 views
What are the disadvantages of single sign-on authentication?
We were discussing to implement single on in our web application,right now after analyzing we came to know that the following were the advantages of single sign on authentication.
Advantages
Users ...
-1
votes
2answers
109 views
Should I use salt to authenticate data?
I have a client and a server. The client makes a request containing userId, cardId, position (on the card)
A hacker could just do the same http request with the next position. So I think about ...
3
votes
4answers
475 views
Is it okay for API secret to be stored in plain text or decrypt-able?
Aren't API keys considered usernames and API secrets considered passwords? Why is it that API servers like Amazon Web Services allow you to view your API secret in plain text? It makes me think they ...
3
votes
5answers
590 views
How to secure a server backend
I am developing a server which serves two purposes: it is a CMS for people to use and maintain some data, and a Web Service for a mobile app to get this data. It runs on a Debian server running Tomcat ...
0
votes
1answer
45 views
Considerations when displaying OpenID and WS-* output to an end user
I'm creating a "Learn OpenID and WS-*" website and am using all the best practices in making the site secure.
I would like to create a page that decryption the current session's OpenID or WS-* token, ...
5
votes
1answer
224 views
What is the benefit of the scope in OAuth2?
In the question, substitute scope with state. Since there is an answer based on the wrong question, I'll let everything below as is. The answer is useful nonetheless.
This question refers to ...
0
votes
1answer
96 views
Implementing an invitation process for user setup
In a new ASP.NET MVC application I'm working on we'd like an administrator user to be able to set up other user accounts by creating invitations which will be emailed to the new user. That email will ...
4
votes
1answer
981 views
Comparing the standard HTML form POST for user authentication vs Javascript/AJAX
Are there any security implications with POSTing a authentication request with the use of javascript/ajax, as opposed to POSTing an HTML element by pressing the submit button?
thus
<form ...
1
vote
4answers
436 views
Authentication between web services within the same project
In our project, we have several web services. Some of them are meant to be used only by the other services and the system administrator. We already have a global authentication system for users, this ...
1
vote
1answer
187 views
Using Tokens to Keep Users Logged In
I'm a PHP web developer who has been reading up on security recently and consequently this question entered my mind: How to properly and securely authenticate already-logged in users with a token? ...
2
votes
1answer
347 views
Implementing 2-step verification via email for web apps?
I was thinking of applying 2-step verification to my web apps that will work similarly to Gmail's SMS/voice 2-step verification, except my web app will just email the verification code each time a ...
