Questions tagged [.net]

A runtime, architecture, and libraries for Microsoft Windows used for creating applications.

Filter by
Sorted by
Tagged with
91 votes
6 answers
131k views

Best place to store authentication tokens client side

When my users are authenticated they receive an authentication token, I need to use this authentication token to authorize some asp.net WebAPI calls. To do this I need to add the token to the head of ...
user avatar
  • 1,013
68 votes
21 answers
67k views

Lessons learned and misconceptions regarding encryption and cryptology

Cryptology is such a broad subject that even experienced coders will almost always make mistakes the first few times around. However encryption is such an important topic, often we can't afford to ...
user avatar
51 votes
9 answers
19k views

Writing my own encryption algorithm [closed]

I am currently studying IT at college (UK college aka not University) and the coursework is boring me to death. I have been coding for quite a while now mainly in OO languages such as C# and Java but ...
user avatar
  • 647
50 votes
4 answers
14k views

How to approach replacing md5 for transporting Unity game data to a remote server

TL;DR I am working on a gaming system that uses UnityScript and C# on the client and PHP on the server. A MD5 hash of the data plus a shared secret is used to check that the data has not been ...
user avatar
  • 1,057
33 votes
3 answers
8k views

Is using the username encrypted with the password as key a good password storage scheme?

On web applications I build I don't hash the passwords. Instead I symmetrically encrypt the username using the user's password and store the result in the password field. I use RijndaelManaged on ...
user avatar
  • 487
28 votes
10 answers
12k views

Is obfuscation worth it [closed]

There are many tools to obfuscate .NET applications. The free ones do some basic obfuscation while commercial ones seem to promise more. My question is: Is it worth to use the commercial obfuscation ...
user avatar
27 votes
2 answers
5k views

How to avoid using System.String with Rfc2898DeriveBytes in C#

I am creating a .NET core webapp in C# that takes in a user password and hashes it to be stored on a server. I'm using Rfc2898DeriveBytes along with a randomly generated salt. I've read, however, that ...
user avatar
  • 373
24 votes
7 answers
29k views

What are the realistic, and most secure crypto for Symmetric, Asymmetric, Hash, Message Authentication Code ciphers?

I'm interested in updating this two pronged question for 2011: What cryptology is most appropriate for low-powered devices (such as a cellphone), and yet still effective? What cryptology is most ...
user avatar
22 votes
1 answer
10k views

Is Rfc2898DeriveBytes using HMAC SHA1 still considered "secure enough" for hashing passwords?

I've been told by a CISSP that the .NET class Rfc2898DeriveBytes would not pass a security audit today because it still uses SHA1. It's reliance on SHA1 - even with the iterations - leaves it too ...
user avatar
17 votes
2 answers
18k views

Is it safe to use PBKDF2 for hashing?

I would like to get a few opinions on whether it would be safe or not to use PBKDF2 to generate a hash of a password. For my purposes I'd like to assume that the hash itself will be posted on the ...
user avatar
  • 357
17 votes
3 answers
7k views

Is there an equivalent of npm audit for nuget packages? [closed]

I'm working on a couple of large .NET web apps and would like to audit the packages used in them. For node projects I've use npm audit. This checks whether your npm packages or their dependencies have ...
user avatar
  • 1,093
16 votes
2 answers
3k views

Secure big, old ecommerce website from XSS?

I'm working for an ecommerce website written in C#.net (no CMS used, quite a lot of code) where security hasn't been a priority for a long time. My mission right now is to find and fix any XSS ...
user avatar
  • 215
15 votes
6 answers
11k views

Is PBKDF2-based System.Cryptology.RFC2898DeriveBytes() "better" for Unicode Password hashing than traditional methods?

When is it appropriate to use RFC2898DeriveBytes versus a typical hash? Update I now understand that a KDF is typically used to create a symmetric key for possible use in encrypting a stream. I ...
user avatar
15 votes
5 answers
12k views

Is it safe to binary-deserialize user-provided data?

AppHarbor has a blog post containing sample C# code which reads data from an unsigned cookie and passes it through .Net binary serialization. Is that safe? Obviously, the data is completely ...
user avatar
  • 250
12 votes
5 answers
3k views

Gold Standard for password hashing

I've developing a web application that will be dealing with highly sensitive information and I want to ensure the hashing of passwords is gold standard. Ideally I'd go for per-user salted SHA512 ...
user avatar
12 votes
2 answers
5k views

How to use DPAPI under load balance environment

DPAPI can be used to encrypt the secret data. We intend to use it in our web app to encrypt some data and store the encrypted data in database. When needed we decrypt the data and present them on UI(...
user avatar
11 votes
4 answers
4k views

Using computer random number generators to produce keys, it is secure?

