2
votes
3answers
223 views

OWASP escaping recommendation - why /?

In OWASP recommendations regarding escaping untrusted input for HTML element content, they list the following: & --> &amp; < --> &lt; > --> &gt; " --> &quot; ' ...
7
votes
5answers
490 views

How to prevent pay per show/click abuse?

We have a webapp. 3rd party websites put our banners on their pages (banner is a snippet of HTML). They are paid for it using "Pay per click" or "Pay per show" methods. So 3rd party website's owners ...
1
vote
2answers
454 views

Application of Bayesian network for Web Application Security

How can a Bayesian network be used to perform attack analysis of web traffic? I read an interesting article on its application. "Web Application Defense with Bayesian Attack Analysis" but I was not ...
4
votes
1answer
1k views

How to detect cookie stuffing attacks?

So the question is how to detect cookie stuffing attacks and how to protect against them? In case of image-based cookie stuffing I can detect that related resources are not loaded and therefore ...
3
votes
3answers
361 views

What to do when asked for a weak password

The guys who made the security for my country's state bank are completely nuts in all senses. Their internet banking password must be between 8 and 10 characters, and contain only letters and digits. ...
18
votes
1answer
3k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...