security | 易学教程

How to dynamically generate secret tokens in Rails 4.1 with secrets.yml?

阅读更多关于 How to dynamically generate secret tokens in Rails 4.1 with secrets.yml?

问题 New to rails. Followed Hartl's tutorial where he uses this code to dynamically generate secret token for config/initializers/secret_token.rb require 'securerandom' def secure_token token_file = Rails.root.join('.secret') if File.exist?(token_file) # Use the existing token. File.read(token_file).chomp else # Generate a new token and store it in token_file. token = SecureRandom.hex(64) File.write(token_file, token) token end end SampleApp::Application.config.secret_key_base = secure_token I'm

Lisp data security/validation

阅读更多关于 Lisp data security/validation

问题 This is really just a conceptual question for me at this point. In Lisp, programs are data and data are programs. The REPL does exactly that - reads and then evaluates. So how does one go about getting input from the user in a secure way? Obviously it's possible - I mean viaweb - now Yahoo!Stores is pretty secure, so how is it done? 回答1: The REPL stands for Read Eval Print Loop. (loop (print (eval (read)))) Above is only conceptual, the real REPL code is much more complicated (with error

How can I generate a “private URL” with state of the art balance between security and convenience?

阅读更多关于 How can I generate a “private URL” with state of the art balance between security and convenience?

问题 Where can I find a well-written, in-depth technical discussion about "private URLs" like the ones used in Google Docs' "anyone with the link" sharing setting? I'm looking for topics like the algorithm and implementation for generating a link, the size of the ID space it uses, analysis of the security implications, and pragmatic compromises in security for convenience. I want to avoid reading dogma about "security through obscurity". I found one loosely related Stack Overflow question, but it

Creation of XSS vulnerable web page

阅读更多关于 Creation of XSS vulnerable web page

问题 I want to create a XSS vulnerable web page which execute script entered in input box. Here I have written this code but whenever I enter script nothing happens. <html> <head> </head> <body> <script type="text/javascript"> function changeThis(){ var formInput = document.getElementById('theInput').value; document.getElementById('newText').innerHTML = formInput; localStorage.setItem("name","Hello world!!!"); } </script> <p>You wrote: <span id='newText'></span> </p> <input type='text' id=

Put SecureString into PasswordBox

阅读更多关于 Put SecureString into PasswordBox

问题 I have an existing SecureString that I would like to put into a PasswordBox without revealing the .Password . Can this be done? For example: tbPassword.SecurePassword = DecryptString(Properties.Settings.Default.proxyPassword); In this case DecryptString produces a SecureString. However, SecurePassword is a read-only property so I can't assign a value to it. 回答1: You can't. However, what you can do is put placeholder text in it's place (it can even be "placeholder" , we are only using it to

Is Ruby's seed for OpenSSL::Random sufficient?

阅读更多关于 Is Ruby's seed for OpenSSL::Random sufficient?

问题 I know very little about Ruby, so please forgive me if the answer to this is obvious. I noticed at http://www.ruby-doc.org/stdlib-1.9.3/libdoc/securerandom/rdoc/SecureRandom.html that Ruby uses the pid and the current time to seed OpenSSL::Random when a call to random_bytes is made. Unless something else happens under the covers, isn't this pretty much the seed that Netscape used in their initial SSL implementation in the mid 90s? http://en.wikipedia.org/wiki/Random_number_generator_attack

Java Decryption - Input length must be multiple of 8 when decrypting with padded cipher

阅读更多关于 Java Decryption - Input length must be multiple of 8 when decrypting with padded cipher

问题 I have a project for a security course but i'm having an issue. basically , i'm trying to encrypt then decrypt a password but i'm getting this error for the decryption . "Input length must be multiple of 8 when decrypting with padded cipher" Am i doing this the right way . I was following an article from 2012 . Is it still secure ? Also i tried replacing the algorithm but nothing seems to work : "AES" , "RSA/ECB/PKCS1Padding" , "PBEWithHmacSHA256AndDESede"..and many more i get : Exception in

Java Decryption - Input length must be multiple of 8 when decrypting with padded cipher

阅读更多关于 Java Decryption - Input length must be multiple of 8 when decrypting with padded cipher

AWS small setup, secured public access idea.. do away with NAT gateway

阅读更多关于 AWS small setup, secured public access idea.. do away with NAT gateway

问题 Seeking review, comments, point out issues, link to available tested, better solution… This idea is to provide secure remote access into EC2 instances and allow backend instances to reach internet when required for update, install packages, etc. I just started to pickup AWS on my own and had no prior experience with AWS. I learned the method to secure remote access (like SSH) is to restrict the SSH source IP, create jump/bastion hosts, then internet access for backend/private subnet would be

Password Management for non-interactive process

阅读更多关于 Password Management for non-interactive process

问题 The challenge I need a password management tool that will be invoked by other processes (scripts of all sort: python, php, perl, etc) and it will be able to identify and verify the caller script in order to perform access control: either return a password back or exit -1 The current implementation After looking into various frameworks, I have decided to use python 's keepassdb which is able to handle Keepass V1.X backend database files and build my own access control overlay (since this can