Collaborate Disseminate
I’m using EST protocol for enrolling new certificates.
And I was thinking how I, as an application, should validate a certificate issued by that CA or EST server before storing and using it.
should I validate the signature of the returned… Continue reading Validate a newly issued certificate
According to the OIDC specification:
The issuer value returned MUST be identical to the Issuer URL that was
used as the prefix to /.well-known/openid-configuration to retrieve
the configuration information. This MUST also be identical to … Continue reading What are the risks of disabling issuer URL validation?
I am currently employed at a financing company operating in both the USA and Canada. My current task involves exploring alternative methods to validate new credit applications.
Presently, we rely on a one-time SMS message for our new custo… Continue reading Application Validation Methods [closed]
I am currently employed at a financing company operating in both the USA and Canada. My current task involves exploring alternative methods to validate new credit applications.
Presently, we rely on a one-time SMS message for our new custo… Continue reading Application Validation Methods [closed]
How can I know whether a program is genuine? The ways I have thought of are checking what the user base has said and knowing the author background. Occasionally my antivirus will flag a webpage as suspicious. Am I on the right lines?
… Continue reading How to know whether a program is genuine? [closed]
I’m doing some research on user invite links (tokens) and if we could use a longer expiration period. I am aware that having a shorter expiration period is good security practice. Currently, user invite links are sent and the user has a co… Continue reading user invite links (tokens) alternate to longer expiry period [closed]
I came across this scenario in the workplace and we don’t have great policies. I’m not the one creating the policies either but can have some influence over implementing them.
We are consistently getting more bugs than we anticipate and i… Continue reading Responsibility and resource allocation for defects or bugs [migrated]
We’re trying to secure our upload forms in PHP regarding image uploads and PDF files. For this purpose, we’re currently trying to do the following in all cases, according to our research done so far:
Check MIME type
Check file size
Scan c… Continue reading Validate File Uploads in PHP: PDFs and images
Hypothetically, I’d like to demonstrate that I am the owner of a piece of published information. The requirements are the following.
The hash/ characteristic string is compact enough (ideally a few bytes, say 16 or 32.)
It does not expose… Continue reading What’s the shortest message you need to claim ownership of another message?
For example, if an antivirus gives no alert for a couple of months, how do you confirm if the antivirus is working to prevent viruses, and not just hung?