All Questions

Filter by
Sorted by
Tagged with
36 votes
5 answers
43k views

What is the correct way to implement anti-CSRF form tokens?

I am fully aware of CSRF and have already implemented some safe forms, but I have never been happy with the results yet. I've created tokens as a md5 of username, form info and a salt and stored it ...
naugtur's user avatar
  • 1,135
20 votes
4 answers
4k views

What type of content better not to transfer by email?

Email is one of the main tools of business communication. On the other hand, it is not a secure way of communication. But to what extent it is not secure? I have always wondered how sensible it is ...
rem's user avatar
  • 2,127
16 votes
6 answers
3k views

What are a few good lists of threats to use to kick-off conversations with others about what worries them?

To effectively communicate with business owners or executives on security, specifically with how people may harm their business, it often helps to discuss what types of people worry them. What are ...
Tate Hansen's user avatar
  • 13.8k
24 votes
4 answers
2k views

How does using OpenID affect webapp security?

Using OpenID for authenticating users grows in popularity and, in fact, makes a webapp easier to use. But what are the security considerations one should bear in mind when deciding whether to ...
rem's user avatar
  • 2,127
5 votes
2 answers
4k views

Do you know any crawler/spider software, which is able to go through an ASP.NET site?

Do you know any crawler/spider software, which is able to go through ASP.NET application, not ASP.NET MVC, but the one full of __doPostBack JavaScript functions on every link/button/change event? If ...
bretik's user avatar
  • 1,870
14 votes
5 answers
13k views

What is the right way of storing database connection strings from the security point of view?

What are recommendations, best practices and have-to-dos regarding handling connection strings in web applications? What things one should never, ever do?
rem's user avatar
  • 2,127
13 votes
4 answers
3k views

What kinds of SSL certificates are usable for encryption?

I know that Verizon SSL certificates cost close to $600. There are couple of cheap alternatives, but I never really understood why Verizon does not offer such certificates. Look for RapidSSL at ...
Sairam's user avatar
  • 723
62 votes
12 answers
51k views

How long should the maximum password length be?

The minimum password length recommended is about 8 characters, so is there any standard/recommended maximum length of the password?
Mohamed's user avatar
  • 1,404
30 votes
8 answers
19k views

Do secure phone lines exist?

I could be out of context here about security, but , I would like to know if phone lines or phone calls over VOIP could be made secure . I know that Skype and other VOIP service providers have to ...
Sairam's user avatar
  • 723
29 votes
7 answers
9k views

What are some good website security scanning solutions? [closed]

What are some good web-based website security scanning solutions? I'm not too concerned if they are web-based solutions, or software that can be run locally. Generally, I'm looking for something we ...
Doozer Blake's user avatar
11 votes
3 answers
2k views

What free tools or techniques exist to discover anomalies in network flows?

I have been using FlowMatrix. What do others do on the cheap?
Tate Hansen's user avatar
  • 13.8k
15 votes
1 answer
2k views

Is there a list of default, standard or third-party "users" for Oracle?

When installed, and depending on which options it is installed with, there are a bunch of standard users pre-created in Oracle. Additionally, third-party software often has its own set of schemas/...
Gary's user avatar
  • 894
11 votes
2 answers
4k views

Is there a benefit in using Oracle's WRAP to obfuscate PL/SQL Code

Oracle stored program units (procedures, functions, packages and types) can be obfuscated using the WRAP functionality. Apart from the generic arguments about 'security through obscurity' are there ...
Gary's user avatar
  • 894
25 votes
8 answers
34k views

Can I detect web app attacks by viewing my Apache log file? [closed]

I occasionally get clients requesting I look at their access_log file to determine if any web attacks were successful. What tools are helpful to discern attacks?
Tate Hansen's user avatar
  • 13.8k
8 votes
3 answers
2k views

How to determine whether site is secure from common user's point of view?

What should be done (or at least declared) so end-users, visitors will start trusting your website? Some thoughts: secured login (via https) privacy policy (hidden email and other private ...
garik's user avatar
  • 1,292
81 votes
5 answers
37k views

What techniques do advanced firewalls use to protect againt DoS/DDoS?

It is hard to protect a server against Denial of Service attacks, DoS/DDoS. The two simple ways I can think of is to use a server with much resources (e.g. CPU and memory), and to build the server ...
Jonas's user avatar
  • 5,223
14 votes
2 answers
2k views

What is the best way to verify the SSL configuration of my web server?

How do I ensure I have my SSL configuration setup securely?
Tate Hansen's user avatar
  • 13.8k
12 votes
3 answers
2k views

What are the pros/cons of using a threat detection system?

What are the pros/cons of using a threat detection system for a web app (like OWASP's AppSensor)? What does a properly implemented threat detection system do and how does it behave when it detects ...
VirtuosiMedia's user avatar
22 votes
1 answer
3k views

Is it secure to connect to a remote Windows Server using Remote Desktop only?

I have a Windows Server that I login to from my home. I only use the pre-installed Remote Desktop. Is this a secure way to remote login or should I improve it in some way? If I should improve it, ...
Jonas's user avatar
  • 5,223
51 votes
3 answers
115k views

How can I check that my cookies are only sent over encrypted https and not http?

I read a blog post GitHub moves to SSL, but remains Firesheepable that claimed that cookies can be sent unencrypted over http even if the site is only using https. They write that a cookie should be ...
Jonas's user avatar
  • 5,223
16 votes
8 answers
3k views

Password management/synchronization?

Is there a good enough service I could run on my own home (Linux) server that I could use for storing/accessing/synchronizing passwords so they could be available for me from multiple computers/places?...
tkit's user avatar
  • 3,362
19 votes
5 answers
3k views

Is Google Chrome a more secure browser?

