Ok, I have some questions from a non-security perspective which maybe some of you can shed some light on since it's the first time I'm attempting anything like that.
My plan is to allow the user to upload files which will be stored on the file system. Some sort of metadata like the uploaded files name, hash value etc in a database to make searching efficient. Is this the accepted/most efficient way of going about it?
@Gilles Well, it's more of a "don't allow users to upload arbitrary malicious scripts that can be executed" sort of thing. I'm ignoring any bugs in the application in my assumptions. I'll work to keep bugs to a minimum of course.
It's a school project so obviously won't be used in any production settings.
to avoid accidental execution, it may be a good idea to systematically rename the files to a random alphanumeric string, and store the association between the uploader-chosen name and the actual file name in a database
@lynks But let's say he didn't use a random salt (or generate a random string for the uploaded file name). Wouldn't I be able to know the name of my executable file on the server?
@Adnan Point of interest. Nessus stores it's scan results as a series of 4 files. The results in their xml v1 schema, results in xml v2 schema, a file containing the scan name, and some file that I don't know what it does. The difference between them is file extension and each one is a shitload of hex characters. I don't know how it's generated.
@lynks not necessarily, it can be useful in a belt-and-braces sense, but if the attacker can request a directory listing, something is already wrong somewhere
The main problem with a storage handle (that's what the filename is) derived from the file name is that it doesn't allow file name collisions, so you can tell whether someone else uploaded a file by a certain name
if each user has their own storage directory, that's not a problem
@lynks ok, but then what's the benefit of hashing? So as to make a directory listing impossible? That seems like a specialty requirement, undesirable in most cases
@Gilles I have implemented it both ways in the past, sometimes hashing to get a uniform length name appeals to my neatness obsession. It also means I dont have to worry about using the stored name in sql or similar.
@Gilles but as I say I have used <original_file_name> + <random_nonce> in the past also.
(I did search on this topic, but I found no complete question/answer that addressed it, or even portions of questions that might be relevant.)
I'm implementing a salt function for user passwords on my web page, and I'm wondering about some things.
A salt is an extension added to a password and ...
We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example of allowing multiple access.
We have secured our web application similar to here.
Does allowing ...
@Adnan buddy i have seen your comment for rory's answer i have some queries on it friend
There are tree ways to handle this A- New sessions will invalidate the old ones. The attacker can override the user's session. B- Prevent a new login unless the user logs out out from the last session. "Oh, I logged in from home last night, now I cannot use the website on my mobile. C- Killing the session after some time. "Remember me" option doesn't make sense anymore. I believe in this matter the default should be allow, unless your service doesn't need multiple login (like a bank).
@D3C4FF That's the whole idea. There are many fruits and vegetables that aren't made into wine, and I really like making wines that aren't usually made (not hipsterish).
The scenario: coworker's Skype somehow lost his auto-fill password. He doesn't remember it anymore, and the account is hooked up to an email address that no longer exists. He's never purchased any credits so he can't use a CC to verify his account to customer service.
I know that Skype should ha...
Maybe its just the cider. Maybe its the fact that its well past my bedtime. Or maybe its the several coffee's i've had today keeping me awake. But this is pretty lulzy
@Polynomial Especially the girls, they reach 20 in about 14 years, then they stop there for 10-15 years, then suddenly they're 35, and they stop there for 10 more years.
TL;DR - You can store the salt in plaintext without any form of obfuscation or encryption, but don't just give it out to anyone who wants it.
The reason we use salts is to stop precomputation attacks, such as rainbow tables. These attacks involve creating a database of hashes and their plainte...
Write the shortest program that prints the entire lyrics of "Never Gonna Give You Up" by Rick Astley.
Rules:
Must output the lyrics exactly as they appear in the above pastebin. Here's the raw dump: http://pastebin.com/raw.php?i=wwvdjvEj
Cannot rely on any external resources - all lyrics must ...
@vignesh - you may wish to take a deeper review of the transcript to see what sort of behaviours are commonly accepted. Different cultures can take things in very different ways.
@RoryAlsop not sure that will be explicit enough....
btw @RoryAlsop @Jefff - if you've seen the flags - I am of two minds regarding that user (its the same one). All his answers are borderline, obviously attempts at self-marketing (he is a vendor, of PCI consulting I think). But so far nothing really blatant, still within bounds. Barely.
@AviD Nemesis? I can't argue with that because I'll only end up proving your point, won't I?! Nice, now all I can say is that you're one lovely lad, you leave me no other option :P
(I did search on this topic, but I found no complete question/answer that addressed it, or even portions of questions that might be relevant.)
I'm implementing a salt function for user passwords on my web page, and I'm wondering about some things.
A salt is an extension added to a password and ...
We are currently developing a web application. The developers have allowed multiple login. e.g an user can log-in to multiple computers at the same time. They are quoting Gmail account as an example of allowing multiple access.
We have secured our web application similar to here.
Does allowing ...