Does generating an encryption key using the random number generator on one's computer present a security risk? If so how might that risk be mitigated, specifically when generating RSA key pairs in ....
user avatar
11 votes
2 answers
5k views

Data Encryption and Key Management in C#

Which route to take, what are the pros and cons, which is more secure.. Generate AES key, encrypt the data with it and then encrypt the AES key with RSA, save the encrypted data and encrypted AES key ...
user avatar
11 votes
4 answers
2k views

Is this a weakness of enveloped XML signature?

There might be a problem in many applications based on XML signature verification (provided I am not wrong, of course). Let's have a simple XML message with an enveloped XML signature: <?xml ...
user avatar
  • 356
10 votes
3 answers
51k views

How can I detect a VPN connection (even just in some cases) to get the real location of the user

I'm creating a web site, I would like to allow people to sign-up only from their "real" physical location (not using a VPN). I was thinking maybe comparing local and server time... what else...? ...
user avatar
  • 359
10 votes
3 answers
3k views

How can I encrypt a file with .NET and have the same file size of the original file?

I'm using .NET and I've written an awesome routine (xD) that encrypts and decrypts a file using AES256 CBC. It works perfectly, but now they told me that the encrypted file must be of the same size of ...
user avatar
  • 153
9 votes
4 answers
4k views

What Partial Homomorphic Encryption implementations exist and how do I leverage them?

It appears that only Partial Homomorphic Encryption(P.H.E.) is practical for modern day (2011) use. However I'm having difficulty locating libraries (FOSS or otherwise) that enable me to leverage ...
user avatar
9 votes
2 answers
6k views

Is it a security risk to maintain an application developed for a version of .NET prior to 4.0?

I've had a request that we upgrade all our internally developed applications to .NET v4.0. Needless to say, this is a massive chunk of work. Is using applications based on the .NET framework prior to ...
user avatar
  • 193
9 votes
2 answers
6k views

C# Image.FromStream is that secure?

after reading the data from the request as Stream i needed to convert it to Image so i used this Method: Stream inputStream = HttpContext.Current.Request.InputStream; Image img = Image.FromStream(...
user avatar
  • 191
9 votes
3 answers
4k views

Ensuring security of deserializing data using Protobuf-net

I am interested in using protobuf-net to serialize/deserialize data sent across my TCP applications. I learnt of protobuf-net a few weeks ago and downloaded it from here and plan to use it in my ...
user avatar
  • 141
8 votes
6 answers
2k views

Protect PHP hashing algorithm (from bots)

First of all, I'm new to this whole crypto thing. Here's my scenario: I have a client app, that sends a 20char max string to my server. The server then checks if the name is indeed matching the char ...
user avatar
  • 189
8 votes
2 answers
12k views

How to store IV and key temporarily but securely

I am using .NET 4.0 to develop a Windows service that will temporarily store encrypted data in a database. The data will be encrypted when it is inserted, then decrypted, processed, and deleted once ...
user avatar
  • 183
8 votes
3 answers
24k views

How to bypass .Net 4.5 request validation, for an XSS attack?

.Net has a feature called request validation which detects malicious inputs and blocks the request. By its nature, request validation is not a precise science. OWASP clearly recommend to only rely on ...
user avatar
  • 32.7k
8 votes
1 answer
4k views

Is .NET XmlSerializer.Deserialize(TextReader) safe?

Is the .NET method XmlSerializer.Deserialize(TextReader) safe from XML vulnerabilities (XXE, XmlBomb etc..)? Will the DTD be processed during deserialization? I can understand why XmlSerializer....
user avatar
8 votes
4 answers
4k views

Random URL string: What kind of attack is this, and what can be done to stop it?

EDIT: It's been a little while since this was posted, but I'm here to report that this does NOT appear to have been some sort of attack after all. Rather, this particular URL string indicates a ...
user avatar
8 votes
1 answer
651 views

Are there any type safe languages with deterministic compilers?

This article about BIND9 concludes with the statement: The point I'm trying to make here is that BIND9 should not be exposed to the public. It has code problems that should be unacceptable in this ...
user avatar
8 votes
2 answers
3k views

Production ready bcrypt implementation for .NET

Which, if any, .NET / C# bcrypt implementations are considered suitable for production environments? I have seen CryptSharp and BCrypt.Net mentioned in answers to other questions but without any ...
user avatar
8 votes
1 answer
580 views

Any vulnerability in .net implementation for C# object.GetHashCode?