I was amazed that IE 8, Safari, Firefox were hacked so fast at Pwn2Own 2010. Is Chrome really so good or was it not tested? Has anyone other results of independent investigations about security of ...
garik's user avatar
  • 1,292
29 votes
5 answers
6k views

Professional certifications for IT Security [closed]

Which credentials of the sub-list of IT certifications (as per the Information Systems Security Association) would be considered MUST HAVE for a IT Security specialist? CEH Certified Ethical Hacker ...
Eric Warriner's user avatar
35 votes
6 answers
10k views

Does it matter which Certificate Authority I source my SSL Certificate from?

To secure my web site with HTTPS, does it matter which company I source my SSL certificate from, or just that the browser recognizes it? From the Area51 proposal.
AviD's user avatar
  • 73.4k
55 votes
9 answers
58k views

Feeding /dev/random entropy pool?

Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
tkit's user avatar
  • 3,362
26 votes
9 answers
30k views

What cryptographic algorithms are not considered secure? [closed]

What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
Olivier Lalonde's user avatar
106 votes
11 answers
32k views

Best practices for Apache Server hardening?

What are some best practices, recommendations, required reading for securing an Apache Server?
Eric Warriner's user avatar
23 votes
5 answers
5k views

What are the best practices for mitigating zero day attacks?

What are best practices / recommendations / strategies for mitigating zero day threats/attacks from a software development perspective?
Eric Warriner's user avatar
13 votes
7 answers
3k views

Is an IP address blacklist good practice to prevent website attacks?

My website has a blacklist of IP addresses. The web application, in some way, detects all invalid, suspicious influences to it and remembers IP address and denies any requests from that IP address. ...
garik's user avatar
  • 1,292
21 votes
4 answers
5k views

How to keep a shared web hosting server secure?

What are the ways of keeping a shared LAMP server secure, assuming SSH access is available for every user? Edit: I am mainly thinking of securing the server from the users themselves and between ...
Olivier Lalonde's user avatar
80 votes
6 answers
16k views

How to disclose a security vulnerability in an ethical fashion?

How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
Olivier Lalonde's user avatar
23 votes
5 answers
3k views

What is the best option for setting up a several sites supporting SSL on the same IP?

If multiple hostnames are hosted on the same IP, it's not straight forward to allow them to support https. What are the best options in terms of browser support and/or web server support?
Erlend's user avatar
  • 2,255
67 votes
6 answers
36k views

How to Securely Implement a "Remember Me" Feature?

Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
colithium's user avatar
  • 883
24 votes
5 answers
3k views

Good session practices

What are some good practices for ensuring logins, session IDs and session content are secure for a website?
James T's user avatar
  • 1,893
46 votes
8 answers
6k views

What methods are available for securing SSH? [closed]

What methods are available for securing SSH?
Olivier Lalonde's user avatar
22 votes
7 answers
2k views

Computer Forensics: what is in your toolbox?

What tools do you use for collecting evidence, making disk images, inspecting live memory and so on?
gbr's user avatar
  • 2,020
63 votes
16 answers
57k views

What tools are available to assess the security of a web application?

What tools are available to assess the security of a web application? Please provide a small description of what the tool does. Update: More specifically, I'm looking for tools that assume no ...
Olivier Lalonde's user avatar
16 votes
3 answers
3k views

ASP.NET MVC Security Check List

I am planning to start a new web site on ASP.NET MVC 2 (3). Does anybody have a full (if possible) check list of actions or approaches I should go through to avoid most security issues?
garik's user avatar
  • 1,292
24 votes
4 answers
6k views

Should I use Suhosin for PHP?

Suhosin can be used to increase the security of your PHP application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps there. ...
Peter Smit's user avatar
  • 2,749
23 votes
4 answers
29k views

Which web server is more secure, Apache, nginx or lighttpd?

We are trying to decide which web server to choose for our PHP application. Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
Peter Smit's user avatar
  • 2,749
47 votes
5 answers
11k views

How to perform a security audit for a PHP application?

I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything. What steps should I take ...
VirtuosiMedia's user avatar
29 votes
5 answers
3k views

Is filtering of user input data enough, or should it be parsed?

In a web application there could be two approaches to mitigate XSS attacks: all the input data could be filtered (removing all 'bad' data), or the input could be parsed, tokenized and output with ...
Peter Smit's user avatar
  • 2,749
116 votes
18 answers
20k views

Does an established HTTPS connection mean a line is really secure?

From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
Peter Smit's user avatar
  • 2,749
23 votes
2 answers
4k views

Rails - protection against code injection and XSS

I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS? I know Rails tries to prevent ...
Magnus's user avatar
  • 1,204
30 votes
14 answers
4k views

Courses on "Secure Software Development" [closed]

This semester, I'm offering a course on "secure software development". The course is divided into three parts: Secure Software Engineering Reverse Engineering Secure Coding Do you know of any ...
Sadeq Dousti's user avatar
  • 1,514
12 votes
3 answers
821 views

Are bookmarklets safe with facebook data?

I usually play Mafia Wars and use bookmarklets like Spockholm, Arum, etc. Can these bookmarklets get my Facebook data when I run them, they usually ask to unframe the Facebook page? I was just ...
Nap's user avatar
  • 275
671 votes
4 answers
334k views

Do any security experts recommend bcrypt for password storage?

On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
Sam Saffron's user avatar
  • 6,795
27 votes
6 answers
9k views

Does prepending a salt to the password instead of inserting it in the middle decrease security?

I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
Arseni Mourzenko's user avatar
14 votes
4 answers
1k views

Wireless Activity Monitoring for PCI DSS Compliance

In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks: Is the presence of wireless access points tested for by using a wireless analyzer at ...
user avatar

15 30 50 per page
1
1379 1380 1381 1382
1383