Tagged Questions
9
votes
3answers
137 views
What simple security considerations can I / should I make for a read-only API?
Right now I'm setting up an API, to be consumed on the client-side to set up a directory site. I'm wondering what extra steps I need to take just to prevent people from gaining write access to the ...
7
votes
4answers
1k views
What kind of attack was this?
So our website was hacked, and these are the things that were done:
Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
2
votes
6answers
229 views
Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?
I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case.
Is there a way to determine and display the state of HTTPS on a page ...
2
votes
2answers
62 views
Will using SSL to secure Wordpress admin area only still actually be secure?
The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas.
There ...
0
votes
2answers
57 views
How can I set up signed downloads?
Scenario
I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
1
vote
1answer
115 views
Exporting data beyond a cryptographic boundary
Scenario
We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
3
votes
3answers
131 views
Is it safe to mix authentication methods?
Is it a good idea to "combine" authentication methods?
Example we can use username/password method to authenticate a user from a server.
What if we used this as a first authentication step to get ...
2
votes
6answers
207 views
Protecting an admin area from the public
We are about a month away from launching a pretty important site, which comes with an admin console to help us manage the site.
Now I'm not very interested at just leaving the admin out in the open ...
0
votes
2answers
133 views
OpenID without SSL certificate
Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed?
Just to make things clear, ...
0
votes
2answers
183 views
How valid is this statement “SSL sit between application layer and network layer”
taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer
The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
8
votes
2answers
2k views
ssltest: Chain issues - Contains anchor
I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)")
What does it mean? Should it be fixed? Can it be exploited?
10
votes
7answers
685 views
Should we force user to HTTPS on website?
Should we force website from HTTP to HTTPS , one of the method is using .htaccess:
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]
But what I notice is that some ...
2
votes
2answers
126 views
Is there a need for SSL on a local site?
Do I need SSL for a site that can only be accessed on the local network?
All users log in with windows credentials using Windows Auth with PHP on IIS.
And if I don't: What security is needed to make ...
3
votes
1answer
111 views
Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?
Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
0
votes
1answer
197 views
How does a Web Security Gateway analyse SSL Encrypted Traffic?
Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
3
votes
1answer
137 views
Client-side cross-site access in SSL environment - when it's still possible to do?
I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
5
votes
3answers
685 views
What are potential security risks when using an insecure wireless connection?
If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it posse a threat even if the person is using a secure application layer protocol? What I mean by ...
2
votes
4answers
198 views
What are some common misconceptions about SSL/TLS that members of the general public hold?
Particularly ones that are, to some extent, the result of advice given by companies who utilise it, e.g. banks, e-commerce sites etc.
6
votes
2answers
824 views
What can an attacker do with a stolen SSL private key? What should the web admin do?
What can an attacker do with a stolen website certificate and key?
What should the website admin do upon learning this?
1
vote
1answer
184 views
JS frontend for RESTful backend vs authorization
I'm building web-app. And i have concern about security issues.
In world a lot of similar questions, but many of them does not have really clear answer(advise,suggestion). This is the reason why i ...
5
votes
3answers
696 views
Securing a multi-tenant architecture
I'm a computer science student looking to expand an already developed web application into using multi-tenant architecture. Considering I'm far from being a security expert, which precautions can I ...
0
votes
3answers
188 views
Is HTTPS necessary for password change if user has already logged in with HTTPS?
I notice many websites implementing HTTPS for changes in account information even though the user has already logged in through HTTPS and tracked by SESSION.
Is this really necessary?
1
vote
3answers
3k views
What does these warnings mean on an SSL connection by firefox (only)
I am connecting to a secure site and firefox mentions about identity:
Owner: This website does not supply ownership information
Verified by: Not specified
Technical Details:
Connection ...
2
votes
1answer
207 views
Is SSL session based only? Is there a (formal) definition of an SSL connection?
In various docs on SSL there is a mention of connection.
But from the context I am not sure if this means the underlying TCP connection or the SSL connection.
