Timeline for Popular Security "Cargo Cults"
Current License: CC BY-SA 3.0
5 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Sep 17, 2013 at 6:06 | history | made wiki | Post Made Community Wiki by Hendrik Brummermann | ||
| Sep 16, 2013 at 22:09 | comment | added | dr jimbob | Well, TLS can prevent say network eavesdroppers from listening in on passwords, session cookies, as well as the URL/data that's being accessed. Many sites that claim to be "hacked" merely have someone using an admin account with captured password and defacing the content. Agree, TLS is not in anyway a catch-all--it only prevents network eavesdropping/tampering (and really you should be using TLSv1.2 - though its fine for servers to accept TLSv1.1 from old browsers; you really shouldn't use any SSL or TLSv1.0). Agree, it doesn't prevent against SQL injection, CSRF, XSS, buffer overflow, etc. | |
| Sep 16, 2013 at 18:30 | comment | added | void_in | @drjimbob Most of the time that is not the case. And even with the private key, SSL is not something that is going to protect the website against any kind of exploitation at the application level. | |
| Sep 16, 2013 at 17:59 | comment | added | dr jimbob | Your intrusion detection/prevention system could have copies of your private keys and be able to decrypt incoming/outgoing TLS traffic. | |
| Sep 16, 2013 at 17:45 | history | answered | void_in | CC BY-SA 3.0 |