Questions tagged [security]
Computer security is security applied to computing devices such as computers and smartphones, as well as to both private and public computer networks, including the whole Internet.
768
questions
60
votes
4
answers
2k
views
Chat bot for posting recent answers
I am the half-robot side of syb0rg that will be posting the recent answers of Code Review to the CR Answers chatroom. Here is the list of review suggestions I would like, in order of preference:
...
- 603
55
votes
3
answers
55k
views
Simplified secure encryption of a String
I have two code examples that I wrote for best practices encrypting a string that I'm looking for feedback both in terms of best practices and security. They are both using authenticated encryption. ...
36
votes
4
answers
1k
views
Memory with a twist
Description
This is the good old game Memory with a twist: Every time you pick a wrong pair, the two tiles you chose will switch their location. So sometimes you might think that a tile is at one ...
- 59.3k
30
votes
3
answers
17k
views
Sandbox or safely execute eval
In a large project of mine, I've run into a situation where a client might need to run evaluated JavaScript code. I know, it makes me cringe too. One option is to manually parse it, but for future ...
Senica Gonzalez
27
votes
6
answers
2k
views
Are there any open vulnerabilities in this mailer script?
I made a PHP mailer script does the basic validation of fields, return errors, else submit if all is good. But it also has a honeypot field that is not required to be filled in (I'm assuming by hiding ...
- 373
27
votes
3
answers
2k
views
How is my CMS design? Any security, design, or other issues?
I am trying to learn PHP in depth by creating this personal CMS. I try to utilize OOP concepts and do best I can...
The way I am trying to design this CMS is to keep including 'modules' within a page ...
- 811
27
votes
2
answers
7k
views
Custom session handler class - is it robust enough?
I've been working on this class for a while now and would appreciate some feedback, even if it's just nitpicking. I've added basic instructions on how to use the class below along with some questions.
...
- 490
21
votes
3
answers
550
views
Encryption functions based on mcrypt
I learned here that it is unsafe to design encryption algorithms from scratch. Given that advice, I made a pair of encryption functions based on mcrypt:
...
- 379
21
votes
2
answers
2k
views
Allowing users to input a safe subset of HTML
I am currently working on a project that requires users to input text that may or may not be formatted (if it helps, just think of it as a Stack Exchange clone, even though that's not quite accurate). ...
- 294
17
votes
3
answers
42k
views
Salt generation in C#
I have designed a small method to generate a salt for a password. All this does is create a random salt and does nothing to add it to the password. I have a few questions regarding my very simple ...
- 445
17
votes
3
answers
1k
views
Prepared statements from security viewpoint
I've decided to go with OOP style and prepared statements, and so far I like it a lot more than the procedural style. It's much more understandable in my opinion.
For this code review, I've just ...
- 908
17
votes
2
answers
16k
views
Secure password hashing
I have found a password hashing article and an implementation.
Is this code secure if I increase the salt to 64 bytes, hash key size to 128 bytes and the iterations to 10000? Are there ...
- 273
17
votes
2
answers
1k
views
Python-like C string library
Most of the C code I have written has never been seen by anybody else, and I wonder if my code follows normal practices, especially how my code performs security-wise. The code is for a library that I ...
- 173
16
votes
5
answers
3k
views
PHP mail form is being abused
I'm nowhere near a PHP expert, but I have dabbled a bit. I can make things work just fine, but I am terrible at figuring out what is wrong. I was informed by our server admin that we have a mail ...
- 163
16
votes
0
answers
867
views
Let's register that Django user
Short intro
So, I've been using Django for a while now and thought it would be nice to start a simple application. In an ideal World, each app must have a way of letting its users register and that's ...
- 9,176
15
votes
3
answers
310
views
Launching an interpreted script
I was just wondering if this is a good example, following good practices, of a C program for launching an interpreted script from a native binary executable. Here the interpreter is Perl and the ...
- 325
15
votes
3
answers
1k
views
15
votes
1
answer
389
views
Cryptographically-secure super-secret government message transaction machine
-Hello Agent. Are you on a secure line?
-Yes, secured.
-Good, in 30 seconds the launch codes will be in your e-mail's inbox.
You now have the go. Are you ready for the package?
-Yes.
...
- 5,737
15
votes
5
answers
4k
views
Constant-time string equality check
This is my attempt to answer my own equally named question on SO. In this case, I need a method comparing two strings so that the running time is input independent.
...
- 13.5k
15
votes
3
answers
72k
views
Encrypting a string using AES/CBC/PKCS5PADDING
The code below takes a String and encrypts it using AES/CBC/PKCS5PADDING as transformation. I am learning as I go and I have a few questions about my code.
Is <...
- 153
15
votes
1
answer
349
views
Security audit of open-source, RSA Blind Signature library
I've just published a small library implementing the RSA Blind Signature process.
Here's the GitHub repo!
I needed something portable, and easy enough to use that I could ask other people to ...
- 4,256
14
votes
5
answers
3k
views
Cryptographically Secure Password Generation in C
I am looking for ways to improve my password generation code written in C. This is in the same vein as my code in C++ and Python with many improvements.
I am using ...
- 3,770
14
votes
3
answers
8k
views
Basic user registration code
My first attempt at a user registration code.
Login.php defines database log in variables (e.g. Database name, Table name, etc)
...
- 163
14
votes
1
answer
1k
views
Typical password generator in Python
Password generators are extremely popular on CodeReview with beginners to both coding in general and Python in particular, for a number of reasons:
They're (seemingly) easy to implement
They offer an ...
14
votes
3
answers
6k
views
Constant time string comparision in PHP to prevent timing attacks
I've been advised that when checking the password hash for a user I should use a string comparison function that always takes the same amount of time, to avoid timing attacks.
So I wrote this:
...
