New answers tagged

1

This could give rise to an information leakage vulnerability. Say your whole site is served over HTTPS, without DNS prefetching disabled. There may be certain pages on your site that reference other external resources. For example, imagine a banking website that customers can login to, and that the page for managing mortgages has some external links unique ...


2

As a client device, simply turn off the "Automatically detect proxy settings" feature in Internet Options. This prevents the browser from trying to look up a location for the wpad.dat or proxy PAC script. If you want to protect poorly configured devices on your network, set a DNS entry for WPAD and blackhole the traffic.


2

This simply means that all these domain names are associated with the IP 17.178.96.59. Several domain names can be associated with the same IP address. This is common with name-based implementation of Shared web hosting service: Name-based In name-based virtual hosting, also called shared IP hosting, the virtual hosts serve multiple host names on ...


1

Sometimes, companies will register domain names that are similar to their actual domain names or products to make sure someone does not use them for phishing or brand abuse. This can be confirmed by running a whois query. I see that jtunes.com is, in fact, registered by Apple. http://www.tcpiputils.com/browse/domain/jtunes.com


0

I'm not aware of a direct security reason to avoid gethostbyname. It isn't like gets which can't be used without risking a buffer overflow except in highly controlled conditions where the application knows the maximum possible size of the input. One reason why gethostbyname is deprecated is that it isn't thread-safe, because it writes its output in a shared ...


5

Google has some servers (Edge Nodes) located into ISPs for quicker response, this is what they call the Google Global Cache. They are basically big proxy caches for serving static content (such as YouTube videos). According to their FAQ, it is ┬źdesigned for end-user networks with greater than 1Gbps of peak Google traffic┬╗ As you have observed, Alaska ...


1

That's not the problem. Some people use VPNs for privacy (which is arguably misguided, as a VPN is a remote network connectivity tool and not a privacy tool, but that's an argument for another day) and having DNS queries leak out of the non-VPN connection is a concern in that scenario. Say, for example, I live in an oppressive regime with little regard for ...


1

Deprecated functions are generally tagged by static code analyzers simply because they're deprecated. (That's usually an optional setting.) Many secure coding standards specifically state: "do not use deprecated functions." Apart from some long-ago-fixed bugs, gethostbyname isn't terrible, but that's no reason to use it in new code when a supported ...


1

Certificate validation is done to make sure that the peer is the one you expect. Validating a server certificate in the browser is mainly done by checking that the hostname from the URL matches the name(s) in the certificate and that you can build a trust chain to a locally trusted CA certificate (i.e. the root certificates stored in the browser or OS). ...


1

I believe the requirement for public IPs and FQDNs is shouldered by the CA's, not the browsers, so you should be OK (at least, unless someone has better information, you can set up a test in an afternoon and confirm one way or the other). This rules out public certs at a minimum. Of your remaining three options, the best user experience is brought by ...


0

It is clear that the certificate authority will issue certificate for fully qualify domain name and validate your domain name, which you want to use for website address. In that case, if you wish to continue with two domain names (www.a.com and www.b.com), then you have two choices as below. 1. Get individual certificates for each You can purchase ...


0

Just to add to the existing answer, if you want to secure multiple domains using a single certificate, you can explore Subject Alternate Name (SAN) certs, which allow you to protect more than one FQDNs. Quoting from the example given in the linked article: With a Multi-Domain (SAN) Certificate, you can secure: 1) www.example.com 2) ...


4

Certificate validation is done against the hostname given in the URL, which means you'll need a certificate for any hostname which you expect to be used inside a URL. Thus, if you want to use both www.a.com and www.b.com in the URL you need a certificate for each, even if they are the same host and if one redirects to the other. DNS settings like same IP ...


0

There are three flags in a DNSSec packet that are responsible for communicating the validation requirements of a domain. The DO bit The DO bit is set by the resolver to indicate that it requires authentication Resource Records to be included in the response. If a resolver is security aware, it MUST set the DO bit. If a Name Server gets a message without ...



Top 50 recent answers are included