Linked Questions

9
votes
3answers
6k views

Why wouldn't it be great, if HTTP/2 would only allow communication via TLS? [duplicate]

https://en.wikipedia.org/wiki/HTTP/2 Earlier, encryption method TLS 1.2 or greater was planned to be mandatory as part of the protocol. However, in lieu of consensus for mandatory TLS, an ...
5
votes
3answers
843 views

Bad things about no SSL encryption? [duplicate]

So I was reading some comments on a popular forum about SSL encryption and how some websites pass their login form data as plaintext and don't use SSL or TLS. I understand that using an encryption ...
6
votes
4answers
2k views

HTTPS vs. HTTP - Is there a security reason for HTTPS for a site that only does Facebook login? [duplicate]

Possible Duplicate: What are the pros and cons of site wide SSL (https)? I am working on a site where all authentication is via facebook oauth2. I'd consider the nature of our content to be non-...
4
votes
2answers
3k views

Is it okay to just secure (using SSL) the login page, but not the rest of the site? [duplicate]

Possible Duplicate: What are the pros and cons of site wide SSL (https)? I'm creating a custom PHP/MySQL CMS for a client (because Wordpress is overkill for this client's particular needs). Now, ...
1
vote
2answers
232 views

Question about authentication cookies? [duplicate]

Say, I have a website where users are required to login to access certain functionality. Once they are logged in, they are issued an authentication cookie. Some of the pages on the authenticated ...
1
vote
1answer
210 views

Impact of using map APIs without SSL support? [duplicate]

We are currently developing a web application which involves map APIs. Most of the map API providers don't provide any SSL support (e.g. Yahoo! doesn't). What will be the security impact of using map ...
1
vote
0answers
39 views

Using SSL on my sites for everything or just some things? [duplicate]

I have a server which provides a few services through the web, some of those services must be logged into to be able to use them. For these services I have implemented SSL using level 3 CACert ...
72
votes
9answers
9k views

Why is HTTPS not the default protocol?

Why is HTTP still commonly used, instead what I would believe much more secure HTTPS?
22
votes
3answers
69k views

How to ensure that cookies are always sent via SSL when using ASP.NET on IIS 7.5?

Firesheep has brought the issue of insecure cookie exchanges to the forefront. How can you ensure that all cookie exchanges are forced to occur only via an SSL-secured connection to the server when ...
34
votes
1answer
42k views

How to implement an API-Key-Mechanism

first of all: I am quite unsure about the title of the question, so if you have a better idea, please feel free to tell (: I would like to know about best-practise examples where services (like ...
14
votes
7answers
9k views

Should we force user to HTTPS on website?

Should we force website from HTTP to HTTPS , one of the method is using .htaccess: RewriteCond %{SERVER_PORT} 80 RewriteRule ^(.*)$ https://www.example.com/$1 [R,L] But what I notice is that some ...
27
votes
2answers
7k views

Guidance for implementors of HTTPS-only sites (Server side)

The recent trend in HTTPS attacks is to attack the HTTP protocol. What should I do to increase my site's security if the only protocol I want is HTTPS? Some easy to implement ideas are Implement ...
20
votes
3answers
806 views

Startup security

I'm running a lean start-up, and I can't afford to pay a dedicated security expert, what types of precautions can I take? These would need to be cheap, simple to implement, and require minimal time ...
9
votes
3answers
7k views

Hashing length for storing password

Does larger hash size improve the security? Is it overkill to use 512 bit hash? If I stored only 256 bits of the PBKDF2-SHA512 derived key, is it less, equal or more safe than 256 bits of PBKDF2-...
7
votes
3answers
11k views

Secure jquery ajax calls from a non secure page

I could not find a clear answer, but if I have the following situation: I browse to a page let's say http://www.example.com/index.html Now I use a form on this page to do a postback with jquery's ...

15 30 50 per page