I've not been able to find any solutions to this other than "monitor responses and match for patterns of fraud".  Let's say I make a client-side HTML/JS skill game, moving a butterfly net left and right to catch falling stars.  At the end of the game, the JS sends a request to the server, something like  {     "stars_collected":30,     "user_id":38194723,     "session_id":'dDhw83hDEknd83y727dhd' }   This is sent to   Nothing's stopping the client from just sending a fraudulent http request written by the end-user  {     "stars_collected":9999999999999,     "user_id":38194723,     "session_id":'dDhw83hDEknd83y727dhd' }   Now, obviously, the server side can mitigate some things such as always have a maximum obtainable number of stars etc.  My question is, can the data in the request be encoded/signed in some way so that the end-user can never actually see how the level_complete request is formulated?
123728
I'm talking about an action game with no upper score limit and no way to verify the score on the server by replaying moves etc.   What I really need is the strongest encryption possible in Flash/PHP, and a way to prevent people calling the PHP page other than through my Flash file. I have tried some simple methods in the past of making multiple calls for a single score and completing a checksum / fibonacci sequence etc, and also obfuscating the SWF with Amayeta SWF Encrypt, but they were all hacked eventually.  Thanks to StackOverflow responses I have now found some more info from Adobe -  and  - which I think I can use for the encryption. Not sure this will get me around CheatEngine though.  I need to know the best solutions for both AS2 and AS3, if they are different.  The main problems seem to be things like TamperData and LiveHTTP headers, but I understand there are more advanced hacking tools as well - like CheatEngine (thanks Mark Webster)
122136
I've called GoDaddy a few different times and they said that it looks like it is a problem with my HTML file.  Except, my HTML file is the basic outline of a webpage, nothing fancy at all.    Chrome still says that the webpage is, "Not Secure" with the big red x over it.    I'm not sure what to do to fix it, I don't have any personal information on the site nor am I collecting any information from visitors (it's sort of an information site).  I shouldn't need an SSL certificate because I am not hosting anything privately.
16294
Is it possible to detect, on the client side, whether the user is using an encrypted page or not?  Put another way -- I want to know if the URL of the current page starts with http or https.
79018
Is it possible to detect the HTTP request method (e.g. GET or POST) of a page from JavaScript?  If so, how?
112508
Say I'm connecting to a web server secured with TLS but with a self-signed certificate. Accordingly, I call the owners of the server and ask them what SHA1 fingerprint they have.  They start reading out the hex digits to me and I follow along, but before reaching the end, I just say "That's fine thanks, no need to read the rest." as I click the OK button.  How far along is the point where its reasonable to stop checking and still remain practically secure?
61142
With regards to user authentication...   The server sends Alice a randomly chosen number. Alice signs the number and sends the signature back to the server. The server checks the signature using Alice's public key. If it's valid, the server accepts her connection request.   Suppose that Alice uses the same private key to log in to the server and sign her emails. The authentication mechanism signs the bare challenge without hashing, while Alice signs the hash of the email message.   Apparently, the server can forge emails from Alice under this scheme? If so, how could this be prevented?
93678
I have a small but popular local website, it is a nonprofit venture. We arrange programming contest. But randomly in some contest our servers goes down. For example in last contest, we had around 300 users and we deployed 12 C4Large grade servers (when site went down, we increased server to tackle it) but still the site was down for 2 hours (even though after 1 hour most of the contestants left seeing the site not working). All our servers are accessed through AWS Load balancer and we use SSL in the load balancer level. I think due to using load balancer, IIS can't differentiate upcoming traffic by IP so i can't apply the IIS built in dynamic IP based restriction for such attack. Is there a way to do these from AWS?  Is this an issue of DDos/Dos attack on our server? We use the same server and same code but in some contest we face this issue but in some other we do not face this issue. But I do not know how to track this to be sure whether we are under DDos or not. What can we do to protect ourselves?  Thanks
9793
My web server periodically comes under attack, and I get a bunch of requests that look like  /my.page?union+all+select+0x31303235343830303536%2C0x31303235343830303536%2C0x31303235343830303536--  Are there simple command line tools to decode this?
28029
I use a basic Post to send data to a Django server.  The data consists of a base64 encoded 640*380 PNG image dynamically created by the flex component.  &lt;mx:HTTPService id="formSend" showBusyCursor="true"      useProxy="false" url="http://127.0.0.1/form/"      method="POST" result="formSentConfirmation(event)"    fault="formSendingFailed(event)"/&gt;    private function sendForm(url:String, message:String, meteo:Number):void {     formSend.url = url;     var params:Object = { message: message, image_data: getEncodedImage() };      snapButton.label = "sending ...";     formSend.send(params); }   On the server side i can see that the data is in the request.POST not in request.FILES. That means the image is not send as a File with multiencode HTTP.   Will i get into trouble on a real server ? since the limit is 200k for urlencoded POST var. How to make HTTPservice send the data as a file? Any other solutions?   Thanks
34760
A recent post on the Stack Overflow blog () states that the Stack Overflow team has implemented a voter fraud detection mechanism.  I look at the user board and noticed at least one user took a major hit as a result.  I'd like to know how it works.  No, not so that I can better circumvent it, but I'd just like to know that it is fair.
