Skip to main content
202 votes

How to approach replacing md5 for transporting Unity game data to a remote server

This approach is fundamentally flawed. Anything on the client side can and will be tampered with by players. It is the same problem which makes DRM untenable - the user owns the machine and all the ...
Polynomial's user avatar
  • 135k
48 votes

How to avoid using System.String with Rfc2898DeriveBytes in C#

The .NET Core team specifically recommends against using SecureString for new development. See the SecureString documentation: We don't recommend that you use the SecureString class for new ...
Vivelin's user avatar
  • 529
40 votes

How to approach replacing md5 for transporting Unity game data to a remote server

There are three problems here: What you're trying to do is fundamentally misguided in several ways, as described in Polynomial's answer. If you insist on doing it anyway, then you're not even using ...
Nathaniel J. Smith's user avatar
37 votes
Accepted

Secure big, old ecommerce website from XSS?

I propose the following four step program, where you first pick the low hanging fruit to give you some minimum of protection while you work on the bigger problems. 1. Activate client side filtering 1....
Anders's user avatar
  • 65.6k
32 votes
Accepted

How to avoid using System.String with Rfc2898DeriveBytes in C#

Using SecureString correctly is difficult, and protects against a threat surface that is unlikely for most use cases. As you say, if an attacker can read your memory, you have other problems. I would ...
Sjoerd's user avatar
  • 31.4k
27 votes
Accepted

How to approach replacing md5 for transporting Unity game data to a remote server

Edit: To clarify, I can't speak to the security of your approach, only the hash portion. There are some strong comments here discouraging your approach. (i.e. a good hash can be part of a secure ...
700 Software's user avatar
16 votes

Protect PHP hashing algorithm (from bots)

You cannot. It is unfortunate, but you cannot. Whatever is running as the client (barring some situations you are almost certainly not in involving TPM) can, if someone is sufficiently motivated, be ...
crovers's user avatar
  • 6,381
11 votes

How to approach replacing md5 for transporting Unity game data to a remote server

A friend of mine once made a flash game (yes it's that long ago) and used the same scheme: md5(authenticated data + secret key), then validate it on the server. I reverse engineered it with some tool ...
Luc's user avatar
  • 33k
11 votes

Protect PHP hashing algorithm (from bots)

HashCash You could incorporate proof of work into the system: use something like HashCash to require the user to spend, say, 1 second of CPU-time to message your server. This system could be as ...
QuadmasterXLII's user avatar
10 votes
Accepted

Where to store secrets in .NET applications?

The Windows-built-in secret store (analogous to Apple's Keyring) is called Credential Manager. See https://stackoverflow.com/questions/9221245/how-do-i-store-and-retrieve-credentials-from-the-windows-...
CBHacking's user avatar
  • 49.3k
9 votes
Accepted

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

"FIPS compliance" is about more than the algorithm. It is about implementations. Being awarded the "compliant" badge is a long, complex and very expensive process; its conceptual meaning is that there ...
Tom Leek's user avatar
  • 173k
8 votes

Protect PHP hashing algorithm (from bots)

Rate limiting, plain and simple. You need to determine just how important the service is. If it's a service that your application depends on, it needs to have security implemented. It could take the ...
zzarzzur's user avatar
  • 1,132
7 votes

Ensuring security of deserializing data using Protobuf-net

I cannot answer questions #1 or #2, but I can speak a bit to question #3. First, a quick overview of protobuf-net. On the wire, Google's protocol buffers are a messaging format not a serialization ...
dbc's user avatar
  • 221
7 votes
Accepted

SHA256 instead of Rfc2898DeriveBytes

Use the known, trusted algorithm over one that you've made yourself.** I can't speak for the entropy, but of course it will take more time if you have a sufficiently large number of iterations. It's ...
Richard Ward's user avatar
7 votes

FIPS Compliance with HMACSHA1 vs HMACSHA256 / HMACSHA512

There are two different notions of compliance here: Using a compliant algorithm — the official term is “Approved”. Hash algorithms for HMAC are Approved if they are listed in FIPS 180-4 (or earlier ...
Gilles 'SO- stop being evil''s user avatar
7 votes
Accepted

Could Meltdown/Spectre be exploited from C#/.Net (or other managed languages or the Midori OS)?

