Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

10
votes
1answer
642 views

How did Google manage to crawl my 403 pages?

I had a couple private files in a directory on my school folder. You could see that the files existed by going to myschool.edu/myusername/myfolder, but trying to access the files themselves via ...
4
votes
2answers
1k views

How to help WikiLeaks remain up and running? [closed]

WikiLeaks is under a lot of attack. It has been ousted from DNS servers, Amazon has kicked it out. It is facing massive DDOS attacks. Under these circumstances what can WikiLeaks do to remain afloat? ...
2
votes
2answers
432 views

Restrict access to web directory with .htaccess

Let me just say that doing this sort of thing with .htaccess files has never been a strong point for me. Let's say that I have a directory in my web root: /dir/data Within that directory let's say ...
1
vote
1answer
462 views

Google Analytics shows 0 Visits?

I checked Analytics yesterday for pageviews, and had several hundred of them (for yesterday). Not today when I check "Yesterdays" stats (which yesterday showed several hundreds), it shows 0...? How ...
1
vote
1answer
1k views

iFrames from Skydrive: yes, no, how

I have a two-pronged question. First: SEO Concerns aside, should I be concerned about using iFrames on my site as far as viruses etc go? I am using skydrive to host my images and it provides an ...
0
votes
2answers
1k views

Godaddy - folder with password protection

Godaddy windows shared hosting on IIS6, but will probably migrate to IIS7 soon. Is there easy way to setup folder with password protection, so when I try to access secure folder, login dialog pops ...
2
votes
1answer
117 views

Looking for usability studies of user authentication methods and interfaces, do you know of any?

Been having issues with stackexchange creating weird usernames for me and grouping them with my account, it appears to be a known issue, and emailed the stackexchange team... which leads me to my ...
1
vote
1answer
173 views

Are there security risks involved in moving from a CMS that uses SQL to one that uses XML?

I've used a lot of content management systems in my day (drupal, wordpress, joomla, etc.) and they have all been database driven using MySQL. While the security updates for many CMS offerings out ...
6
votes
3answers
395 views

Using two salts for user authentication?

When storing user credentials in a database, we all know that hashing the password is the bare minimum you should do, but salting it before hashing is better. The salt should be randomly generated, ...
6
votes
3answers
287 views

How to fix a site that Google tells you is infected

I work for a company that setup a website, this one thelinearshop.com (warning this site contains malware so don't go there if you are concerned), before I started working for them. The site uses ...
1
vote
2answers
244 views

HTTP Server invalid request/connection throttling

I have a custom HTTP server. When F5 is held down in a browser the server gets slammed with requests. How can I detect and limit these (or any other) invalid connections? It seems that I would have ...
3
votes
5answers
318 views

Variable IPs: How variable are they? Best practices for tracking

There are a lot of questions on StackOverflow relating to session security / session hijacking, but there doesn't seem to be a really good solution to the problem. The three most common suggestions ...
16
votes
6answers
4k views

How Can I Secure A VPS Installation?

What are the basic steps to securing a VPS installation that I plan to install Webmin on to host my blogs and personal projects?
5
votes
4answers
592 views

404 page echoing request URI - security risk?

I just noticed the default 404 page on one of my hosting accounts displays the requested URI. <!--#echo var="REQUEST_URI" --> I faintly remember hearing or reading that this is a potential ...
7
votes
2answers
4k views

How to use cookies in a secure manner to authenticate users?

In most cases I like using cookies to remember returning users to my websites. In my early/foolish days, I would store a UserID (auto-increment integer) in a cookie and if the user returned I would ...
6
votes
1answer
5k views

Thawte/GeoTrust/VeriSign 2048 Bit Root migration and Intermediate SSL Certificates

Thawte, GeoTrust, VeriSign and other Certificate Authorities are currently in the process of changing from a 1024 bit MD5 based root certificate to a 2048 bit SHA-1 based root to "keep in line with ...
1
vote
5answers
683 views

How to prevent iframe virus? What are all the measures can be taken once affected by it?

Suddenly, I see some of my blog files(wordpress) contains some <iframe> tags with links to some websites. How does it happen? What do I have to do to remove this virus and clean my website? I ...
10
votes
5answers
181 views

Is PCI compliance scrutinised?

After reading the very strongly worded recommendations regarding the storage of credit card details here, I've got to wonder - what happens if a non-PCI compliant company starts storing credit card ...
6
votes
3answers
176 views

How would you establish user credibility for your web app?

One of the problems with general public facing apps is to deal with fake user accounts. Using an Open ID service doesn't solve this, as anyone can open multiple Google accounts and register as many ...
11
votes
2answers
33k views

Can I skip the PEM pass phrase question when I restart the webserver?

After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation in their SSL wiki page). Everything is fine, it works and I get a green ...
6
votes
2answers
124 views

Using WordPress for large collaborative site

I work for a government agency, and we're thinking about creating a new, fairly large site using WordPress as the platform. It would involve allowing quite a few people around the state access to the ...
14
votes
2answers
482 views

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from?

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from? Are some SSL certificate vendors better than others? If so, why?