New answers tagged

7

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. There is no reasonable alternative to TLS, and trying to re-create it on your own is certainly doomed. Never roll your own crypto. If your shared host doesn't support TLS, then find one that does, or else accept that your site is insecure. ...


2

Short answer is: You can't. All your server see is what the computer at the library sends. What programs or processes on that computer that generated the data is impossible for you to know. From the servers perspective, it might as well have been a pidgeon with a telegraph as your legitimate user. The fact that the user entered a password does not mitigate ...


1

There really is no way to be validate the input if the user's computer is compromised. There are just too many variables. When your browser submits a form it looks something like this before it's encrypted and sent to the server: POST /login.php HTTP/1.1 Host: www.example.com User-Agent: mycoolbrowser Content-Length: 34 Content-Type: ...


0

I've seen several web applications that implement a "sudo mode". In your example, it might look something like this: I, an admin, am logged into your application, and stay logged in for long periods of time (perhaps the session expires after 30 days). I protect this account with reasonable amount of security, but I'm not super paranoid about it. When I ...


3

I'll propose a rule of thumb which may help you with your decision: When switching from a lower privilege level to higher, make them login again. When switching from higher to lower, do not require another login. Here's an example of how bank ATMs implement this rule. Consider these 2 scenarios: You put in your ATM card, enter your pin, select ...


0

You open yourself up to bad user behavior at that point. Really you want to keep them safe by making sure you protect against as much bad user behavior as possible. If an admin opens the web view it makes it easier for them to forget they are in the admin area and leave without signing out of the admin area, leaving it open to someone sitting down and ...



Top 50 recent answers are included