Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

1
vote
1answer
170 views

Are there security risks involved in moving from a CMS that uses SQL to one that uses XML?

I've used a lot of content management systems in my day (drupal, wordpress, joomla, etc.) and they have all been database driven using MySQL. While the security updates for many CMS offerings out ...
6
votes
3answers
394 views

Using two salts for user authentication?

When storing user credentials in a database, we all know that hashing the password is the bare minimum you should do, but salting it before hashing is better. The salt should be randomly generated, ...
6
votes
3answers
275 views

How to fix a site that Google tells you is infected

I work for a company that setup a website, this one thelinearshop.com (warning this site contains malware so don't go there if you are concerned), before I started working for them. The site uses ...
1
vote
2answers
244 views

HTTP Server invalid request/connection throttling

I have a custom HTTP server. When F5 is held down in a browser the server gets slammed with requests. How can I detect and limit these (or any other) invalid connections? It seems that I would have ...
3
votes
5answers
315 views

Variable IPs: How variable are they? Best practices for tracking

There are a lot of questions on StackOverflow relating to session security / session hijacking, but there doesn't seem to be a really good solution to the problem. The three most common suggestions ...
16
votes
6answers
4k views

How Can I Secure A VPS Installation?

What are the basic steps to securing a VPS installation that I plan to install Webmin on to host my blogs and personal projects?
5
votes
4answers
574 views

404 page echoing request URI - security risk?

I just noticed the default 404 page on one of my hosting accounts displays the requested URI. <!--#echo var="REQUEST_URI" --> I faintly remember hearing or reading that this is a potential ...
7
votes
2answers
4k views

How to use cookies in a secure manner to authenticate users?

In most cases I like using cookies to remember returning users to my websites. In my early/foolish days, I would store a UserID (auto-increment integer) in a cookie and if the user returned I would ...
6
votes
1answer
5k views

Thawte/GeoTrust/VeriSign 2048 Bit Root migration and Intermediate SSL Certificates

Thawte, GeoTrust, VeriSign and other Certificate Authorities are currently in the process of changing from a 1024 bit MD5 based root certificate to a 2048 bit SHA-1 based root to "keep in line with ...
1
vote
5answers
677 views

How to prevent iframe virus? What are all the measures can be taken once affected by it?

Suddenly, I see some of my blog files(wordpress) contains some <iframe> tags with links to some websites. How does it happen? What do I have to do to remove this virus and clean my website? I ...
10
votes
5answers
180 views

Is PCI compliance scrutinised?

After reading the very strongly worded recommendations regarding the storage of credit card details here, I've got to wonder - what happens if a non-PCI compliant company starts storing credit card ...
6
votes
3answers
173 views

How would you establish user credibility for your web app?

One of the problems with general public facing apps is to deal with fake user accounts. Using an Open ID service doesn't solve this, as anyone can open multiple Google accounts and register as many ...
11
votes
2answers
31k views

Can I skip the PEM pass phrase question when I restart the webserver?

After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation in their SSL wiki page). Everything is fine, it works and I get a green ...
6
votes
2answers
122 views

Using WordPress for large collaborative site

I work for a government agency, and we're thinking about creating a new, fairly large site using WordPress as the platform. It would involve allowing quite a few people around the state access to the ...
14
votes
2answers
475 views

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from?

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from? Are some SSL certificate vendors better than others? If so, why?