Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [design-flaw]

The tag has no usage guidance.

0
votes
2answers
70 views

Secure algorithm for transferring data between users via QR Code

I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use. The scenario should be ...
-1
votes
1answer
53 views

What are the flaws in this security protocol between client and server? [closed]

Here is my security protocol for the use of a service provided by server. It utilises a symmetric key: Client requests to use a service Server sends back nonce Client sends back nonce encrypted with ...
0
votes
1answer
31 views

Exception handling in multi-tier applications

Error and exception handling in web applications can introduce security issues, often in the form of denial of service (i.e., when a service crashes because of poor error handling) and information ...
1
vote
1answer
72 views

How useful is PDF signing in real world usage?

Background senario: So we had a problem where our system (Alice's shiny widgets) generated a PDF with a quote amount for 10 widgets. Someone (Eve) took the PDF, altered it to increase the price by 20%,...
0
votes
2answers
78 views

Is TLS security for web server reliable or suffer a major design flaw

Best practice in term of security for the web are enforced by major actors like Google or Mozilla, but it feels a bit like something is messed up in the global design. To mitigate all man in the ...
2
votes
2answers
435 views

Can CDN contents be decrypted by officials in new Telegram security design?

Recently Telegram announced using CDN in some territories where they don't want to place main servers. Although the internals are not explained, according to provided diagram and information, a key is ...
1
vote
1answer
238 views

Where to start filtering POST input with MVC? [PHP]

My question is more about design practice, but where should I start the filtering? I figured the class would be the best place for it, but wouldn't that put the instantiated object ($objReg) at risk ...
3
votes
2answers
136 views

Methods of determining if a software bug is a security risk?

I don't really want to get into the specifics. I found a bug from a huge software provider. As any other responsible user, I have reported the bug to the software provider. It is hard to tell if ...
131
votes
10answers
15k views

Should I contact the manufacturer if their product allows access to other users' location information?

I recently purchased a satellite communicator that allows me to send a map of my location to friends and family while I'm hiking in the wilderness. While testing out my product, I noticed that the ...
6
votes
3answers
312 views

How do programs prevent data from being leaked?

There are many programs out there that offer encryption and key management. From what I understand when a file is saved on a hard drive, then there will sometimes (often?) be copies of the file in ...
3
votes
1answer
129 views

Security-by-design based on an existing framework or a custom design?

Personally I do most of the development in PHP (the programming language doesn't really matter for this question). Popular PHP frameworks along developers are for example: CodeIgniter Laravel Symfony ...
3
votes
2answers
78 views

Why gethosbyname() is as bad as gets() by design?

I know gethosbyname() has been obsolete for a long time. But I see static analysers report its use as unsafe, and when softwares remove its usage, it tends to be for security reasons. I know there ...
3
votes
2answers
194 views

Should ability to access login page after authentication be considered a security flaw?

On one of the recent engagements, I bumped into something I have not seen before: after successful authentication attempt the user still can access the login web page and login as another user. It ...
0
votes
2answers
144 views

Can we store sensitive client information with the admins without them(admins) identifying it?

I am trying to design a pairing application for my university this valentine. How is it supposed to work, you ask?? The clients will submit preferences specifically names to the server and after some ...
-1
votes
5answers
298 views

Is there a name for this flawed way of thinking about security? [closed]

I've recently encountered a developer who thinks that she can implement security on the client end of a web application. Breaking the security is as trivial as reading a few lines of Javascript and ...
2
votes
2answers
151 views

Violation of security principles?

It's clear that keyless entry fobs, smart entry cards, NFC, etc. are vulnerable to relay attacks. Suppose they were improved by limiting the period of activity, eg let them be active only when they ...
3
votes
1answer
298 views

Challenge: How to find the secret key in homebrew MAC/keyed hash: sha1(key + cookie)?

I am trying to solve a security challenge on a website. Basically, the website computes sha1(key + cookie) to sign a cookie so that the user can't change it himself, and to accomplish the goal you ...
13
votes
1answer
903 views

Secure backup encryption with OpenSSL

I know, the general advice is "keep your hands off crypto stuff". And the standard way to encrypt backup data securely would be using GnuPG. However, for a rather academic exercise, I would like to ...
0
votes
1answer
193 views

Is it secure to not expire keys in symmetric encryption?

Note that this question describe hypothetical case, that is never meant to be used in real world. Server communicates with clients with message structure: client_id, initialization_vector, encrypted ...
1
vote
1answer
1k views

Difference between Architecture review and a Design review

As the question says, I would like to know the difference(s) between an Architecture review and a Design review. If someone could explain the two using an example, such as an Architecture review of a ...
64
votes
3answers
8k views

Heartbleed: Why does the client supply the length of the message at all?

"The fix for this bug is simple: check that the length of the message actually matches the length of the incoming request." Why do we even have the client report the length at all? If we can know ...
-1
votes
1answer
943 views

How is the widespread design of ATM rooms more secure? [closed]

Widespread ATM room designs are such that the machine faces the door which is less secure as compared to a situation wherein I face the door when using the ATM.
1
vote
0answers
139 views

Untrusted central server and self-hosted/local client

I am wanting to develop a web service (classic client/server) where the server is not trusted, so is kept (cryptographically) ignorant about the actual content/messages. Obviously, if you don't trust ...
4
votes
5answers
10k views

Is using Google Voice number for two-factor authentication a big mistake?

Two-factor authentication is growing in popularity as a security measure. For example, Google, Facebook, Twitter, and many other services all have two-step security options today as well as many banks ...
12
votes
3answers
1k views

How much information about the reason for an unsuccessful login should a web application give?

After an unsuccessful login attempt, should I inform the user about its reason? Or more generally, how much information about the reason for an unsuccessful login attempt should a web application give?...
4
votes
3answers
311 views

Does a 'reset password' website facility give away too much information?

If a website has a reset password facility (which will e-mail the account holder a reset link), does this facility reveal too much information by allowing someone to probe who holds an account by ...
3
votes
1answer
1k views

Does anyone know how to use TRIKE?

TRIKE is an open source threat modeling methodology and tool, as presented by the authors. After i tried several threat modeling tools and methodologies, I have the feeling that it is the only real "...
2
votes
2answers
167 views

Bad planning causing weak passwords

The athletic department at my university has a facebook page and on it they said "the first 500 people to register for this event will get free t-shirts". When registering one has to create an account ...