97435
I get HTTP errors for various resources, and no styles or scripts are applied, which effectively makes the whole site unusable.  Meta does seem to be working fine, though.  Edit: Here's a log from Firefox Console. The relevant requests appear to be returning 403 Forbidden.  [10:28:39.766] GET http://stackoverflow.com/questions/19269438/is-there-a-way-to-call-member-function-without-or-operator/19827813# [HTTP/1.1 200 OK 917ms] [10:28:40.929] GET http://ajax.googleapis.com/ajax/libs/jquery/1.7.1/jquery.min.js [HTTP/1.1 304 Not Modified 680ms] [10:28:40.932] GET http://cdn.sstatic.net/Js/stub.en.js?v=e3d47b73fa12 [HTTP/1.1 403 Forbidden 612ms] [10:28:40.935] GET http://cdn.sstatic.net/stackoverflow/all.css?v=87e1657c9db8 [HTTP/1.1 403 Forbidden 605ms] [10:28:41.401] GET http://cdn.sstatic.net/Js/stub.en.js?v=e3d47b73fa12 [HTTP/1.1 403 Forbidden 347ms] [10:28:41.753] GET http://cdn.sstatic.net/stackoverflow/all.css?v=87e1657c9db8 [HTTP/1.1 403 Forbidden 237ms]   Edit 2: It happened again. This time I screenshotted everything. The CAPTCHA actually does not appear to be the usual one with men dressed as robots. I had to scale the page down a bit drastically to fit onto one screenshot.        I'm posting this update a bit in the blind because the same error prevents those images from loading. Let me know if they weren't uploaded. Meta still shows no other symptoms.
53592
I'm planning on venturing on making a single player action rpg in js/html5, and I'd like to prevent cheating. I don't need 100% protection, since it's not going to be a multiplayer game, but I want some level of protection.   So what strategies you suggest beyond minify and obfuscation?  I wouldn't bother to make some server side simple checking, but I don't want to go the Diablo 3 path keeping all my game state changes on the server side.  Since it's going to be a rpg of sorts I came up with the idea of making a stats inspector that checks abrupt changes in their values, but I'm not sure how it consistent and trusty it can be.  What about variables and functions escopes? Working on smaller escopes whenever possible is safer, but it's worth the effort?  Is there anyway for the javascript to self inspect it's text, like in a checksum?   There are browser specific solutions? I wouldn't bother to restrain it for Chrome only in the early builds.
28914
Browser and mobile games commonly have global highscore tables. It's also common for those tables to contain scores of 2,147,483,647 &mdash; where people have figured out the webservice call that reports scores and used it to record a fictitious score.  For simple puzzle games, we can defend against this by including a record of every move the player made (and any random seeds used to generate the level) with the score-reporting call. The entire game can then be reproduced and verified on the server.  However, this quickly becomes infeasible for anything larger than Pac-man.  How else can cheating of this kind be prevented?
79005
edited my question,  where I specifically said that our software sending back stacktrace to one of our servers was a user-known public feature.  He then modified the title of my post, along with the entire content, making it sound like I snuck in the feature and that our application was phoning home without our users knowing.    I specifically wrote in the original post that the feature was not sneaky. He completely changed the meaning of my post. I find this to be rather unacceptable.  A few questions:   Is it possible to prevent editing of my posts? How can I retaliate? Can I file a complaint?   Can people with  do anything they want on Stack Overflow?
26888
I've seen a couple questions around here like , which mentions:     Unfortunately that same browser won't allow me to test HTTP PUT, DELETE, and to a certain degree even HTTP POST.   I've also heard that browsers support only GET and POST, from some other sources like:        However, a few quick tests in Firefox show that sending PUT and DELETE requests works as expected -- the XMLHttpRequest completes successfully, and the request shows up in the server logs with the right method. Is there some aspect to this I'm missing, such as cross-browser compatibility or non-obvious limitations?
95825
I've noticed that with the new question asking form, sometimes, attempting to submit a question will post two identical copies of the same question.  I've  (), but at the time, I assumed it was just a temporary fluke. As far as I remember, I just reviewed the question, saw no errors, and submitted it. (That's all the info I have.)  However, I just saw this happen to someone else, so it can't just be a fluke on my end. , and . The author claims there that they did indeed double click the "Review" button, but their question didn't go through since it didn't have a required tag, but when they tried to submit the question with the required tag, they only clicked it once.  Also, now that I think about it, it could not have been just a temporary client-side issue on both our ends. The system is supposed to  if one tries to post more than one question in 30 seconds. Neither of us got a CAPTCHA. This means that the server accepted the double post, and so it's a server issue.  This has the effect of denying users badges that they would have otherwise qualified for, since a single negatively-received, closed, or deleted question . This means that even if the double post is deleted and the original is upvoted, the user won't qualify for that day since they've made a "bad" question on that day. (While they may be able to later reverse this 60 days later by undeleting and re-deleting their question - questions deleted more than 60 days later aren't considered "deleted" for the check - they often won't be able to, since most of the time, users will have downvoted the double post, which also disqualifies one from the badges.)  Can an employee go through server logs to see what happened in both these cases, and add some safeguards to prevent accidental double submissions of questions? This seems to have come up when the new asking form was deployed.  Update: There was another case just now:  was . As both have the exact same time of submission, this is an instance of this bug, since as I said above, this thing is ordinarily prevented by a CAPTCHA.
113251
The sender and receiver share two different secret keys:  s1 and s2 both y bit values. 'x' is a randomly generated y bit value. The reader sends to the tag a challenge y =  x ⊕ s1, and the receiver  responds with z = x ⊕ s2 after recovering x = y ⊕ s1.   s1 and s2 never change, x is randomly generated each complete transaction. Can you determine s1 and s2 through a single transaction? After multiple?