82 votes
Accepted

How many rounds of hashing is enough for a password manager?

I'm currently writing my own little password manager That's your first mistake. Something this complex has many subtle pitfalls that even experts sometimes fall into, without plenty of experience in ...
AndrolGenhald's user avatar
77 votes

What are some important concepts to teach developers about cross-site scripting (XSS)?

From a developer's perspective, the first two points you have are not very relevant. Stored and Reflected XSS have the same mitigation: properly escape things you output according to their context. ...
bonsaiviking's user avatar
  • 11.7k
69 votes
Accepted

Can I trust public code versioning platforms when building a social platform?

Unfortunately, you are the ones responsible of seeing if your threat model is justified or not. Therefore, we cannot simply give a definite "yes" whether we see using the platform as a security threat ...
Simon's user avatar
  • 3,202
42 votes

Why is there no web client for Signal?

Yes HTTPS is used. The thread doesn't say that the web app will be completely insecure, instead it says This effectively reduces the security of your end-to-end encrypted communication to that of ...
nobody's user avatar
  • 11.6k
25 votes

Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?

Yes, internal applications should be secured with due diligence and yes OWASP can be a good guide for securing your application. Also look over Microsoft's Security Development Lifecycle (SDL), It is ...
Kyle Fennell's user avatar
23 votes

Can I trust public code versioning platforms when building a social platform?

@Simon has already provided a fantastic answer, but I'd like to add in response to this point: there is no possible real warranty that staff from Gitlab cannot investigate the source and find ...
Adam Barnes's user avatar
22 votes

How many rounds of hashing is enough for a password manager?

First let me disclose that I work for 1Password, a password manager, and although it may seem self-serving, I have to add my voice to those telling you that writing a secure password manager is harder ...
Jeffrey Goldberg's user avatar
19 votes

What are some important concepts to teach developers about cross-site scripting (XSS)?

What are some concepts you think are indispensable to get across to them? Difference between Reflected and stored -- I don't really care. Layers of defense -- Yes. Many developers do not understand "...
Eric Lippert's user avatar
  • 4,446
19 votes

Does having no 'if' blocks in code mitigate side-channel attacks?

Not just if. You will have to remove all functions, methods, lambdas, classes, loops, whiles, exceptions, polling, switch, if, lookup tables, jump tables. You will then have no need for tests, ...
Konchog's user avatar
  • 615
11 votes
Accepted

Does having no 'if' blocks in code mitigate side-channel attacks?

Removing branching would probably mitigate these problems. But so what? If you remove branching you essentially remove the need for a general purpose computer, and you're left with something that can ...
vidarlo's user avatar
  • 16.1k
9 votes

What are some important concepts to teach developers about cross-site scripting (XSS)?

You covered most of the basics. To extend a bit on your points (some of these will seem obvious to most readers here, but may not necessarily be obvious to all developers): XSS can happen via GET and ...
tim's user avatar
  • 29.6k
9 votes

Does having no 'if' blocks in code mitigate side-channel attacks?

Unfortunately, even aside from the other issues mentioned, compilers can produce conditional execution even in cases where you did not explicitly write a conditional. This most commonly arises from ...
TLW's user avatar
  • 190
8 votes

How secure is the use of fingerprints (like Apple's TouchID) for authentication in banking apps?

The problem is that the server cannot store a hash of the fingerprint, because the fingerprint can come with slight variations that would give a completely different hash. And if your fingerprint is ...
Serge Ballesta's user avatar
8 votes
Accepted

How can I safely store a password in a .class file?

You cannot. If the application has to know the password, there is no way to store it safely, unless you ask a user at run time for a master password. Because if the app can get it, an attacker could ...
Serge Ballesta's user avatar
8 votes
Accepted

Should I return meaningful error code in case of internal error?

Which practice is better? It depends on your needs. There is no "secure" or "not secure", only "secure enough for my needs". Which is better depends on your particular risk/benefit tradeoff ...
Conor Mancone's user avatar
8 votes

Username Enumeration in 2018 - How serious is this

As a pentester, I generally call out username enumeration as a very low or informational issue, but this can vary based on the application I'm looking at. Things that factor into how big an issue ...
Buffalo5ix's user avatar
  • 2,706
6 votes

What are some important concepts to teach developers about cross-site scripting (XSS)?

I think the two most important lessons to teach are these: If you're generating markup or any other structured textual representation (e.g., JSON, SQL, URL query strings) in an ad-hoc manner by ...
Luis Casillas's user avatar
6 votes
Accepted

How long should I wait before choosing a hash function?

How long should I wait before using a newer (hopefully improved) hash function? The better question to ask is: "How long should I wait before switching off my current hash". What are you on now? If ...
Mike Ounsworth's user avatar
6 votes
Accepted

How to Check Open Source Code for Vulnerabilities?

It largely depends on what it is you are trying to find bugs for. And I can tell you now that there will never be a one size fits all approach to this. Finding bugs in something like OpenSSL will be ...
Raz Varren's user avatar
6 votes

How many rounds of hashing is enough for a password manager?

Do not use raw SHA256 - it is able to be accelerated using GPUs and therefore prone to brute force. It isn't broken, by any stretch, it just isn't best practice any longer. PBKDF2 works to counteract ...
crovers's user avatar
  • 6,381
6 votes

Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?

Others already mentioned some good points about evil employees, infiltration, defense in depth... but it's much more practical than that. I can attack your internal intranet application from a random ...
Luc's user avatar
  • 32.9k
5 votes
Accepted

Penetration Testing vs Secure Source Code Review

How exercise of independent third party secure source code review is different from penetration testing? The secure code review is a white-box methodology where the code reviewer will be using ...
Shiv Sahni's user avatar
5 votes

Can I trust public code versioning platforms when building a social platform?

There are multiple options except for Gitlab (including pure Git). Gitlab is an open-source/open code project so that you can install it on your private server, so nobody except your team have access. ...
Maxim Kuleshov's user avatar
5 votes
Accepted

How do we secure image parsing libraries against buffer overflow?

There are a couple of obvious things which are not limited to image parsing libraries: Don't assume that the input is well-formed but actually check it. It is actually a common problem with image or ...
Steffen Ullrich's user avatar
5 votes

Does an application purely for intranet use by employees need secure software design or to follow OWASP guidelines?

Remember the giant Capital One breach in August 2019? The root cause was a server-side request forgery (SSRF) vulnerability in an internal Capital One app. So Yes, you need to worry about secure ...
Mike Ounsworth's user avatar
5 votes

Does having no 'if' blocks in code mitigate side-channel attacks?

There is no IF statement at the CPU level and it is unclear which programming language with if statements you refer to. But depending on the programming language various statements will result in ...
Steffen Ullrich's user avatar
4 votes

High security application in Angular - a bad idea?

The browser should be trusted with the user's data in any case. Whether you use a single-page app or a plain HTML page, you are toast if the browser is compromised. Single-page apps do not change ...
André Borie's user avatar
  • 12.8k
4 votes
Accepted

Is collecting credit card information the only intention of hackers?

To answer your question: NO, hackers have a lot of reasons to attack a site. Credit card information is only one of those. Having recently completed a PHP project myself, we made sure to use the ...
Cas's user avatar
  • 156
4 votes

How secure is the use of fingerprints (like Apple's TouchID) for authentication in banking apps?

For TouchID, the fingerprint doesn't leave the phone (as stated by Apple when they introduced touchID). The API called LocalAuthentication and is relatively straightforward: https://developer.apple....
Gp2mv3's user avatar
  • 141

Only top scored, non community-wiki answers of a minimum length are eligible