All Questions
69,325
questions
55
votes
9
answers
58k
views
Feeding /dev/random entropy pool?
Which way of additionally feeding /dev/random entropy pool would you suggest for producing random passwords? Or, is there maybe a better way to locally create fully random passwords?
- 3,382
26
votes
9
answers
30k
views
What cryptographic algorithms are not considered secure? [closed]
What cryptographic algorithms are not considered secure, but yet are still widely used and available in standard libraries? If applicable, mention a secure alternative.
- 5,119
106
votes
11
answers
32k
views
Best practices for Apache Server hardening?
What are some best practices, recommendations, required reading for securing an Apache Server?
- 3,371
23
votes
5
answers
5k
views
What are the best practices for mitigating zero day attacks?
What are best practices / recommendations / strategies for mitigating zero day threats/attacks from a software development perspective?
- 3,371
13
votes
7
answers
3k
views
Is an IP address blacklist good practice to prevent website attacks?
My website has a blacklist of IP addresses. The web application, in some way, detects all invalid, suspicious influences to it and remembers IP address and denies any requests from that IP address.
...
- 1,292
21
votes
4
answers
5k
views
How to keep a shared web hosting server secure?
What are the ways of keeping a shared LAMP server secure, assuming SSH access is available for every user?
Edit: I am mainly thinking of securing the server from the users themselves and between ...
- 5,119
80
votes
6
answers
16k
views
How to disclose a security vulnerability in an ethical fashion?
How to disclose a security vulnerability in an ethical way? I've heard there are various schools of thought on this topic. I'd like to know the pros/cons of each.
- 5,119
23
votes
5
answers
3k
views
What is the best option for setting up a several sites supporting SSL on the same IP?
If multiple hostnames are hosted on the same IP, it's not straight forward to allow them to support https. What are the best options in terms of browser support and/or web server support?
- 2,255
68
votes
6
answers
36k
views
How to Securely Implement a "Remember Me" Feature?
Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let'...
- 893
24
votes
5
answers
3k
views
Good session practices
What are some good practices for ensuring logins, session IDs and session content are secure for a website?
- 1,893
46
votes
8
answers
7k
views
What methods are available for securing SSH? [closed]
What methods are available for securing SSH?
- 5,119
22
votes
7
answers
2k
views
Computer Forensics: what is in your toolbox?
What tools do you use for collecting evidence, making disk images, inspecting live memory and so on?
- 2,020
63
votes
16
answers
57k
views
What tools are available to assess the security of a web application?
What tools are available to assess the security of a web application?
Please provide a small description of what the tool does.
Update: More specifically, I'm looking for tools that assume no ...
- 5,119
16
votes
3
answers
3k
views
ASP.NET MVC Security Check List
I am planning to start a new web site on ASP.NET MVC 2 (3).
Does anybody have a full (if possible) check list of actions or approaches I should go through to avoid most security issues?
- 1,292
24
votes
4
answers
6k
views
Should I use Suhosin for PHP?
Suhosin can be used to increase the security of your PHP application. I can really see the use of it when you are using shared hosts, with multiple (possibly evil) people running their PHP apps there.
...
- 2,749
23
votes
4
answers
29k
views
Which web server is more secure, Apache, nginx or lighttpd?
We are trying to decide which web server to choose for our PHP application.
Which of Apache, nginx or lighttpd is the most secure? Which of these has had the most and most severe security holes?
- 2,749
47
votes
5
answers
11k
views
How to perform a security audit for a PHP application?
I have a PHP application that I would like to have audited for security. I'm familiar with most of the general security issues, but want to make sure I didn't miss anything.
What steps should I take ...
- 3,252
29
votes
5
answers
3k
views
Is filtering of user input data enough, or should it be parsed?
In a web application there could be two approaches to mitigate XSS attacks:
all the input data could be filtered (removing all 'bad' data), or
the input could be parsed, tokenized and output with ...
- 2,749
116
votes
18
answers
20k
views
Does an established HTTPS connection mean a line is really secure?
From the view of somebody offering a web application, when somebody connects with TLS (https) to our service and submits the correct authentication data, is it safe to transmit all sensitive data over ...
- 2,749
23
votes
2
answers
4k
views
Rails - protection against code injection and XSS
I've started using Ruby on Rails, and I was wondering if there were any security gotchas to watch out for with Rails, particularly regarding code injection and XSS?
I know Rails tries to prevent ...
- 1,204
30
votes
14
answers
4k
views
Courses on "Secure Software Development" [closed]
This semester, I'm offering a course on "secure software development". The course is divided into three parts:
Secure Software Engineering
Reverse Engineering
Secure Coding
Do you know of any ...
- 1,514
12
votes
3
answers
824
views
Are bookmarklets safe with facebook data?
I usually play Mafia Wars and use bookmarklets like Spockholm, Arum, etc. Can these bookmarklets get my Facebook data when I run them, they usually ask to unframe the Facebook page?
I was just ...
- 275
671
votes
4
answers
335k
views
Do any security experts recommend bcrypt for password storage?
On the surface bcrypt, an 11 year old security algorithm designed for hashing passwords by Niels Provos and David Mazieres, which is based on the initialization function used in the NIST approved ...
- 6,795
27
votes
6
answers
9k
views
Does prepending a salt to the password instead of inserting it in the middle decrease security?
I read somewhere that adding a salt at the beginning of a password before hashing it is a bad idea. Instead, the article claimed it is much more secure to insert it somewhere in the middle of the ...
- 4,794
14
votes
4
answers
1k
views
Wireless Activity Monitoring for PCI DSS Compliance
In an effort to be PCI DSS compliant, I took a trustkeeper.net questionnaire. I failed the question that asks:
Is the presence of wireless access points tested for by using a wireless analyzer at ...
dkusleika