Tag Info

Hot answers tagged

8

You can get a free class-1 certificate from https://startssl.com (I have no affiliation with them other than using them for my free SSL certificates). It's not the most user friendly experience, but it gets the job done for free -- note the free certificate will only last a year (and doesn't offer features like wildcard certificates for free). There are ...


8

The first example is a normal SSL certificate meaning that it's a valid certificate issued by a trusted Certificate Authority, but there was no extended validation of the owner of the domain/site. This could mean that the certificate claims to be from Foo Inc. but the CA did not check that the person/entity applying for the certificate was indeed Foo Inc. ...


5

I think OAuth is your best bet; specifically OAuth2. It might be a little overkill, but it does what you want. OAuth OAuth provides client applications a 'secure delegated access' to server resources on behalf of a resource owner. What does this mean? You have a client application, contentsite.com, that you would like to give secure access to ...


2

The difference is that the lower bar indicates an Extended Validation certificate, and the upper bar doesn't. See the support page.


2

It will pick off the low hanging fruit, but in general, it is not hard to spoof a header. I would say that if it has caused issues in the past, it is more than likely not worth the risk to your business apps.


2

https login iframes are secure from passive eavesdropping but won't help against active MITM. The js vulnerabilities may have been closed, but the issue remains, as the parent html (served over http) can still be modified, including the url of the iframe. Then the MITM can set up the login page via http and that will be loaded by targeted users. Only users ...


2

using Fiddler and visiting a site with HSTS enabled honor HSTS in incognito if set previously in non-incognito (ie, immediately tunnel to HTTPS, do not request HTTP url) Chrome : YES Firefox : YES IE 11 : doesn't seem to honor HSTS honor HSTS in incognito if previously visited site in incognito only (ie, immediately tunnel to HTTPS, do not request HTTP ...


1

As far as I know, iframe are always vulnerable to Clickjacking. This is a big reason why website should not do log in in an iframe and why you need the header X-Frame-Options or now frame-ancestors on your log in page. Also, as mentioned in your post and that answer, the content of the http page can be intercepted and changed by a man in the middle. Since ...


1

If you have HTTPS setup for your login pages there's hardly a valid reason why you wouldn't keep it up throughout the whole website. If a user visits a page unencrypted with a specific session ID/token, what prevents a spoofing adversary from stealing that token and then visiting the website as well? And it's not just a matter of the token being observed, ...


1

No, this is definitely a scanner trying various URLs on the server to see which URL it can find. For example, if it finds "/phpmyadmin/scripts/setup.php" it knows you have phpmyadmin installed, and where it's installed. The attacker can then find the version, and run a known exploit to get access. As for how they found it, it could be several ways: ...


1

In Firefox, the HSTS set is shared between normal and private browsing mode, according to https://bugzilla.mozilla.org/show_bug.cgi?id=930638. Internet Explorer (11) does not support HSTS. In Chromium and Opera, the HSTS set is unique for each browsing profile (normal and incognito). This can easily be verified by visiting chrome://net-internals/#hsts: ...



Only top voted, non community-wiki answers of a minimum length are eligible