I am thinking that there is no SSL ...
1
vote
2answers
251 views
Really secure webmail
If I'm feeling paranoid about the CCDP (UK) - requiring ISPs to intercept communications across the internet - then what would be the most secure approach to a webmail system?
Obviously, there's some ...
5
votes
2answers
803 views
Google Analytics on a secured site
Just read this article on Google Analytics and the risk of forged certificates, where it said:
Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
2
votes
2answers
80 views
Does TLS-OBC only improve security of Web Browsers? Does it improve the security of SSH?
I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols?
Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh)
...
7
votes
3answers
361 views
Is a mobile app more secure for mobile use than the “normal” website?
An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
1
vote
3answers
549 views
OWA Keep-Alive in http, even though it should be forced https
Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
2
votes
2answers
259 views
HTTP + HTTPS + One Time Pad/stream cipher
I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
3
votes
1answer
240 views
Security for a low latency online multiplayer game
I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
2
votes
2answers
766 views
Secure SSL Session from losing itself into unsecure http
I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
4
votes
4answers
2k views
Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP
The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a ...
10
votes
4answers
2k views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
4
votes
1answer
172 views
What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see last years draft
I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status
Where can I find the most current guidance on STS in DNS? If ...
10
votes
1answer
4k views
What key exchange mechanism should be used in TLS?
There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
10
votes
3answers
4k views
Is the Facebook login form using SSL without https in the URL?
If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
10
votes
1answer
1k views
Guidance for implementors of HTTPS-only sites (Server side)
The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS?
Some easy to implement ideas are
Implement ...
1
vote
2answers
84 views
How can I force certain the webclient to honor or remember certain parameters from the webserver?
HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted ...
4
votes
4answers
2k views
Should I ignore the BEAST SSL exploit and continue to prefer AES?
Because of the BEAST exploit it seems everyone is saying you should stop using AES and instead use RC4.
I am wondering if it wouldn't be better to continue using AES instead for the following ...
3
votes
1answer
227 views
Any non-commercial certificate authority issuer for web applications?
Is there any non-commercial certificate authority capable of issuing valid certificates for web applications? I mean, the certificate must be accepted by browsers, like those of commercial CAs?
7
votes
6answers
546 views
when is it safe to click through an SSL warning message?
How does a user know if it's safe to click through scary browser warnings about SSL certificates?
Ideally, a user should never need to click through these warning messages, but sometimes honest ...
10
votes
1answer
1k views
enable browser caching with HTTPS
I understand that sensitive data should not be cached (ie, you dont want to cache an HTML file with all of your bank account details in it), but there are some things that HTTPS protected sites should ...
4
votes
4answers
442 views
Secure Web Password Fields + http to https redirect
I'm a software developer but I'm marking my niche in secure development. It turns out that while using WebScarab, I discovered that a popular user group site doesn't appear to properly take care of ...
2
votes
1answer
495 views
Is it possible to secure a web app without HTTPS? [duplicate]
Possible Duplicate:
Can you secure a web app from FireSheep without using SSL?
Think of a typical web application where the users log in, and then the session is kept with a session key. Is ...
23
votes
5answers
1k views
Why is HTTPS not the default protocol?
Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
4
votes
3answers
385 views
It is safe to buy a domain if I get this message in Firefox?
Greetings, I want to buy a domain name from a big registar(well known on the internet) but when I go to checkout I see that my link is going from full encrypted to “Connection Partially Encrypted” ...
5
votes
2answers
378 views
What is more secure: Many subdirectories, or many subdomains?
I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef:
www.mydomain.net/enroll
www.mydomain.net/admin
www.mydomain.net/
... or I can configure them as a ...
6
votes
3answers
3k views
What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?
I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider.
Question 1 Why ...
6
votes
2answers
445 views
What a programmer should know before their web service's client audit
Situation: I have created a WS client (.net wcf) for the customer that access a third party web service (Websphere). This WS uses HTTPS and I get a certificate from WS vendor. All works fine, I have ...
