Tag Info

New answers tagged

0

I don't know the answer but with a little search I found this presentation. I think you can find more useful information by using right keywords. http://www.iaria.org/conferences2007/filesICCGI07/Tutorial_SecurityPatterns.pdf


0

Public / private keys seems the logical way to do, but you may not want to code from scratch. Look at how TextSecure does it: https://github.com/WhisperSystems/TextSecure/ It does all the things that your app would (encrypt data / send to web service). You should probably use the encryption libraries / code directly from their codebase although the ...


1

Securing by IP is a great first step. It severely limits your attack surface. But, as you point out, the source IP in PAAS deployments has limited trust value. Adding a (reverse) proxy server between the outside world & the inside (local) server will also make things more difficult for an attacker. In business settings, having a reverse proxy separate ...


3

If you wish to educate other people on how to secure their site more effectively, i can see no harm in that as long as you do not mention the vulnerable site at all or even hint at it. A number of sites detail how to perform exploits and how to secure yourself, but they never encourage users to do anything illegal or post targets because that's what gets ...


6

I work at Disqus and I feel the answers above are misinformed about how our application works. Basically, our application is loaded almost entirely inside an iframe. This dramatically changes how your site is exposed to both our code and 3rd-party code. Am I essentially giving scorecardresearch.com access to my users and user's cookies for my domain, ...


0

In addition to the mentioned documents, these standards may be of your interest: JSON Web Encryption (http://tools.ietf.org/html/draft-ietf-jose-json-web-encryption-24) and JSON Web Signature (http://tools.ietf.org/html/draft-ietf-jose-json-web-signature-24) are counterparts to XML Signature and XML Encryption. They are still under development, but you can ...


1

PKI isn't a very popular approach to 2 factor authentication outside the enterprise because of the overhead of protecting the private keys and managing certificates, but there are some commercial solutions available. Take a look at Layer7. Years ago I used to work for Baltimore Technologies (famous for the first digital signature of legislation (by Bill ...


1

OWASP has some very good guidelines concerning the security of REST services.



Top 50 recent answers are included