Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

1
vote
0answers
162 views

Is posting a document with a hand signature insecure? [closed]

Every once and a while, one of our departments would like to post a hand-signed document on the web site. Up until now I've scanned them in as a PDF and posted them without much thought, but recently ...
4
votes
3answers
98 views

How Do You Store Website Backups?

I'm not that great about backing up my site, which is something I want to improve on. Currently, I save backups of my site on my local computer and on an external thumb drive. I was thinking of ...
10
votes
1answer
405 views

Is an externally-hosted subdomain a security risk?

A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company ...
4
votes
2answers
178 views

what is website security verification?

I have an ecommerce website and I recently came accross a web page that talks about cyber crime and this has got me wondering what website security verification means. I saw this and I am a bit ...
8
votes
8answers
478 views

What are the reasons to have a two step login? (Username on one page, password on the second.)

So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an ...
7
votes
5answers
224 views

What do I need to do to enable my site to accept credit cards?

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
3
votes
1answer
1k views

How do I save user uploaded files outside of the web folder but use them on my page?

I have read that one of the best things to do for security with user uploaded files is to store them outside of the web folder, as there is very little you can do to ensure that that jpg image the ...
1
vote
1answer
1k views

What is best practice for securing access to GMail for an enterprise?

Is there any way to restrict access to Gmail accounts from certain IP/MAC addresses ? For instance, can I setup Google Apps so that my users can access their GMail account from within the corporate ...
2
votes
2answers
458 views

Keeping files private on the internet (.htaccess password or software/php/wordpress password)

I was asked a while ago to setup a server such that only authenticated users can access files. It was like a test server for clients to view WIP sites. More recently, I want to do something similar ...
0
votes
3answers
405 views

MODX based site has been compromised, and tagged by Google as malware

I'm the webmaster (inherited the site from the developer) for a site called kenbrook.org. The site is currently being tagged as malware infected by Google, and gives the following details: ...
3
votes
1answer
244 views

User registration usability vs security

What are cons and pros of the following: asking to repeat password asking to have a certain length-password asking to repeat e-mail address using captcha sending confirmation e-mail what do you ...
1
vote
3answers
113 views

What are some internet trends that you've noticed over the past ~10 years? [closed]

I'll give an example of one that I've noticed: the number of web sites that ask for your email address (GOOG ID, YAHOO! ID, etc.) has skyrocketed. I can come up with no legitimate reason for this ...
0
votes
2answers
362 views

block users by country in .htaccess

Is there a way to block users from a particular region. Currently I have compiled a list of over 100 IP addresses that I block in my .htaccess file. Unfortunately as the list grows I see a great ...
2
votes
1answer
179 views

A single request appears to have come from all the browsers? Should I be worried?

I was looking over my site access logs when I noticed a request with the following user agent string: "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 ...
1
vote
0answers
296 views

Does the Adblock Plus extension prevent malicious code from downloading/executing? [closed]

Firefox and Chrome are my favourite browsers. The main reason is an extension called Adblock Plus. Basically, it blocks all the ad networks if you subscribe to one of the lists, like EasyList. Does it ...
0
votes
1answer
141 views

Free forum engine with good anti-attack mechanisms [duplicate]

Possible Duplicate: What Forum Software should I use? I am looking for forum engine (for discussions) with good attack countermeasures built in. Windows (preferrably) or Linux. Free (as ...
0
votes
1answer
252 views

Developing payment gateway

I have an idea of developing internet payment gateway similar to PayPal or Webmoney. Since i'm only sophomore at Computer Science, and i've only taken intermediate programming classes, i've no idea ...
1
vote
1answer
129 views

Is there a way of listing files for a directory if it contains index.html?

On my server (over which I have little control), directories are listed by default, so for mysite.com/images I get: Index of /images Parent Directory BirdsAreHere.png ...
7
votes
3answers
211 views

How should a site respond to automated login attempts with phony usernames?

For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
1
vote
3answers
262 views

Are there any security considerations if users are allowed to upload flash files

Lets say I have a website where users are allowed to upload files which will be displayed publicly as a portfolio gallery. For example, users might upload screenshots of a website they designed, or a ...
1
vote
1answer
66 views

Problematic using Captcha on billing page

I have simple captcha on user page. I want make it refresh if user input incorrect captcha, I just wanna ask Should I do it or I just add a simple button to refresh it.
1
vote
1answer
414 views

scorecardresearch dot com: weird tracking pixel

I'm seeing very weird behaviour in relation to this domain and a tracking image. On a specific page on our site, I'm seeing a script that's being added dynamically, apparently via flash (I wasn't even ...
1
vote
1answer
145 views

What is the purpose of the appserv_root requests?

I see a lot of requests for nonexistent php files on my website. They tend to have a querystring like appserv_root=http://www.example.com, using domains with evil-looking php code. I am pretty ...
0
votes
1answer
144 views

Why does my certificate provider ask me to disable its root certificate?

I received an SSL certificate from GoDaddy yesterday and their instructions to install the certificate seemed weird. To be precise, they asked me to disable their root certificate in server. NOTE: ...
1
vote
1answer
731 views

Significant number of non-HTTP requests hitting my site

I'm seeing a significant number of non-HTTP requests hitting a site I just launched. They show up in the server (nginx) logs as non-ASCII and get rejected (correctly) with a 400 status. Here are ...
1
vote
3answers
143 views

Security considerations for my first eStore

I have a website through which I am going to sell few products. It is hosted on a simple shared-hosting and does not have SSL. On the products page, each product has a Buy Now button created from my ...
4
votes
2answers
346 views

How does amazon get away without verifying emails?

