Tagged Questions
7
votes
4answers
953 views
What kind of attack was this?
So our website was hacked, and these are the things that were done:
Some entries in the database were changed. I don't know if this was via SQL injection, or direct database access (only root is ...
2
votes
6answers
215 views
Can one reliably show HTTPS status in browser (not just the lock in the URL bar)?
I'm almost certain this isn't possible, as it would probably be too exploitable, but I wanted to ask the community just in case.
Is there a way to determine and display the state of HTTPS on a page ...
1
vote
2answers
44 views
Will using SSL to secure Wordpress admin area only still actually be secure?
The vast majority of our website contains no sensitive information, logins, forms, etc. However there are portions driven by wordpress so we are looking into getting SSL to secure these areas.
There ...
0
votes
2answers
57 views
How can I set up signed downloads?
Scenario
I have a web server that authenticates and redirects from HTTP to HTTPS. Clients can then view available "downloads" in their account. I want to be able to sign these download links - as in, ...
1
vote
1answer
114 views
Exporting data beyond a cryptographic boundary
Scenario
We're working on putting a FIPS 140-2 compliant SQL database on a dedicated machine behind the internal firewall of an organization, and need the capacity to push a specific document or ...
3
votes
3answers
130 views
Is it safe to mix authentication methods?
Is it a good idea to "combine" authentication methods?
Example we can use username/password method to authenticate a user from a server.
What if we used this as a first authentication step to get ...
2
votes
6answers
202 views
Protecting an admin area from the public
We are about a month away from launching a pretty important site, which comes with an admin console to help us manage the site.
Now I'm not very interested at just leaving the admin out in the open ...
0
votes
2answers
114 views
OpenID without SSL certificate
Is it wise to use OpenID (from Google or Yahoo) to log-into a website instead of a username+password login if that website doesn't have an SSL certificate installed?
Just to make things clear, ...
0
votes
2answers
161 views
How valid is this statement “SSL sit between application layer and network layer”
taken from http://searchsecurity.techtarget.com/answer/How-does-SSL-sit-between-the-network-layer-and-application-layer
The SSL protocol is quite unusual, as it doesn't just operate at one layer. ...
7
votes
2answers
2k views
ssltest: Chain issues - Contains anchor
I've run ssltest on web application and it found "Chain issues - Contains anchor" (section "Additional Certificates (if supplied)")
What does it mean? Should it be fixed? Can it be exploited?
10
votes
7answers
646 views
Should we force user to HTTPS on website?
Should we force website from HTTP to HTTPS , one of the method is using .htaccess:
RewriteCond %{SERVER_PORT} 80
RewriteRule ^(.*)$ https://www.example.com/$1 [R,L]
But what I notice is that some ...
2
votes
2answers
126 views
Is there a need for SSL on a local site?
Do I need SSL for a site that can only be accessed on the local network?
All users log in with windows credentials using Windows Auth with PHP on IIS.
And if I don't: What security is needed to make ...
3
votes
1answer
109 views
Vulnerabilities of having one path of app accessible only via HTTPS but others via HTTP?
Imagine example.com that is accessible via HTTP and HTTPS. Most of content at site isn't secure and it won't be bad if it will be read by attacker. One of paths - example.com/secure_zone is accessible ...
0
votes
1answer
190 views
How does a Web Security Gateway analyse SSL Encrypted Traffic?
Since HTTPS traffic is encrypted in transit how does a web security gateway analyse it?
3
votes
1answer
135 views
Client-side cross-site access in SSL environment - when it's still possible to do?
I'm trying to imagine an secure sandboxed environment for an application which is big and unexplored, and may contain backdoors. It would live under chroot/virtual environment with no outgoing ...
5
votes
3answers
663 views
What are potential security risks when using an insecure wireless connection?
If someone is using an insecure wireless connection (for example a hot spot in a coffee shop) does it posse a threat even if the person is using a secure application layer protocol? What I mean by ...
2
votes
4answers
193 views
What are some common misconceptions about SSL/TLS that members of the general public hold?
Particularly ones that are, to some extent, the result of advice given by companies who utilise it, e.g. banks, e-commerce sites etc.
4
votes
2answers
738 views
What can an attacker do with a stolen SSL private key? What should the web admin do?
What can an attacker do with a stolen website certificate and key?
What should the website admin do upon learning this?
1
vote
1answer
179 views
JS frontend for RESTful backend vs authorization
I'm building web-app. And i have concern about security issues.
In world a lot of similar questions, but many of them does not have really clear answer(advise,suggestion). This is the reason why i ...
5
votes
3answers
683 views
Securing a multi-tenant architecture
I'm a computer science student looking to expand an already developed web application into using multi-tenant architecture. Considering I'm far from being a security expert, which precautions can I ...
0
votes
3answers
179 views
Is HTTPS necessary for password change if user has already logged in with HTTPS?
I notice many websites implementing HTTPS for changes in account information even though the user has already logged in through HTTPS and tracked by SESSION.
Is this really necessary?
1
vote
3answers
3k views
What does these warnings mean on an SSL connection by firefox (only)
I am connecting to a secure site and firefox mentions about identity:
Owner: This website does not supply ownership information
Verified by: Not specified
Technical Details:
Connection ...
2
votes
1answer
193 views
Is SSL session based only? Is there a (formal) definition of an SSL connection?
In various docs on SSL there is a mention of connection.
But from the context I am not sure if this means the underlying TCP connection or the SSL connection.
I am thinking that there is no SSL ...
1
vote
2answers
250 views
Really secure webmail
If I'm feeling paranoid about the CCDP (UK) - requiring ISPs to intercept communications across the internet - then what would be the most secure approach to a webmail system?
Obviously, there's some ...
