New answers tagged

0

@AEonAX : you can use the double handshake token method to use authorize and take care of security. Encryption of token can also be done. Sheldon


0

I only have a windows version in my house to connect to a computer. The rest is run on Linux. Most of us are decent people, and doubt that would eve be subject to the interest of Microsoft. But in reality this is an honest declaration that your data is available to them and anybody that has access to that data in transit. If you have something that you ...


2

As Knorke mentions and the expanded passage explains, the article you referenced specifically refers to information stored on Microsoft Owned information systems such as that stored on servers that provide outlook.com email, or the file servers that house OneDrive cloud storage. A few other good references can be found in the following links: General ...


9

This is the whole passage (source: https://privacy.microsoft.com/en-us/privacystatement): Finally, we will access, disclose and preserve personal data, including your content (such as the content of your emails in Outlook.com, or files in private folders on OneDrive), when we have a good faith belief that doing so is necessary to: comply ...


4

I believe it's because many developers learn just enough to get the job done, for some value of "done". They learn how to build SQL code, often from outdated online tutorials, and then when the code "works" to the extent that they can say "I can put stuff in the database, and I can generate the page of results", then they're satisfied. Consider this guy on ...


4

The other answers have pointed to almost all the reasons. But there is something else, which I think is the most dangerous security concern of all. Developers attempt to add more and more features to technologies, and sometimes deviate from the actual purpose of the technology. A little like how a client side scripting language ended up being used for server ...


2

Personally I think this is a specific case of a more general problem in programming, that IDE's and languages are overly permissive. We give our developers immense power in the name of flexibility and efficiency. The result is "what can happen will happen", and security lapses are inevitable.


7

Yes, anthropologically, humans are stupid. Yes, politically, the incentive structure does not sufficiently penalize vulnerable applications Yes, the process is flawed-- code is written in a hurry; bad/old code is not always thrown away. And, yes, technically, treating and mixing data as code is harder to do by default. But, there's a more positive view ...


6

Because such security issues are not covered during most 3-year education cycles and equivalent studies, and many developers followed such track (including myself). Given how wide the field is, actually 3 years is not even enough to cope with the actual study program.. So things like security are dropped. It is unfortunate, but since some of the new ...


4

If you use prepared statements correctly, SQL injection is not possible. "If the original statement template is not derived from external input, SQL injection cannot occur." https://en.m.wikipedia.org/wiki/Prepared_statement Unfortunately people usually don't use prepared statements correctly, if at all. SQL injection would be a thing of the past if ...


1

PDO (or other "safe" methods) is no more secure than mysql_ (or other "unsafe" methods). It makes it easier to write safe code, but it is even simpler to just concatenate the unescaped user provided strings into the query and not bother with the parameters.


20

I agree with a lot of the answers, but one very important point isn't made: code doesn't magically fix itself, and there is a lot of code out there which is 17 years old. I have seen many companies write clean and safe new code, whilst the application could still be attacked in some of it's older sections. And worst of all: fixing old code is expensive, ...


243

Because it's not a problem. When was the last time a company with a SQL injection vulnerability got hauled up in court, and slapped with a big fine for being reckless with user data, and the directors' warned, fined or locked up for negligence? When was the last time a company lost a big contract because their company website login page didn't validate ...


8

I think the main reason is that developer training doesn't start with best practices, it starts with language understanding. Thus, new programmers, believing they have been trained with the tools to create something proceed to create the queries the way they've been taught. The next and most dangerous step, is to allow someone to develop anything without ...


7

Firstly no one writes secure requirements properly, they say something like "The product shall be secure" Which in no way is testable Secondly Profession developers are not stupid, and to say so is rather disingenuous, they are all likely to have university degrees, and have been solving problems we haven`t even begun to look out... The problem is that ...


8

Why did SQL injection vulnerabilities not got extinct yet? Metaphorically speaking, for the same reason that car crashes are still around since the very first car in 1895 and even the most innovating and modern self-driving cars today, Tesla model S (on autopilot) or Google self-driving car crash from time to time. The cars are created (and controlled) by ...


46

When testing, it is very easy to test for what you expect to happen. For example, when filling in a "name" field in a database you will probably choose something you are familiar with, like "John Doe". This works, and your application seems to work fine. Then, one day, someone names their child Robert'); DROP TABLE Students; -- (little Bobby Tables). Of ...


27

Steffen makes good points in his answer, but I'd like to add to it. The why, I think, can be broken in to the following topics: Lack of knowledge or education of developers Churn in an enterprise development environment Pressure to deliver ahead of schedule Not enough emphasis from the top on security So let's break those down. Developer training There'...


106

SQL injection is still around because the software world still doesn't understand that programmatic generation of tree-structured values (like queries or markup) should be done by constructing syntax trees as first-class objects, not by concatenating strings that represent fragments of a language. There has been a bit of progress in recent years with the ...


387

There is no general fix for SQLi because there is no fix for human stupidity. There are established techniques which are easy to use and which fix the problems (especially parameter binding) but one still has to use these techniques. And many developers are simply not aware of security problems. Most care that the application works at all and don't care ...


1

Is it a good idea to preventively disable (public) access to certain filetypes (by extension) and/or by filenames? Absolutely! In fact all access should be denied and only allow known good requests. This is otherwise known as "Default Deny" or "Whitelisting". Marcus Ranum has some great points in The Six Dumbest Ideas in Computer Security. Though closely ...


1

You're trying to do the impossible here. You're having the localhost server authenticate the client application running in the browser. This is impossible to do securely. What you would want is to write a browser plugin/add-on. The browser plugin/add-on should only activate itself when visiting authorized sites.


1

Assuming you're using a decent language & framework, the only URLs that are accessible are the routes you defined. Everything else should get 404'd by default, except perhaps static non-sensitive files in a specific directory. Anything sensitive should be out of reach of the web server anyway and should only be proxied by the application should it ...



Top 50 recent answers are included