Where to ask about improvements for a security scenario?

Question

I'm building a mobile application that transfers points between users via QRCode. I'm concerned about security and am looking for effective simple yes secure algorithm to use.

What is the best website to ask my question on? Code Review, Information Security, Stack Overflow or another site? And what tags should I use?

My question:

The scenario should be something similar to this.

1. User A wants to transfer X points to User B.
2. User A generates a QR code on his mobile application, embeds the points number(X) and userA.id in the QR code.
3. User B reads the QR code, sends {points numver:X, from=userA.id, to=userB.id} to the server.
4. User A can generate the QRCode while offline, where user B must be online to read the QRCode.
5. The server receives the request and transfers X points from user A to user B.

The technical scenario we have for making this:

• The server has a global value named salt. salt is random and auto generated every day.
• In the server, every user has the following fields:
  • id: Auto Incriminate number.
  • userKey: md5( id + salt ) => changes every day.
  • generatedQRCodesNumberForToday: a number represents how many times the user generated a QRCode today, max value is 10, the value resets every day.
  • N: Array of already uses numbers in the current day while transferring points, the array resets everyday.
• Every day, the user claims a new userKey.
• Every user have a counter in his mobile application represents generatedQRCodesNumberForToday, this number is synced with the server whenever the user is online, and this number increases whenever the user creates an new QRCode.
• If user A wants to transfer X points to user B:
  • User A creates a QRCode that has {from:userA.id, numberOfTrile:md5(userA.userKey + userA.generatedQRCodesNumberForToday), points:encode(userA.pointsToTransfer, userA.userKey)}.
  • User B reads the qr data, adds to:userB.id to them, and sends them to the server.
• On server side:
  • The server receives the from field and knows who is the sender.
  • The server receives the to field and knows who is the receiver.
  • The server receives the points field and decodes is using the sender userKey to know the amount of points.
  • The server receives numberOfTrile field. The use of numberOfTrile field is to make sure that no user will generate the same QRCode more than once. The server tries to match numberOfTrile with {md5(from.userKey + '1'),...,md5(from.userKey + N),...,md5(from.userKey + '10')} where N was not used before, if there's a match then the transform process is approved and the number that matched the concatenation N is marked as not valid for future use.

Answer 1

Your question is about security, so it will probably be most well received on Information Security SE, however it would still be on-topic on Stack Overflow.

On Information Security, the best tags would probably be data-transfer and programming.
On Stack Overflow, you should use security along with the tag for the programming language you are using.

Answer 2

This definitely sounds like a question for Information Security. You have a system designed, and you want to know if it's secure or not, and why it's not secure if it isn't.

These kinds of questions are often asked on Information Security, and it seems like the best place to get a good answer, especially about the security aspects.