25 votes
Accepted

Custom algorithm for hashing and un-hashing password

First of all, what you have is an encryption function, not a hashing function (encryption can be reversed by knowing the algorithm and optionally a password, hashing is one way). For passwords, you ...
tim's user avatar
  • 25.1k
19 votes
Accepted

Python password manager

Some general tips: The runner should use argparse to parse arguments. It most definitely should not hardcode passwords. (object) is redundant in Python 3 class ...
l0b0's user avatar
  • 8,907
18 votes
Accepted

Employing 3DES algorithm in Java

It's kind of secure, but it uses older algorithms. Although Benjamin correctly identifies 3DES, I would not call 3 key triple DES "broken". It still delivers a security of about 112 bits which nobody ...
Maarten Bodewes's user avatar
15 votes
Accepted

Checking that a password contains a '$', a digit, and an uppercase letter

Design So the point of this program is to check a password, right? There are many problems with your approach to verifying a password. To list a few: Password could be brute-forced in a matter of ...
syb0rg's user avatar
  • 21.8k
15 votes
Accepted

Cryptographically Secure Password Generation in C

Overall, this is pretty well written. It's very easy to read and understand. I especially like that you annotated the usage() function with ...
user1118321's user avatar
  • 11.7k
13 votes

Custom algorithm for hashing and un-hashing password

Since this topic has come up more than once on Security SE, this answer is heavily based upon the answers there. The wrong way The number one rule of secure cryptograpy has to be: don't roll your ...
user2428118's user avatar
13 votes

Employing 3DES algorithm in Java

No, it's not secure. Your code is using Random instead of SecureRandom, which limits the entropy of the salt to 48 bits. In ...
Roland Illig's user avatar
  • 21.3k
12 votes
Accepted

Avoiding shell injection when calling Git in Python

Your defense strategy is known as "enumerating badness". As a rule, any strategy based on enumerating badness is doomed to fail. For example, you prohibit rm -rf /...
200_success's user avatar
12 votes

Secured registration script

Correctness Also, all of the code works. No, it doesn't, so let's start with that. ...
Peter Taylor's user avatar
  • 24.1k
12 votes

Securing my password wallet

Avoid calling system() If possible, avoid calling system(). There are almost always issues doing this: It is slow: ...
G. Sliepen's user avatar
12 votes

Banking System console app in C++

Please Provide Complete Code This sample doesn’t compile, because "hashpassword.h" is missing (and seems to rely on an external ...
Davislor's user avatar
  • 6,666
11 votes
Accepted

Banking System console app in C++

Preface: Code reviews can happen on different levels. Others have already pointed out many of the issues regarding potential bugs, syntax, stylistic choices and idiomatic use of the language. This ...
Simon Lehmann's user avatar
10 votes
Accepted

Selective password generator in C++ and Python

In both languages: Why does your syms contain '%' twice and not contain an escaped '\\' at ...
Quuxplusone's user avatar
  • 19.3k
10 votes
Accepted

Bob Marley is jamming on the wifi

Nothing would make a reviewer happier than help you jam the networks of an innocent neighborhood. (sarcasm) Mutually exclusive conditions Can line match ...
janos's user avatar
  • 111k
10 votes
Accepted

Securing my password wallet

There's quite a few beginner problems here: using namespace std; This is a really bad idea. It means we no longer have any control over the names in the global ...
Toby Speight's user avatar
  • 74.4k
10 votes

Saving form data to a text file on server

All I can do is repeat what I already told you on StackOverflow: this code is crippling the data and stores a fake IP address. The main problem with your code is that you don't understand what does it ...
Your Common Sense's user avatar
9 votes

Simple login page

✔ Binding parameters You're using a database API and successfully binding your parameters. This will prevent SQL injection. ✘ No character white-lists Since you're outputting user input (ie: ...
ʰᵈˑ's user avatar
  • 336
9 votes

Encrypt a byte array

Standard disclaimer: in a production setting it is overwhelmingly better to use somebody else's crypto. I don't have the expertise to certify "Yes, this is secure" (and as I'm some randomer online, ...
Josiah's user avatar
  • 5,976
9 votes
Accepted

Reading source code and extracting json from a url

The Security The main point here is your assumption that HTTP_REFERER could prevent someone from using this code. Unfortunately it doesn't. Referrer, just like any other HTTP header, is easily faked, ...
Your Common Sense's user avatar
9 votes

Password maker in C#

Fully Refactored Code: see this Gist Example Usage: ...
Kittoes0124's user avatar
  • 1,940
8 votes

Custom algorithm for hashing and un-hashing password

Hashing functions usually are not one-to-one so they are not invertable. What you have is a simple substitution cipher. You are correct that it is not secure, you can see this for yourself by ...
Josh Famestad's user avatar
8 votes

Securing a file encryption(ECIES) protocol using Scrypt + Inferno

The biggest issues I see are some conformity/readability issues. For example, the following if/else structure: ...
Der Kommissar's user avatar
8 votes
Accepted

Secure client-side encryption of user content

First the good news Your code looks clean Your methods are mostly short ones You are mostly disposing disposable objects by using the using statement You name your ...
Heslacher's user avatar
  • 50.4k
8 votes
Accepted

Bash script to temporarily run a shell without certain group memberships

It's not an error to ask for help When -h is passed, the help() function shouldn't exit with non-zero status, because it's done ...
Toby Speight's user avatar
  • 74.4k
8 votes
Accepted

Dynamically loading CSS files based on URL or URI in PHP

Most of questions you are asking are not fit for this site and your code does not work as intended but this is an interesting case to review The grave mistake Adding anything to your code just in case ...
Your Common Sense's user avatar
8 votes
Accepted

Python/Flask Password Manager

Disclaimer: I haven't done authentication in Flask before. Tl;dr: Don't do authentication yourself, it's VERY hard to do right (and using a global ain't right); also, separate the user's ...
scnerd's user avatar
  • 2,020
7 votes

Inserting a record into MySQL with a timestamp

Security SQL Injection It's probably[*] secure, but it's not the right way to do it, see for example here why prepared statements are better than escaping. Sooner or later, you will mess up when ...
tim's user avatar
  • 25.1k
7 votes

Secured registration script

Your code is secure but hard to read, unclear and inconsistent. Poor Scarlett O'Hara will be saved in the database as ...
Your Common Sense's user avatar
7 votes

Cryptographically Secure Password Generation in C

You should always use braces around if statements, making it easier to add statements later if necessary. Failure to do this caused Apple's goto fail security vulnerability. apparently not (thanks ...
rlee827's user avatar
  • 313

Only top scored, non community-wiki answers of a minimum length are eligible