I've already asked this question on SO, but I think that this forum is more appropriate to discuss security issues. My point is that most OO languages has a way to get a unique hash code for an ...
user avatar
8 votes
1 answer
2k views

A practical .NET Remoting Architecture exploit

If you were to demonstrate a .NET Remoting Architecture vulnerability with a practical attack, which one would you choose? I've read J. Forshaw's white paper on Breaking .NET Through Serialization (...
user avatar
7 votes
3 answers
4k views

Why must all classes' data members be set to private?

In OO programming courses, teachers always tells us to set class members to private unless there is a good reason because it is more "secured". How does setting members to private makes the program ...
user avatar
  • 1,188
7 votes
3 answers
6k views

Reference implementation of C# password hashing and verification

Does anyone have a reference implementation (ideally 3rd party certified, or government approved) way one-way hash a password for C# and or Java? Ideally,I'd like to see something that includes a "...
user avatar
7 votes
2 answers
2k views

In Visual Studio, what are the risks of simply opening an untrusted project? What are the mitigations?

I'm looking at the source code of some potentially hostile code. As usual, VS 2012 is giving me the security warning: "You should only open projects from a trustworthy source" ... "ask me for every ...
user avatar
7 votes
2 answers
6k views

How to securely use Process.Start?

I am using Process.Start in a Windows Service I created to execute an exe that I have on my server that is used for audio conversion. I am passing some user input as a parameter to this exe. The ...
user avatar
  • 8,145
7 votes
1 answer
8k views

Is PBKDF2 only SHA1 in C#?

I can't find a way of specifying the hashing algorithm used by the PBKDF2 (the Rfc2898DeriveBytes class) implementation in C# System.Security.Cryptography. It seems to be just SHA1. Am I missing ...
user avatar
  • 171
7 votes
2 answers
1k views

Is there any reason to use AesManaged over DPAPI in this scenario?

I have a situation where my web application is going to be deployed on multiple web servers, and I'll be wanting to store some securely encrypted data on the DB servers (each web server has a DB ...
user avatar
  • 275
7 votes
1 answer
8k views

How To Proper Handle Passwords In C#

It's a well known fact that C# string is pretty insecure, it's not pinned in RAM, the Garbage Collector can move it, copy it, leave multiple traces of it in RAM and the RAM can be swapped and be ...
user avatar
6 votes
1 answer
1k views

Does encrypting a setting in web.config actually provide security?

Does encrypting a value in the web.config file actually provide any real protection? It seems to me that any web app can read that setting. Yes that's more work than just reading the web.config file, ...
user avatar
6 votes
1 answer
3k views

Are there any functional differences in the implementations of OpenSSL, GnuTLS, Java's TLS, and .NET's TLS?

Question Are there any functional (or detectable) differences between the various implementations of SSL/TLS? What are the differences between them? (e.g. which ones implement "False Start") Would ...
user avatar
6 votes
1 answer
422 views

When does one need to be concerned with leaking timing information in .NET?

According to this post, Dominick Baier was comparing two HMACSHA256 signatures and was leaking timing information upon an unsuccessful comparison. When working with .NET crypto classes, when should ...
user avatar
6 votes
1 answer
2k views

Secure query string parameters

I have an application which use the Thick box jQuery component to open a popup page . And I pass my parameters in query string like this : <a id="btnShowPopup6" runat="server" class="thickbox" ...
user avatar
6 votes
1 answer
8k views

What's the risk of changing permissions of the Security Eventlog registry key to IT operations?

Background Many developers are unnecessarily lowering the security of the event log, or requiring applications to run in Administrator mode just so they can use the event log with this C# or VB code: ...
user avatar
6 votes
2 answers
2k views

How do I remove or anonymize file names and path that are stored in compiled .NET exe output?

When an exception occurs in a .NET application, the exception output also includes the path and file name of the code file that resided on the developer's machine. This shares some information that ...
user avatar
5 votes
4 answers
11k views

Reflector - obfuscated code

I run Reflector to de-compile some program and it seems to be obfuscated. I got following output, it’s not very useful. Any ideas how to decompile obfuscated code? [CompilerGenerated] get ...
user avatar
  • 2,575
5 votes
2 answers
11k views

Diffie Hellman c# implementation

For a test project I have tried to implement the (famous) Diffie Hellman algorithm for safe key exchange. Now I have written this in C#: using System; using System.Collections; using System....
user avatar
  • 233
5 votes
1 answer
3k views

Where to store secrets in .NET applications?

I have some secrets that need to be transferred from my .NET application to another. I am using the CNG DPAPI to encrypt these secrets, and I wish to find the most suitable place to store them (in ...
user avatar
  • 294

1
2 3 4 5
8