I was playing around with Amazon's Check out process today and I noticed something odd. Amazon does not make you activate your account or verify your email address. I only had to enter my email twice ...
-1
votes
1answer
2k views

Best free Vulnerability Scanners that check your websites PHP & MySQL code? [duplicate]

Possible Duplicate: Best free Vulnerability Scanners that check your websites PHP & MySQL code? I'm looking for a free vulnerability scanner to check whether my website has common ...
2
votes
1answer
98 views

Web Directories Monitor Script

I have some troubles with injections on my shared hosting account where I run a lot of sites with a lot of different technologies: wordpress, drupal, joomla, osticket etc... I installed wordpress ...
0
votes
1answer
155 views

Controlling Access using htpasswd and htaccess

I've got a bit of a peculiar problem on my site. I'm using a .htaccess and .htpasswd file to protect the root of the site. This works great, but when I try to view a video file on my site, it prompts ...
10
votes
1answer
674 views

How did Google manage to crawl my 403 pages?

I had a couple private files in a directory on my school folder. You could see that the files existed by going to myschool.edu/myusername/myfolder, but trying to access the files themselves via ...
4
votes
2answers
1k views

How to help WikiLeaks remain up and running? [closed]

WikiLeaks is under a lot of attack. It has been ousted from DNS servers, Amazon has kicked it out. It is facing massive DDOS attacks. Under these circumstances what can WikiLeaks do to remain afloat? ...
2
votes
2answers
435 views

Restrict access to web directory with .htaccess

Let me just say that doing this sort of thing with .htaccess files has never been a strong point for me. Let's say that I have a directory in my web root: /dir/data Within that directory let's say ...
1
vote
1answer
469 views

Google Analytics shows 0 Visits?

I checked Analytics yesterday for pageviews, and had several hundred of them (for yesterday). Not today when I check "Yesterdays" stats (which yesterday showed several hundreds), it shows 0...? How ...
1
vote
1answer
1k views

iFrames from Skydrive: yes, no, how

I have a two-pronged question. First: SEO Concerns aside, should I be concerned about using iFrames on my site as far as viruses etc go? I am using skydrive to host my images and it provides an ...
0
votes
2answers
1k views

Godaddy - folder with password protection

Godaddy windows shared hosting on IIS6, but will probably migrate to IIS7 soon. Is there easy way to setup folder with password protection, so when I try to access secure folder, login dialog pops ...
2
votes
1answer
118 views

Looking for usability studies of user authentication methods and interfaces, do you know of any?

Been having issues with stackexchange creating weird usernames for me and grouping them with my account, it appears to be a known issue, and emailed the stackexchange team... which leads me to my ...
1
vote
1answer
180 views

Are there security risks involved in moving from a CMS that uses SQL to one that uses XML?

I've used a lot of content management systems in my day (drupal, wordpress, joomla, etc.) and they have all been database driven using MySQL. While the security updates for many CMS offerings out ...
6
votes
3answers
401 views

Using two salts for user authentication?

When storing user credentials in a database, we all know that hashing the password is the bare minimum you should do, but salting it before hashing is better. The salt should be randomly generated, ...
6
votes
3answers
310 views

How to fix a site that Google tells you is infected

I work for a company that setup a website, this one thelinearshop.com (warning this site contains malware so don't go there if you are concerned), before I started working for them. The site uses ...
1
vote
2answers
248 views

HTTP Server invalid request/connection throttling

I have a custom HTTP server. When F5 is held down in a browser the server gets slammed with requests. How can I detect and limit these (or any other) invalid connections? It seems that I would have ...
3
votes
5answers
324 views

Variable IPs: How variable are they? Best practices for tracking

There are a lot of questions on StackOverflow relating to session security / session hijacking, but there doesn't seem to be a really good solution to the problem. The three most common suggestions ...
16
votes
6answers
5k views

How Can I Secure A VPS Installation?

What are the basic steps to securing a VPS installation that I plan to install Webmin on to host my blogs and personal projects?
5
votes
4answers
632 views

404 page echoing request URI - security risk?

I just noticed the default 404 page on one of my hosting accounts displays the requested URI. <!--#echo var="REQUEST_URI" --> I faintly remember hearing or reading that this is a potential ...
7
votes
2answers
4k views

How to use cookies in a secure manner to authenticate users?

In most cases I like using cookies to remember returning users to my websites. In my early/foolish days, I would store a UserID (auto-increment integer) in a cookie and if the user returned I would ...
6
votes
1answer
5k views

Thawte/GeoTrust/VeriSign 2048 Bit Root migration and Intermediate SSL Certificates

Thawte, GeoTrust, VeriSign and other Certificate Authorities are currently in the process of changing from a 1024 bit MD5 based root certificate to a 2048 bit SHA-1 based root to "keep in line with ...
1
vote
5answers
688 views

How to prevent iframe virus? What are all the measures can be taken once affected by it?

Suddenly, I see some of my blog files(wordpress) contains some <iframe> tags with links to some websites. How does it happen? What do I have to do to remove this virus and clean my website? I ...
10
votes
5answers
189 views

Is PCI compliance scrutinised?

After reading the very strongly worded recommendations regarding the storage of credit card details here, I've got to wonder - what happens if a non-PCI compliant company starts storing credit card ...
6
votes
3answers
176 views

How would you establish user credibility for your web app?

One of the problems with general public facing apps is to deal with fake user accounts. Using an Open ID service doesn't solve this, as anyone can open multiple Google accounts and register as many ...
12
votes
2answers
41k views

Can I skip the PEM pass phrase question when I restart the webserver?

After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation in their SSL wiki page). Everything is fine, it works and I get a green ...