5
votes
2answers
702 views
Google Analytics on a secured site
Just read this article on Google Analytics and the risk of forged certificates, where it said:
Sooner or later it's going to happen; obtaining forged SSL certificates is just too easy to hope ...
2
votes
2answers
77 views
Does TLS-OBC only improve security of Web Browsers? Does it improve the security of SSH?
I'm studying the TLS-OBC extension and would like to know if it improves security of non Web-based protocols?
Specifically, would it be of any benefit to SSH clients? (version 1 or version 2.x/secsh)
...
7
votes
3answers
357 views
Is a mobile app more secure for mobile use than the “normal” website?
An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
1
vote
3answers
512 views
OWA Keep-Alive in http, even though it should be forced https
Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the Ascii decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
2
votes
2answers
245 views
HTTP + HTTPS + One Time Pad/stream cipher
I'm designing a web application where users will exchange short messages with the server very frequently (for instance, a few characters every second). I want the whole communication to be ...
3
votes
1answer
232 views
Security for a low latency online multiplayer game
I am designing an online multiplayer game and I am looking for a good tradeoff of secure communications with minimal CPU and bandwidth utilization. My ideal solution would only use UDP packets since ...
2
votes
2answers
722 views
Secure SSL Session from losing itself into unsecure http
I've seen some implementations of HTTPS SSL and, as a visitor, forced to rely to a lot of those. What would a secure implementation look like and where can one expect problems? I expect the installer ...
4
votes
4answers
2k views
Benefits of identifying clients based upon the “X-Forwarded-For” or similar HTTP header in addition to Client IP
The X-Forwarded-For header is used by some HTTP proxies to identify the IP address of the client. The wiki page (linked above) mentions that ISPs may use this header as well.
In addition there are a ...
10
votes
4answers
2k views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
4
votes
1answer
168 views
What is the status of forced HTTPS everywhere (Strict transport security) via DNS? I only see last years draft
I'm trying to find the most recent RFC on HSTS in DNS (or rather said DNSSEC), but can only find this year old one in expired draft status
Where can I find the most current guidance on STS in DNS? If ...
10
votes
1answer
4k views
What key exchange mechanism should be used in TLS?
There are many key exchange mechanisms that can be used in TLS. Among them are RSA, ECDH_ECDSA, ECDHE_ECDSA, ECDH_RSA, ECDHE_RSA and others. Which of these are more cryptographically secure and can be ...
10
votes
3answers
4k views
Is the Facebook login form using SSL without https in the URL?
If I go to http://facebook.com, I am not redirected to https://www.facebook.com. If it doesn't have https in the URL, can the login be secure? Usually I am redirected to an https page on other sites? ...
10
votes
1answer
1k views
Guidance for implementors of HTTPS-only sites (Server side)
The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS?
Some easy to implement ideas are
Implement ...
1
vote
2answers
83 views
How can I force certain the webclient to honor or remember certain parameters from the webserver?
HTTPS is subject to several MITM attacks, that is clear. However I think it would be helpful to the ITSec crowd if there was a way to force a certain browser behaviour when accessing known-trusted ...
4
votes
4answers
2k views
Should I ignore the BEAST SSL exploit and continue to prefer AES?
Because of the BEAST exploit it seems everyone is saying you should stop using AES and instead use RC4.
I am wondering if it wouldn't be better to continue using AES instead for the following ...
3
votes
1answer
221 views
Any non-commercial certificate authority issuer for web applications?
Is there any non-commercial certificate authority capable of issuing valid certificates for web applications? I mean, the certificate must be accepted by browsers, like those of commercial CAs?
7
votes
6answers
534 views
when is it safe to click through an SSL warning message?
How does a user know if it's safe to click through scary browser warnings about SSL certificates?
Ideally, a user should never need to click through these warning messages, but sometimes honest ...
9
votes
1answer
1k views
enable browser caching with HTTPS
I understand that sensitive data should not be cached (ie, you dont want to cache an HTML file with all of your bank account details in it), but there are some things that HTTPS protected sites should ...
4
votes
4answers
439 views
Secure Web Password Fields + http to https redirect
I'm a software developer but I'm marking my niche in secure development. It turns out that while using WebScarab, I discovered that a popular user group site doesn't appear to properly take care of ...
2
votes
1answer
469 views
Is it possible to secure a web app without HTTPS? [duplicate]
Possible Duplicate:
Can you secure a web app from FireSheep without using SSL?
Think of a typical web application where the users log in, and then the session is kept with a session key. Is ...
23
votes
5answers
1k views
Why is HTTPS not the default protocol?
Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
4
votes
3answers
380 views
It is safe to buy a domain if I get this message in Firefox?
Greetings, I want to buy a domain name from a big registar(well known on the internet) but when I go to checkout I see that my link is going from full encrypted to “Connection Partially Encrypted” ...
5
votes
2answers
361 views
What is more secure: Many subdirectories, or many subdomains?
I have 3 websites that could be configured as a "VirtualApplication" in servicedefinition.csdef:
www.mydomain.net/enroll
www.mydomain.net/admin
www.mydomain.net/
... or I can configure them as a ...
5
votes
3answers
3k views
What SSL key should I make for IIS: RSA or DH? What bit length is appropriate?
I'm creating an SSL cert for my IIS server and need to know when I should choose the Microsoft RSA SChannel Cryptographic Provider or the Microsoft DH SChannel Cryptographic Provider.
Question 1 Why ...
6
votes
2answers
435 views
What a programmer should know before their web service's client audit
Situation: I have created a WS client (.net wcf) for the customer that access a third party web service (Websphere). This WS uses HTTPS and I get a certificate from WS vendor. All works fine, I have ...
11
votes
2answers
8k views
How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?
Firesheep has brought the issue of insecure cookie exchanges to the forefront.
How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
