Linked Questions

172 votes
11 answers

Is visiting HTTPS websites on a public hotspot secure?

It's often said that HTTPS SSL/TLS connections are encrypted and said to be secure because the communication between the server and me is encrypted (also provides server authentication) so if someone ...
Calmarius's user avatar
  • 1,975
73 votes
6 answers

What's the difference between using HSTS and doing a 301 redirection?

If I already have done a 301 redirection from all the HTTP inner pages to HTTPS, why should I use HSTS as well?
Franzech Domâs's user avatar
31 votes
5 answers

Are address bars unphishable?

I've taken, out of curiosity, the Phishing Quiz by OpenDNS that tries to teach the general public about detecting phishing: Ever wonder how good you are at telling the difference between a ...
badp's user avatar
  • 371
22 votes
2 answers

Double Submit Cookies vulnerabilities

Is the Double Submit Cookies mechanism vulnerable anything other than XSS and sub-domain attacks? All CSRF protection mechanisms are vulnerable to XSS, so that's nothing new. I'm just wondering if I ...
Gili's user avatar
  • 2,169
19 votes
2 answers

Why is referer checking needed for Django to prevent CSRF

Today I learned that Django's CSRF protection uses refer(r)er header checking in addition to checking a hidden form field against a cookie. It seems to be important, judging from docs and issue below. ...
Mark's user avatar
  • 333
18 votes
6 answers

How secure is redirecting user from to

I have an application. Which works on http, But for log-in, performing any action, etc. I am rediecting user to, where user can login and perform action....
Imran Qadir Baksh - Baloch's user avatar
13 votes
5 answers

How do you prevent sending cookie data over HTTP the first time? [duplicate]

You could use HSTS to tell browser to always use HTTPS in future requests. You could use Cookie Secure flag that from now on only send cookies over HTTPS. You could use DNS based redirect but only ...
Muhammad Umer's user avatar
11 votes
2 answers

Actually, isn't it bad to redirect http to https? [duplicate]

I have a two-part question about question #570288 over on ServerFault. Question: Is it bad to redirect http to https? Accepted answer (185 up-votes): [...] Hell no. It's very good. Part 1 Is ...
daveloyall's user avatar
10 votes
4 answers

Is a mobile app more secure for mobile use than the "normal" website?

An untrained end user who uses a mobile web browser is vulnerable to phishing and can't easily verify the the authenticity (or security) of a website among other issues. Also, it is very easy to ...
makerofthings7's user avatar
9 votes
7 answers

Disadvantages of Using a VPN?

I've got a yearly subscription to a VPN service which is real quick and from the research I did at the time seems to be pretty legitimate, but are there any disadvantages or scenarios where you ...
Crizly's user avatar
  • 2,617
8 votes
4 answers

Mitigating SSLStrip by only serving a site over HTTPS?

So I just learned about SSLStrip now--I feel like I'm so late to the game. What I want to know is: If your site only serves content over HTTPS and hard fails on HTTP requests, with no redirect, are ...
John's user avatar
  • 2,282
6 votes
1 answer

What are HSTS Super Cookies?

A few questions : What are HSTS super cookie? How do they work? Why is possible to access them from multiple domains? Do I have to worry and if yes, how to mitigate their effect? Sources http://...
Gudradain's user avatar
  • 7,001
5 votes
4 answers

Bank login in foreign country

I have friends andfamily that travel/live in foreign countries and compromised unsecure wireless networks and credit card scanners have always been a problem. I was recently asked a question about ...
BenW301's user avatar
  • 153
4 votes
2 answers

Data Security on a Malicious WiFi Network

Let's assume that I unwittingly connect to a malicious WiFi network and visit some websites. By malicious, I mean the network has been set up for the purpose of stealing data. From what I've read, ...
Peter's user avatar
  • 143
2 votes
3 answers

Flash cookie and man-in-the-middle

I am using the Scala Play web framework. In it, there is a PLAY_FLASH cookie used to flash messages to the user (it's a cookie so it will still work after several redirects). I put HTML in the cookie ...
Paul Draper's user avatar
  • 1,010

15 30 50 per page