Click here to Skip to main content
15,888,062 members
Home / Discussions / Web Development
   

Web Development

 
QuestionIIS 5.0 to IIS 6.0 Upgrade Pin
No-e28-Feb-07 4:18
No-e28-Feb-07 4:18 
AnswerRe: IIS 5.0 to IIS 6.0 Upgrade Pin
Vasudevan Deepak Kumar28-Feb-07 12:32
Vasudevan Deepak Kumar28-Feb-07 12:32 
AnswerRe: IIS 5.0 to IIS 6.0 Upgrade Pin
Guffa28-Feb-07 21:18
Guffa28-Feb-07 21:18 
QuestionInserting a new row. Pin
nclauder28-Feb-07 4:08
nclauder28-Feb-07 4:08 
QuestionWebpage with Zoom, and Rotate functionality Pin
swjam28-Feb-07 3:07
swjam28-Feb-07 3:07 
AnswerRe: Webpage with Zoom, and Rotate functionality Pin
Vasudevan Deepak Kumar28-Feb-07 12:33
Vasudevan Deepak Kumar28-Feb-07 12:33 
AnswerRe: Webpage with Zoom, and Rotate functionality Pin
badgrs1-Mar-07 0:32
badgrs1-Mar-07 0:32 
QuestionEnsuring Database Security Pin
Meysam Mahfouzi28-Feb-07 2:28
Meysam Mahfouzi28-Feb-07 2:28 
Hi Most of us as web developers know how to hash user passwords within our database in order to prevent hackers from abusing stolen passwords in case they are stored in a plain text format. But I personally haven't seen any thing as a best practice (something standard recommended to all developers) to protect our sensitive data from being stolen.

As an example of a situation where we might want to encrypt some of our database fields, consider a shopping site which sells all its products through custom credit cards designed and delivered by your company whose information (including amount of each card's credit) have been stored on a database. Now, as the owner of such database, I'm mostly obsessed with these concerns when it comes to data encryption in database:

1- Which of the symmetric encryption algorithms is faster or recommended for encrypting "credit" field?

2- Where do you store your encryption key? in source code? What if your source is stolen too? Is it sensible to rely on this fact that nobody can access our compiled .net assemblies on the server and hence storing the key there?

3- How do you detect a new record that hasn't been inserted to database by your application but by a hacker?

* These are my main approaches concerning above issues:

1- In order to prevent passwords from being seen: I'll hash them with a salt

2- I order to prevent a hacker from modifying the amount of a card: I will hash and store the credit amount using a salt (e.g. Hash("34$"+salt)), and I'll also store the encrypted value of the credit amount (e.g. Encrypt("34$"+password)). Now, whenever I see that the hashed credit value of a record doesn't match the previously hashed value, I'll restore the credit amount from where I've already encrypted it.

3- In order to prevent a hacker from inserting his own credit card into database: I'll assign a unique ID field to each card, which has been generated based on a rule (like a serial number). So, the hacker won't know how to generate new valid card IDs unless he accesses my code and knows the rule.

The last concern: Checking all the constraints mentioned above, doesn't it hit the performance considerably? If so, what should we do then?!!! Confused | :confused:

Any helping ideas are most welcome and greatly appreciated! Smile | :)
AnswerRe: Ensuring Database Security Pin
Bradml1-Mar-07 0:06
Bradml1-Mar-07 0:06 
GeneralRe: Ensuring Database Security Pin
Meysam Mahfouzi1-Mar-07 9:28
Meysam Mahfouzi1-Mar-07 9:28 
GeneralRe: Ensuring Database Security Pin
Bradml3-Mar-07 15:54
Bradml3-Mar-07 15:54 
QuestionRegular Expression Pin
248912828-Feb-07 2:12
248912828-Feb-07 2:12 
AnswerRe: Regular Expression for validating password strength Pin
andyharman28-Feb-07 6:16
professionalandyharman28-Feb-07 6:16 
QuestionWebconfig Ajax Pin
AnhTin27-Feb-07 21:12
AnhTin27-Feb-07 21:12 
AnswerRe: Webconfig Ajax Pin
badgrs27-Feb-07 22:43
badgrs27-Feb-07 22:43 
QuestionAJAX web app - ScriptResource-Handler failes to load js resources Pin
civilwar27-Feb-07 20:40
civilwar27-Feb-07 20:40 
QuestionHow should we design the programe if we like to add up more detail ? Pin
sdev27-Feb-07 19:41
sdev27-Feb-07 19:41 
AnswerRe: How should we design the programe if we like to add up more detail ? Pin
Paddy Boyd27-Feb-07 23:54
Paddy Boyd27-Feb-07 23:54 
GeneralRe: How should we design the programe if we like to add up more detail ? Pin
sdev28-Feb-07 6:32
sdev28-Feb-07 6:32 
GeneralRe: How should we design the programe if we like to add up more detail ? Pin
sdev28-Feb-07 6:37
sdev28-Feb-07 6:37 
QuestionCookies Pin
Sachin Pimpale27-Feb-07 19:36
Sachin Pimpale27-Feb-07 19:36 
AnswerRe: Cookies Pin
Michael Sync27-Feb-07 20:11
Michael Sync27-Feb-07 20:11 
AnswerRe: Cookies Pin
Vasudevan Deepak Kumar28-Feb-07 12:34
Vasudevan Deepak Kumar28-Feb-07 12:34 
QuestionRemove Event onMouseOver on ImageHtml [modified] Pin
AnhTin27-Feb-07 16:07
AnhTin27-Feb-07 16:07 
AnswerRe: Remove Event onMouseOver on ImageHtml Pin
Michael Sync27-Feb-07 19:38
Michael Sync27-Feb-07 19:38 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.