25
votes
Accepted
Custom algorithm for hashing and un-hashing password
First of all, what you have is an encryption function, not a hashing function (encryption can be reversed by knowing the algorithm and optionally a password, hashing is one way).
For passwords, you ...
- 25.1k
19
votes
Accepted
Python password manager
Some general tips:
The runner should use argparse to parse arguments. It most definitely should not hardcode passwords.
(object) is redundant in Python 3 class ...
- 8,887
18
votes
Accepted
Employing 3DES algorithm in Java
It's kind of secure, but it uses older algorithms.
Although Benjamin correctly identifies 3DES, I would not call 3 key triple DES "broken". It still delivers a security of about 112 bits which nobody ...
- 4,748
15
votes
Accepted
PHP login based on a password parameter
This is not secure at all.
Apart from the GET issue (use POST) and the hashing issue (use bcrypt) already mentioned, and the ...
- 25.1k
15
votes
Accepted
Checking that a password contains a '$', a digit, and an uppercase letter
Design
So the point of this program is to check a password, right? There are many problems with your approach to verifying a password. To list a few:
Password could be brute-forced in a matter of ...
- 21.8k
15
votes
Accepted
Cryptographically Secure Password Generation in C
Overall, this is pretty well written. It's very easy to read and understand. I especially like that you annotated the usage() function with ...
- 11.6k
13
votes
Custom algorithm for hashing and un-hashing password
Since this topic has come up more than once on Security SE, this answer is heavily based upon the answers there.
The wrong way
The number one rule of secure cryptograpy has to be: don't roll your ...
- 233
13
votes
Employing 3DES algorithm in Java
No, it's not secure.
Your code is using Random instead of SecureRandom, which limits the entropy of the salt to 48 bits.
In ...
- 21.2k
12
votes
Accepted
Preventing XSS attacks in a Spring MVC application controller
Don't use RegEx to prevent XSS attacks!
Why?
Regex is not a tool that can be used to correctly parse HTML.
There are much better ways to prevent XSS attacks.
An example, using your code, modified ...
- 20.4k
12
votes
Accepted
Avoiding shell injection when calling Git in Python
Your defense strategy is known as "enumerating badness". As a rule, any strategy based on enumerating badness is doomed to fail. For example, you prohibit rm -rf /...
- 144k
12
votes
Secured registration script
Correctness
Also, all of the code works.
No, it doesn't, so let's start with that.
...
- 24.1k
12
votes
Securing my password wallet
Avoid calling system()
If possible, avoid calling system(). There are almost always issues doing this:
It is slow: ...
- 50.4k
12
votes
Banking System console app in C++
Please Provide Complete Code
This sample doesn’t compile, because "hashpassword.h" is missing (and seems to rely on an external ...
- 6,341
11
votes
Converting a SecureString to a byte array
Although you have done a decent job, you could do this in a better way, without even to use unsafe.
First thing to mention, you should always use braces ...
- 50.3k
11
votes
Accepted
Banking System console app in C++
Preface: Code reviews can happen on different levels. Others have already pointed out many of the issues regarding potential bugs, syntax, stylistic choices and idiomatic use of the language. This ...
- 226
10
votes
Simple password generator
Your CharacterSet method could be more performant! Let's work on this first.
Using String to keep characters to include and ...
- 12.4k
10
votes
Accepted
Selective password generator in C++ and Python
In both languages:
Why does your syms contain '%' twice and not contain an escaped '\\' at ...
- 19.3k
10
votes
Accepted
Bob Marley is jamming on the wifi
Nothing would make a reviewer happier than help you jam the networks of an innocent neighborhood. (sarcasm)
Mutually exclusive conditions
Can line match ...
- 111k
10
votes
Accepted
Securing my password wallet
There's quite a few beginner problems here:
using namespace std;
This is a really bad idea. It means we no longer have any control over the names in the global ...
- 72k
10
votes
Saving form data to a text file on server
All I can do is repeat what I already told you on StackOverflow: this code is crippling the data and stores a fake IP address.
The main problem with your code is that you don't understand what does it ...
- 8,315
9
votes
PHP login based on a password parameter
Checking passwords / sending passwords via $_GET (in URL) as a absolutely nogo. You have to send that credentials via $_POST, ...
- 201
9
votes
Simple login page
✔ Binding parameters
You're using a database API and successfully binding your parameters. This will prevent SQL injection.
✘ No character white-lists
Since you're outputting user input (ie: ...
- 336
9
votes
Encrypt a byte array
Standard disclaimer: in a production setting it is overwhelmingly better to use somebody else's crypto.
I don't have the expertise to certify "Yes, this is secure" (and as I'm some randomer online, ...
- 5,966
9
votes
Accepted
Reading source code and extracting json from a url
The Security
The main point here is your assumption that HTTP_REFERER could prevent someone from using this code. Unfortunately it doesn't. Referrer, just like any other HTTP header, is easily faked, ...
- 8,315
9
votes
8
votes
Custom algorithm for hashing and un-hashing password
Hashing functions usually are not one-to-one so they are not invertable. What you have is a simple substitution cipher. You are correct that it is not secure, you can see this for yourself by ...
8
votes
Securing a file encryption(ECIES) protocol using Scrypt + Inferno
The biggest issues I see are some conformity/readability issues.
For example, the following if/else structure:
...
- 20.1k
8
votes
Accepted
Secure client-side encryption of user content
First the good news
Your code looks clean
Your methods are mostly short ones
You are mostly disposing disposable objects by using the using statement
You name your ...
- 50.3k
8
votes
Accepted
Bash script to temporarily run a shell without certain group memberships
It's not an error to ask for help
When -h is passed, the help() function shouldn't exit with non-zero status, because it's done ...
- 72k
8
votes
Accepted
Dynamically loading CSS files based on URL or URI in PHP
Most of questions you are asking are not fit for this site and your code does not work as intended but this is an interesting case to review
The grave mistake
Adding anything to your code just in case ...
- 8,315
Only top scored, non community-wiki answers of a minimum length are eligible