Tagged Questions
7
votes
5answers
388 views
How to prevent pay per show/click abuse?
We have a webapp. 3rd party websites put our banners on their pages (banner is a snippet of HTML). They are paid for it using "Pay per click" or "Pay per show" methods.
So 3rd party website's owners ...
1
vote
2answers
332 views
Application of Bayesian network for Web Application Security
How can a Bayesian network be used to perform attack analysis of web traffic? I read an interesting article on its application. "Web Application Defense with Bayesian Attack Analysis" but I was not ...
4
votes
1answer
593 views
How to detect cookie stuffing attacks?
So the question is how to detect cookie stuffing attacks and how to protect against them?
In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
7
votes
2answers
848 views
How to protect against clickjacking attack but allow legit iframes?
I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
3
votes
3answers
274 views
What to do when asked for a weak password
The guys who made the security for my country's state bank are completely nuts in all senses. Their internet banking password must be between 8 and 10 characters, and contain only letters and digits.
...
10
votes
1answer
1k views
Guidance for implementors of HTTPS-only sites (Server side)
The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS?
Some easy to implement ideas are
Implement ...
