14 questions from the last 30 days
-1
votes
0
answers
38
views
How to securely store the license key based purchases?
I am trying to implement license key logic in my app where users can enter the license key they bought from stripe or any payment provider and than, the entered license key would need to first ...
- 513
Best practices
1
vote
3
replies
68
views
Should I change RSA algorithm to some more modern algorithm or just stay on RSA but use larger key length?
I tried use 6144 bits RSA key, but this has been taking so much time as around of 5 - 7 seconds to generate key pair, I think it's too long. On the other side, using keys with less length may become ...
- 43
0
votes
0
answers
47
views
Java Apple KeyStore or SSL TrustManager which trusts certificates from both admin and root keychains
Running security dump-trust-settings -d on my MacBook shows some company-specific certificates that I want Java's TrustManager to trust when creating SSL/TLS connections to internal company servers. I ...
- 435
Advice
1
vote
0
replies
53
views
BIOS/UEFI guided security examples
I am looking for simple examples which show a step-by-step guide on, for example, purposefully installing rootkits or other firmware-related malware in order to show how they work and their effects. I ...
- 11
Best practices
0
votes
0
replies
43
views
What is the Best Approach to both Authenticate and Persist Authentication for Federated Systems?
For this setup, let's assume that here are no libraries to use (public/private/paid or otherwise) and so this task has to be completed without them. Also, let's assume that all communication between ...
- 43
Best practices
1
vote
0
replies
97
views
How to securely build Docker images in GitHub Actions on Kubernetes runners (no privileged mode / no DinD)?
I'm setting up a secure CI/CD pipeline using GitHub Actions with self-hosted runners running in Kubernetes, and I want to build Docker images and push them to AWS ECR securely.
Goals
Build Docker ...
Advice
0
votes
1
replies
28
views
OAuth middleman API
I am having issue with our current login setup.
We have multiple types of clients (mobile, webapp, spa).
Our app has its own user managment a pretty old way to auth users (Each user recieve GUID and ...
- 58
1
vote
0
answers
84
views
Trying to setup a snowflake oath security integration but saml integration getting in the way?
So I'm currently trying to setup two different security integrations. My snowflake instance already has a SAML security integration setup for users, where they're logging into okta using sso, this ...
- 309
-1
votes
1
answer
77
views
How to detect or mitigate wall-clock time jumps when validating offline software licenses?
I’m implementing an offline license validation mechanism in a desktop/server application.
The license has an expiration date and must continue to work without any online checks.
The problem I’m facing ...
-3
votes
1
answer
120
views
How to make my TOTP generator work with other hashing algorithms (other than sha1)? [closed]
I'm having trouble making my Python code generate the correct TOTPs using the test secret key 12345678901234567890, the same one used in the RFC6238 appendix B examples. I was able to get the correct ...
Best practices
0
votes
2
replies
96
views
How to verify webhook signatures from multiple providers (Stripe, GitHub, Shopify, etc.) in Go?
I'm building a webhook handler that needs to accept webhooks from multiple providers (Stripe, GitHub, Shopify, Twilio, etc.). Each provider uses different signature verification methods:
- Stripe: ...
- 235
0
votes
1
answer
57
views
How to hide UI elements in a custom frontend based on Dataverse security roles when using MSAL authentication?
We are building a custom frontend application (SPA) that authenticates users against Microsoft Dataverse using MSAL and OAuth.
The UI should hide certain navigation items and actions, e.g. show the &...
- 21
Best practices
0
votes
1
replies
55
views
Is BFF actually more secure with Oauth for SPAs?
Some of the articles that I have seen lately imply that implementing a Back-end for Front End architecture is more secure for a SPA than a traditional setup as the tokens never leave the "...
- 101
Advice
1
vote
3
replies
63
views
CS degree project on computer networks
I am preparing a project for a computer networks course and I wanted to ask for advice. My teacher gave me this assignment for the exam: make an analysis on the vulnerabilities and attacks to protect ...
