Linked Questions

12
votes
5answers
4k views

How do you prevent sending cookie data over HTTP the first time? [duplicate]

You could use HSTS to tell browser to always use HTTPS in future requests. You could use Cookie Secure flag that from now on only send cookies over HTTPS. You could use DNS based redirect but only ...
8
votes
2answers
16k views

Actually, isn't it bad to redirect http to https? [duplicate]

I have a two-part question about question #570288 over on ServerFault. Question: Is it bad to redirect http to https? Accepted answer (185 up-votes): [...] Hell no. It's very good. Part 1 Is ...
140
votes
11answers
86k views

Is visiting HTTPS websites on a public hotspot secure?

It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
51
votes
5answers
15k views

What's the difference between using HSTS and doing a 301 redirection?

If I already have done a 301 redirection from all the HTTP inner pages to HTTPS, why should I use HSTS as well?
18
votes
6answers
5k views

How secure is redirecting user from http://normal.bank.com to https://secure.bank.com?

I have an application. Which works on http, http://normal.bank.com. But for log-in, performing any action, etc. I am rediecting user to https://secure.bank.com, where user can login and perform action....
31
votes
5answers
3k views

Are address bars unphishable?

I've taken, out of curiosity, the Phishing Quiz by OpenDNS that tries to teach the general public about detecting phishing: Ever wonder how good you are at telling the difference between a ...
18
votes
2answers
12k views

Double Submit Cookies vulnerabilities

Is the Double Submit Cookies mechanism vulnerable anything other than XSS and sub-domain attacks? All CSRF protection mechanisms are vulnerable to XSS, so that's nothing new. I'm just wondering if I ...
9
votes
7answers
41k views

Disadvantages of Using a VPN?

I've got a yearly subscription to a VPN service which is real quick and from the research I did at the time seems to be pretty legitimate, but are there any disadvantages or scenarios where you ...
9
votes
4answers
6k views

Mitigating SSLStrip by only serving a site over HTTPS?

So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...
12
votes
2answers
5k views

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
9
votes
4answers
6k views

Is a mobile app more secure for mobile use than the “normal” website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
5
votes
1answer
3k views

What are HSTS Super Cookies?

A few questions : What are HSTS super cookie? How do they work? Why is possible to access them from multiple domains? Do I have to worry and if yes, how to mitigate their effect? Sources http://...
4
votes
2answers
1k views

Data on Malicious WiFi Network

Let's assume that I unwittingly connect to a malicious WiFi network and visit websites. By malicious, I mean the network has been set up for the purpose of stealing data. From what I've read, using ...
4
votes
4answers
638 views

Bank login in foreign country

I have friends andfamily that travel/live in foreign countries and compromised unsecure wireless networks and credit card scanners have always been a problem. I was recently asked a question about ...
2
votes
3answers
647 views

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...

15 30 50 per page