New answers tagged

0

Any comprehensive solution is going to require depth, i.e. security in layers. Aside from hardening the system, restricting network access, having a substantial logging, auditing, and SIEM approach, you'll want to protect the data within the database as well. Obviously protect any login information with a strong hashing algorithm like PBKDF2 w/ ...


2

static const is more secure, but not for the reasons you're thinking of. It permits the compiler to perform type checking, which will catch a class of bugs that #define won't permit it to catch. In regards to your specific concerns: "#define" is embedded in compiled code, while static int leaves a variable in memory, which a user can change the value ...


0

From my understanding #define will indeed replace TimeLimit with the literal 30 when the preprocessor runs. It is not clear to me what the standard states on static const variables (if anything). For instance, if the compiler supports constant folding and the variable is only used in constant expressions, the expressions are evaluated at compile time and it ...


6

No, you shouldn't encrypt the password on the client if the transmission of data is secured. If you got it all perfect, you're not likely to add any security to the process. If you don't get it perfect, you might be introducing a new vulnerability (buffer overflow, oracle attack, etc). If the TLS version you're using somehow gets compromised, then you ...



Top 50 recent answers are included