Hot answers tagged html-5
4
Your site has not been hacked, you just have an open comment form without CAPTCHA.
What you are seeing is almost entirely automated spam, put there by bots configured to look for HTTP comment forms exactly like yours.
You need to either disable the comment forms, or add an image CAPTCHA.
2
Yup, that's the exact definition of a HTTPOnly cookie. Of course the client can do whatever it wants to itself - so this isn't surprising. The goal is to protect the client from malicious websites (as opposed to protecting the client from itself).
This segues nicely into one of the Golden Rules of programming, with extra emphasis on game development: Don't ...
2
The purpose of the element is to provide a secure way to authenticate users.
The tag specifies a key-pair generator field in a form.
More can be found here
http://www.w3schools.com/html/html5_form_elements.asp
1
Document types (or DOCTYPE) is a declarative and semantical element which is part of the W3C specification regarding markup languages documents (such as XHTML).
Their presence (or non-presence) within a markup document does not influence a whatever security aspect when they are being rendered and processed by a web browser.
If you are writing an XHTML 1.1 ...
1
From what I know of the WebSockets protocol whilst it allows two way message passing, at a TCP level the connection is initiated by the client and as such the most firewall configurations (e.g. those which allow standard web browsing) will allow WebSockets communication without further configuration. Indeed looking at the Wikipedia Article, this is touted ...
1
Pros
It can improve security when authenticating (in addition to a multi-factor device)
If used as a "client certificate", it can make MITM attacks much more difficult
The Keygen tag is implemented across most non-IE browsers, making it very easy to implement
Works regardless of administrator permission. With IE Active X controls can be disabled and IE ...
1
It seems that the answer lies in the updated w3 link I just found. Specifically
This specification does not specify how the private key generated is
to be used. It is expected that after receiving the
SignedPublicKeyAndChallenge (SPKAC) structure, the server will
generate a client certificate and offer it back to the user for
download; this ...
1
The W3C security instructions for this are surprisingly accurate and complete:
Authors should check the origin attribute to ensure that messages are
only accepted from domains that they expect to receive messages from.
Otherwise, bugs in the author's message handling code could be
exploited by hostile sites.
Furthermore, even after checking ...
1
Quite a few things have been published since the question was asked back in January, including:
ENISA Smartphone Secure Development Guidelines for App Developers
viaForensics Secure Mobile Development Best Practices (you need to register to download the PDF version)
W3C Mobile Web Application Best Practices: W3C Recommendation 14 December 2010
Denim Group: ...
Only top voted, non community-wiki answers of a minimum length are eligible
