Linked Questions

10 votes
4 answers

Is a mobile app more secure for mobile use than the "normal" website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
makerofthings7's user avatar
8 votes
4 answers

Mitigating SSLStrip by only serving a site over HTTPS?

So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...
John's user avatar
  • 2,282
5 votes
4 answers

Bank login in foreign country

I have friends andfamily that travel/live in foreign countries and compromised unsecure wireless networks and credit card scanners have always been a problem. I was recently asked a question about ...
BenW301's user avatar
  • 153
2 votes
3 answers

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
Paul Draper's user avatar
  • 1,010
0 votes
3 answers

Is http to https port forwarding a vulnerability? [duplicate]

I work in an organisation where a TMG server with port forwarding has been used successfully for a number of years to forward all http traffic to https for a particular web application. This meant ...
dev123's user avatar
  • 3
22 votes
2 answers

Double Submit Cookies vulnerabilities

Is the Double Submit Cookies mechanism vulnerable anything other than XSS and sub-domain attacks? All CSRF protection mechanisms are vulnerable to XSS, so that's nothing new. I'm just wondering if I ...
Gili's user avatar
  • 2,169
19 votes
2 answers

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
Mark's user avatar
  • 333
11 votes
2 answers

Actually, isn't it bad to redirect http to https? [duplicate]

I have a two-part question about question #570288 over on ServerFault. Question: Is it bad to redirect http to https? Accepted answer (185 up-votes): [...] Hell no. It's very good. Part 1 Is ...
daveloyall's user avatar
4 votes
2 answers

Data Security on a Malicious WiFi Network

Let's assume that I unwittingly connect to a malicious WiFi network and visit some websites. By malicious, I mean the network has been set up for the purpose of stealing data. From what I've read, ...
Peter's user avatar
  • 143
2 votes
2 answers

Is https safe enough as of now?

Because of my job I keep traveling around Europe, which means I keep connecting to all kinds of public wireless. In principle I could use a VPN and that should be always safe (is this statement right?...
Scarlehoff's user avatar
2 votes
2 answers

How to prevent attacks before HSTS is established for the first time? [closed]

What is the best way to accomplish this and prevent attacks like SSL Strip?
Phoenix Logan's user avatar
1 vote
2 answers

Solution to User Initial HTTP Requests Unencrypted Despite HTTPS Redirection?

It is my understanding that requests from a client browser to a webserver will initially follow the specified protocol e.g, HTTPS, and default to HTTP if not specified (Firefox Tested). On the server ...
user237462's user avatar
6 votes
1 answer

What are HSTS Super Cookies?

A few questions : What are HSTS super cookie? How do they work? Why is possible to access them from multiple domains? Do I have to worry and if yes, how to mitigate their effect? Sources http://...
Gudradain's user avatar
  • 7,001
1 vote
1 answer

How is HTTP converted to HTTPS when no HSTS is present?

Suppose you have a website Now, you also have an SSL certificate, which means users can access the site securely using But if I just write ...
Utkarsh Agrawal's user avatar
1 vote
1 answer

Redirection HTTP to HTTPS, can I prevent giving away the URL?

Yes, yet another question on HTTP to HTTPS redirection. But this one talks about a quite quirky situation. This is a follow up question on Security of an initial redirection from ...
grochmal's user avatar
  • 5,877

15 30 50 per page