- 368
13
votes
2
answers
1k
views
PHP mcrypt AES encryption wrapper
There are two keys: the main is aes128 and the second is XTEA, used just for randomization of data inside the AES. Randomization is done with secret random key that is not know even if someone knows ...
rsk82
13
votes
2
answers
10k
views
Sending an SMS message in C
Recently I've been fiddling with the idea of sending a text message using C. Looking at a few options, I thought that using libcurl to send an SMTP email using TLS for some security would be the best ...
- 21.8k
13
votes
1
answer
643
views
.NET 4.5 licensing subsystem using RSA-4096 strong name key, SHA256 signed XML, and assembly signature enforcing
Abstract
For the past week I have been looking at taking advantage of the .NET 4.5 improvements to code signing and XML signing to produce a licensing subsystem I can use to license my own products. ...
12
votes
2
answers
3k
views
Employing 3DES algorithm in Java
I am making a project just for fun that employs the 3DES algorithm in Java. I was wondering if my algorithm looks secure. Is there any advice or feedback you could give me? Do I need to include an IV? ...
- 131
12
votes
3
answers
804
views
Pretty way of keeping sensitive info out of a logged command string in Ruby?
I have a long command that I am building with shovels (<<), with the intention of eventually running system(command). I'd ...
- 221
12
votes
3
answers
10k
views
Python password manager
I am writing a python password manager, and I know there's a lot of scrutiny that goes into storing passwords (don't worry, mine aren't plaintext). I was hoping that this community could help me ...
- 273
12
votes
3
answers
1k
views
Security issues in a SQL query and possible function?
By adding more and more features to my websites, I am now up to 7 different hard coded queries.
I have read a lot about SQL injections and possible flaws and security issues, and wanted to make sure ...
- 263
12
votes
2
answers
863
views
Password hashing method
I am having some issue to use PHP5 password_hash() function. My server is not supporting it, so I am using a function to hash. Is this one secure?
...
- 123
12
votes
3
answers
713
views
Secured registration script
I created code for my registration form on my social network. I want to know if it is secured enough to release on the web as a public social network. Also, all of the code works. I just want to make ...
- 121
12
votes
2
answers
1k
views
Is this safe against major XSS attacks?
I am building a classifieds website here in Portugal, and I'm now in the security phase. So until now, I already made what I think is a good measure against SQL injection:
...
- 123
12
votes
3
answers
4k
views
PHP PDO Database Abstraction Layer
I'd like to get some feedback on a PHP Database Abstraction Layer I've created. It's a little long, but there really wasn't a way to just post part of it. Here is the base ...
- 245
12
votes
2
answers
1k
views
'find' template for handling any file
After growing tired of all the ways in which a file loop can be broken (find -print | while read) or unreadable (find -exec with ...
- 8,917
12
votes
1
answer
2k
views
PHP form with bot deterrent
I saw somewhere on here that it helps reduce spam by adding a dummy input field that you hide with display: none, and like if it's filled out, then it's obviously a ...
- 908
12
votes
2
answers
3k
views
Bob Marley is jamming on the wifi
Bob is jamming it's way through the city deauthenticating people from thier wifi for a few seconds. First scanning all possible wifi-AP and then pretty printing them, afterwards you can choose a wifi ...
- 11.6k
12
votes
2
answers
18k
views
IIdentity and IPrincipal Interfaces
I've always seen the IPrincipal and IIdentity interfaces separately, but I haven't seen any compelling reason for it, so I have ...
- 223
12
votes
1
answer
4k
views
Fluent API of a Role based access control implementation
I am trying to provide a fluent API for authorization based on roles.
As you will see I separated my implementation in two related Interfaces the Session and the Query. The session provides all roles, ...
- 5,566
12
votes
1
answer
291
views
Safe dynamic SQL for generic search
Prompted by discussion about SQL injection, I wanted to put a proof of concept forward to get feedback about whether this is in fact safe and protected against SQL injection or other malicious use. ...
- 2,029
12
votes
1
answer
21k
views
Secure way to store and load password in app config
I am trying to figure out a good way to store and load a password in the application configuration of my C# application.
To achieve this I use the BouncyCastle library and the DPAPI from Windows.
To ...
- 378
11
votes
5
answers
8k
views
Generating a password to save to a .txt file
Here is my basic password generator which saves your password to a .txt file which you can choose the name of etc.
...
- 231
11
votes
2
answers
409
views
Is this a sufficient way to prevent script injections and other bad stuff in strings
Would this function be sufficient enough to remove all malicious code and foreign characters from a string?
...
- 213
11
votes
4
answers
768
views
Markdown static blogger program
I was hoping I might get some of the brains in Stack Overflow to take a look at my Python static blogger application. I've been using it a few years in a pretty hacked up form. Lately I decided to ...
- 309
11
votes
4
answers
17k
views
Encrypt a byte array
This code is a Frankenstein. I found ten examples done in ten different ways and my requirements were slightly different so even if they were reliable they weren't a copy and paste solution.
Encrypt ...
- 371
11
votes
3
answers
10k
views
Symmetrical encryption in C#
I'm trying to symmetrically encrypt some data using C#, and there seems to be a lot of misleading or incorrect information out there on the subject.
I created a project on GitHub to act as some sort ...
- 231
11
votes
2
answers
25k
views
User Password Encryption in C#
I am maintaining an old codebase of one of our legacy .Net applications which has a component that encrypts and decrypts user passwords using symmetric key cryptography. Since cryptography is not my ...
- 213
11
votes
2
answers
10k
views
Logging into WebAPI 2 site from c# desktop application
I'm trying to login into a webapi2 site from a desktop application. After a lot of googling, I cobbled together a working prototype. Since we are talking about security I wanted to do a peer review. ...
- 211