183
votes
Accepted
Is HostGator storing my password in plaintext?
Yep, that's a big problem, especially if that was your old password (i.e. not a newly assigned one).
Technically, the password might be stored under reversible encryption rather than plain text, but ...
- 52.1k
82
votes
Is HostGator storing my password in plaintext?
Yes, they store passwords in plaintext or equivalent, and definitely transmit them in plain text. This was discovered in 2011.
This is confirmed HostGator being listed on Plaintext Offenders, as well ...
- 67.3k
65
votes
Why are SSL certificates an annual expense?
Let's start with the cynical view:
Certificate Authorities are for-profit companies, so they will charge as much as they are able to get away with!
More seriously, running a certificate authority is ...
- 59.3k
52
votes
Accepted
Domain about to expire. Afraid that new owners will spread malware
Unless your freeware is somewhat popular or used by high-value targets, its usefulness for conducting supply chain attacks is probably limited. If the domain name enjoys good SEO, I would rather ...
- 8,465
43
votes
Accepted
Pentesting against own web service hosted on 3rd party platform
In general, you're correct you'll need the permission of the hosting company where you are scanning services deployed on their infrastructure. This is partially so that their Intrusion Detection ...
- 62.6k
42
votes
Accepted
Accessing multiple sites via HTTPS produces different, unrelated content (Peugeot club via HTTPS)
This is likely a server misconfiguration, since all those websites are served from 95.173.215.72.
When opening one of the websites via HTTPS, my browser warns me that the certificate common name, ...
- 14.7k
36
votes
Accepted
Why are SSL certificates an annual expense?
It's easy to think that the certificate has a limited lifetime just in order to charge a recurring fee, but it is actually the other way around: a certificate has a limited lifetime, and therefore you ...
- 3,920
20
votes
Domain about to expire. Afraid that new owners will spread malware
Cost makes a big difference. Some people think keeping a domain means spending hundreds of dollars a year because "that's what we've always paid", but that really is not the case.
If the ...
12
votes
Accessing multiple sites via HTTPS produces different, unrelated content (Peugeot club via HTTPS)
You might also be asked to add a temporary security exception to view the content.
This is a typical issue when multiple sites share the same IP address and some of these have HTTPS enabled and some ...
- 208k
11
votes
Why are SSL certificates an annual expense?
During the lifetime of the certificate, the CA must be able to revoke it, that means:
maintaining the list of revoked certificates (CRL)
responding to clients asking for the revocation status (OCSP).
...
- 2,105
9
votes
Accepted
Suspicious "100% guaranteed" web hosting security package
A few things worth noting (expanding on my comment, so I can elaborate a bit more).
He claimed there was a 100% guarantee that no attack could bypass their security.
This claim can never be verified....
- 9,227
7
votes
Pentesting against own web service hosted on 3rd party platform
You should also check with your ISP. Depending on government regulations and their own operating policies, they could be required to block your pentest actions if detected, or cancel your service ...
- 71
6
votes
Is email forwarding an altogether unsafe practice?
You're right, but consider this:
Most E-Mail traffic happens in plain text. E-Mails take several hops while being routed to the target mail server. All the routers in between can read the email if ...
- 9,293
6
votes
Find Security Flaws in My Payment Page
Stored in .html (Ensure nothing can be injected by the DB or exploitable server-side scripts, such as PHP).
For this I would break everything down into modular components and work from there:
Harden ...
- 1,877
5
votes
Dealing with the dangers of self-hosting a webserver?
Sounds like you've done a good job doing taking care of the usual suspects.
How good is your web development skills? In my work experience, misconfigured web servers are the most common threat vector ...
- 1,905
5
votes
Risk of getting MySQL database compromised with a client application
Yes and no.
First the no: As you have realized, if any data you put in an app that you send to a client can be extracted from it. You can take steps to make it harder to find the password (...
- 31.7k
4
votes
Accepted
Are Anti DDoS server farms really effective?
In my experience, there is no such thing as 100% DDoS protection. The largest DDoS cyber-attacks ever recorded have reached and exceed 1Tbps. Even if some company claims that they can protect you ...
- 291
4
votes
Accepted
Can I use the same ssl cert to protect my web site and sign my app?
No.
The long version follows. I simplified a few things, so don't take every single statement as gospel, but the basic principles are correct.
You can't use the same certificate. You may be ...
4
votes
Is HostGator storing my password in plaintext?
If the company rep's response is true, the Password is stored as an encrypted text. This makes the plain text password in unprompted email a bigger concern.
is it safe to assume that my password is ...
- 2,732
3
votes
How to decide where to host an online store?
This is hardly a security question but I can give you some pointers.
... can (and will) accumulate large parts of our customer database.
This is normally handled by contract law. (or to be more ...
- 9,063
3
votes
Accepted
dangers of using WAMPServer on my home PC?
Port forwarding to your PC is almost always a bad idea. Also to run a webserver on the machine. If configured wrongly, which could well be the case, it could leak out a lot of personal information to ...
- 146
3
votes
Suspicious "100% guaranteed" web hosting security package
Rule one: Never, ever believe what the sales guy tells you
Rule two: be very suspicious of what the sales guy commits to in contract
Rule three: measure the promises made
You seem to be heeding ...
- 18.8k
3
votes
Accepted
Are my website visitor's protected more if i use a vpn while self-hosting website
If your site uses a VPN, then the connection from your web server to the VPN server is encrypted. The connection between the visitor and the VPN server is not encrypted. The visitors do not get the ...
- 132k
3
votes
What are the techniques to know if VPS cloud hosting provider is accessing my data?
No, this is impossible.
They can bypass the OS and any other code you have running by simply cloning the hard-drive and looking at it. Even if the drive is encrypted, they control all the ways you ...
- 8,275
3
votes
Accepted
Would my IP be recorded when I visit a website
The website admin certainly knows your IP Address. If they didn't they couldn't send you the website you requested. Whether or not they record your address or try to track you is entirely up to them.
...
- 31.7k
3
votes
Domain about to expire. Afraid that new owners will spread malware
I wouldn't worry too much about them spreading malware on your domain unless it was fairly prominent, it just wouldn't be worth the effort.
What you do need to make sure of though is that any accounts ...
- 194
2
votes
Pentesting against own web service hosted on 3rd party platform
Additional to the ISP consideration as per the answer of "Mike Lane", put in mind that also you are going to pentest over networks that are properties of a different entities that belong to the state ...
- 1,872
Only top scored, non community-wiki answers of a minimum length are eligible