Could Meltdown be exploited from C#/.Net (or other managed languages)? It can even be done from JavaScript.
Hector's user avatar
  • 11k
7 votes
Accepted

Is .NET XmlSerializer.Deserialize(TextReader) safe?

Took a peek into the XmlSerializer.Deserialize code XmlSerializer.Deserialize(TextReader) internally calls the other override - XmlSerializer.Deserialize(XmlTextReader) with XmlResolver set to null, ...
Nagarjuna Borra's user avatar
7 votes

.Net dll encryption

Since you mentioned dll (and not dylib or so), then one important thing to note that, Windows10 would kill your program immediately when it detects some module is applying cryptography on code ...
DannyNiu's user avatar
  • 374
7 votes
Accepted

Can we add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 on windows server 2012 using gpedit although not supported by windows OS by default?

If the version of SChannel (the code Microsoft wrote that implements TLS in Windows) doesn't support a cipher suite, then enabling it in the registry will not affect anything. The registry stores a ...
Z.T.'s user avatar
  • 8,524
6 votes
Accepted

AES Encryption random IV per file

From a security perspective, the generateIV() method is fine, if a bit redundant as .NET will generate an IV for you in exactly the same way if one is not provided. The three bigger issues are that ...
Xander's user avatar
  • 35.8k
6 votes

How can I verify that network calls to my API come only from my C# program?

Every time this question came up, I point people to David Auerbach's Chat Wars: Microsoft vs. AOL. The story shows the extent that some very clever people have done to try to do what you're trying to ...
Lie Ryan's user avatar
  • 31.5k
6 votes

What do you search for in Open Source code to be sure there isn't malicious code?

If you want to be 100% sure that some git repo doesn't contain malicious code, write it yourself; anything else will be an uphill battle. If someone's really truly trying to hide malicious code in ...
Mike Ounsworth's user avatar
6 votes
Accepted

How to prevent expired cookies from maintaining accesss?

How do sessions work? Before you can understand the issue, you need to have an understanding of how sessions work. The most common way to manage sessions is to send the browser a cookie with a ...
AndrolGenhald's user avatar
6 votes
Accepted

Alternative to bcrypt in .NET Core?

The preffered algorithm from that namespace seems to be PasswordDeriveBytes, though this is PBKDF1, which is nowhere as good as Bcrypt and probably should not be used. PBKDF2 from a different ...
Peter Harmann's user avatar
6 votes
Accepted

Should I specify JWT audience and issuer if I have only one SPA client?

This answer complements the comments on the original question. What do these claims mean anyway? Issuer: The iss-claim corresponds to the authority who issued the token. In federated identity ...
Beltway's user avatar
  • 406
5 votes
Accepted

What does "don't roll your own security" mean?

Quoting Bruce Schneier: Anyone can design a cipher that he himself cannot break. This is why you should uniformly distrust amateur cryptography, and why you should only use published algorithms ...
thel3l's user avatar
  • 3,404
5 votes

Secure big, old ecommerce website from XSS?

The short of it is that there is no easy solution. I have a suggestion for an "easy" solution at the bottom, but bear in mind that it has many caveats, which I will discuss here. First though, let's ...
Conor Mancone's user avatar
5 votes
Accepted

Get client ip address that is not spoofed

This obviously only applies to HTTP, as it is a HTTP header. It furthermore relies on a proxy server that doesn't attempt to hide that it's a proxy server. It will not work with clients using VPN. It ...
vidarlo's user avatar
  • 16.6k
5 votes
Accepted

How good/bad is this implementation to secure password?

Password hashing, like most cryptographic operations, is something you should never try creating from scratch, and should avoid even implementing from somebody else's design unless there's some reason ...
CBHacking's user avatar
  • 49.3k
5 votes

.Net dll encryption

Going for obfuscation than encryption is the way to go. Encryption takes the easy-to-reverse-engineer DLL and adds a layer of encryption, for which one must know the key. Once the key is revealed/...
usr-local-ΕΨΗΕΛΩΝ's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible