Preventing a system from unauthorized access, modification, disruption, or destruction.
49
votes
10answers
2k views
Storing credit card details
I need to store credit card numbers for recurring billing through our 3rd party merchant.
Are there any standards I need to adhere to regarding the storage of the details? We've been accepting credit ...
34
votes
9answers
980 views
Tools to check for common vulnerabilities?
Are there any good tools (desktop or online) which allow you to check whether your website has common vulnerabilities (e.g. SQL Injection, XSS)?
13
votes
4answers
228 views
Prevent possible spammer from linking to my site
We own a website which, through google search results, we determined is either being linked to improperly or for spam purposes by another completely random source.
They recently registered a domain ...
13
votes
2answers
412 views
If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from?
If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from? Are some SSL certificate vendors better than others? If so, why?
11
votes
6answers
2k views
How Can I Secure A VPS Installation?
What are the basic steps to securing a VPS installation that I plan to install Webmin on to host my blogs and personal projects?
11
votes
3answers
124 views
Is it sufficient to secure a order status page just by a random URL?
After a (corporate) customer bought some items in our online shop, we send an email with an overview what he has bought to him.
We'd like to inform our customer about received payments, packet ...
9
votes
3answers
2k views
what is wwws.site.com
I know about https for securing important pages like login and such. But why would someone create a separate subdomain like wwws as well? for example
https://wwws.site.com/login
9
votes
1answer
292 views
Why chmod 777 is not secure?
chmod 777 file change the permissions of the file file to read, write,
and execute for all.
Ok, so the file can be manipulated in any way by any script on the server. But why is this not ...
9
votes
5answers
158 views
Is PCI compliance scrutinised?
After reading the very strongly worded recommendations regarding the storage of credit card details here, I've got to wonder - what happens if a non-PCI compliant company starts storing credit card ...
9
votes
1answer
244 views
Is an externally-hosted subdomain a security risk?
A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company ...
9
votes
1answer
506 views
How did Google manage to crawl my 403 pages?
I had a couple private files in a directory on my school folder. You could see that the files existed by going to myschool.edu/myusername/myfolder, but trying to access the files themselves via ...
8
votes
8answers
335 views
What are the reasons to have a two step login? (Username on one page, password on the second.)
So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an ...
8
votes
2answers
418 views
Forum Spam Question. Why are Chinese hackers posting tiny images on my forum
My forum is getting attacked by spammers with Chinese IP's.
Replies are created to discussion topics, always short responses and along with the response an image is inserted using forum code which is ...
8
votes
2answers
777 views
How to find domain registrar and DNS hosting with good DNSSEC support?
Simplified problem
I want to buy a domain and make a website that is fully secured with DNSSEC.
I want to make sure that only the one right SSL certificate could be validated by the browsers and all ...
7
votes
2answers
159 views
Does the 'Server' header serve any purpose?
For example, when I dump the response header for my server I get:
Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.5 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g
Is this used for anything? Is ...
7
votes
5answers
374 views
Better Spam Protection than reCAPTCHA?
I hope this is a valid question to ask here... but knows anyone a better spam protection than reCAPTCHA? We've now using reCAPTCHA for some time but got now the situation that obviously more and more ...
7
votes
3answers
931 views
Important fields in HTTP header from security perspective
What are the Important fields in HTTP header from security perspective? I tried to google it but unable to find. Can anybody provide me a link to read about it? Thanks in advance.
7
votes
1answer
140 views
Is there any good reason I would want my website to be framed?
I'm building a website that's not security-critical in any way at all, so having somebody put a page in an <iframe> is not particularly dangerous to its users. However, as my website doesn't ...
7
votes
3answers
112 views
Found Odd File on Site: Should I Be Concerned?
I found a php file that was uploaded to our web server that had sneaked past our form validation. I did some searching and there was very little information regarding this file, however the small ...
7
votes
2answers
425 views
Does SSL really matter for most websites?
I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL.
I've read plenty of ...
7
votes
3answers
172 views
How should a site respond to automated login attempts with phony usernames?
For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
7
votes
3answers
1k views
Prevent spam using Honey Pots
I am really curious about how to prevent comment spam in a forum using a honey pot trap for spam bots.
What if CSS and javascript is turned off in a browser?
Do you see any other disadvantages in ...
7
votes
2answers
2k views
How to use cookies in a secure manner to authenticate users?
In most cases I like using cookies to remember returning users to my websites.
In my early/foolish days, I would store a UserID (auto-increment integer) in a cookie and if the user returned I would ...
6
votes
4answers
664 views
Are “trustmarks” such as McAfee Secure worth the cost?
There are a number of services that will scan a website for vulnerabilities and allow the display of a "trustmark" image if the site passes their tests. This allegedly increases the level of trust a ...
6
votes
3answers
330 views
Using two salts for user authentication?
When storing user credentials in a database, we all know that hashing the password is the bare minimum you should do, but salting it before hashing is better. The salt should be randomly generated, ...
6
votes
5answers
203 views
What do I need to do to enable my site to accept credit cards?
I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
6
votes
5answers
4k views
Identify “non-secure” content IE warns about
As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
6
votes
1answer
155 views
Security: Hide mysql connection details file
Ok, so I know this must be a very basic question, but my problem is the following: I have developed my first PHP mini-app (so I'm fairly new to this) and I am pretty sure that there are two files of ...
6
votes
3answers
236 views
How to fix a site that Google tells you is infected
I work for a company that setup a website, this one thelinearshop.com (warning this site contains malware so don't go there if you are concerned), before I started working for them. The site uses ...
6
votes
4answers
179 views
Webhosting company able to unhash passwords?
Tonight I was using the cPanel of a web-site I host and when I went to change the password I received a warning that I couldn't change the password to my desired password because it was too similar to ...
6
votes
2answers
113 views
Does https site needs extra configuration after installation of SSL certificate?
I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data).
...
6
votes
3answers
168 views
How would you establish user credibility for your web app?
One of the problems with general public facing apps is to deal with fake user accounts. Using an Open ID service doesn't solve this, as anyone can open multiple Google accounts and register as many ...
6
votes
2answers
121 views
Using WordPress for large collaborative site
I work for a government agency, and we're thinking about creating a new, fairly large site using WordPress as the platform. It would involve allowing quite a few people around the state access to the ...
6
votes
1answer
101 views
What secure domain registry services exist?
I'm using a domain registry service that only requires a username and password to log in. Are there any domain registry services that require a second factor in addition to a password?
6
votes
1answer
4k views
Thawte/GeoTrust/VeriSign 2048 Bit Root migration and Intermediate SSL Certificates
Thawte, GeoTrust, VeriSign and other Certificate Authorities are currently in the process of changing from a 1024 bit MD5 based root certificate to a 2048 bit SHA-1 based root to "keep in line with ...
5
votes
7answers
409 views
Hacked by our own hosting company!
OK, so our hosting company decided to clone our site and database onto a new serve. Without our knowledge or permission they then edited our code to point to the new database. The old server was left ...
5
votes
4answers
392 views
404 page echoing request URI - security risk?
I just noticed the default 404 page on one of my hosting accounts displays the requested URI.
<!--#echo var="REQUEST_URI" -->
I faintly remember hearing or reading that this is a potential ...
5
votes
3answers
277 views
How To Hide From BuiltWith?
Out of curiosity, does anyone know how builtwith.com works? How does it identify the platform or app a website is using? And most importantly does anyone know how to hide the details from it?
Somehow ...
5
votes
2answers
2k views
How can I secure an installation of MediaWiki?
I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
5
votes
1answer
237 views
A bounce-rate attack to manipulate SEO?
This is a question to experienced people that might help us shed some light on the issue.
We noticed a very strange behavior on our site, in Google Analytics.
Some dude from Finland, namely, from ...
5
votes
3answers
532 views
Disadvantages of a fake phpMyAdmin honeypot that causes ip blacklisting and robots.txt disallow/exclusion of the honeypot?
I'm trying to figure out whether I should set up a honeypot system with a fake phpMyAdmin (site gets hits all the time with people spidering for insecurities with that app).
My thought was to create ...
5
votes
2answers
317 views
Online gift certificates: Systems to avoid fraud
What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)?
I'm looking to ...
5
votes
1answer
86 views
Is it necessary for a web developer to know how to hack website?
I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?
5
votes
2answers
168 views
Managing accounts on a private website for a real-life community
I'm looking at setting-up a walled-in (i.e. mostly private, with a small public-facing login page) website for a real-life community of people, and I was wondering if anyone has any experience with ...
5
votes
1answer
85 views
Hiring security auditors…what should I know?
I want to hire someone to do a security audit of my website but I'm not sure how to go about it. Where are good places to look for an auditor? Besides a list of referrals, what should I be looking ...
5
votes
3answers
181 views
PayPal Basic vs PayPal Pro and credit card security
This link provides a comparison between PayPal Basic and PayPal Pro plans. To me basic PayPal is ideal but I need to be able to transfer funds between two PayPal accounts and for that I have to ...
4
votes
5answers
668 views
Site compromised .htaccess files everywhere
Some of the sites we're hosting are compromised by... I don't know what.
Every directory on the webserver contains a .htaccess file which redirects a user coming from a search engine to a page which ...
4
votes
2answers
299 views
How does amazon get away without verifying emails?
I was playing around with Amazon's Check out process today and I noticed something odd. Amazon does not make you activate your account or verify your email address. I only had to enter my email twice ...
4
votes
1answer
82 views
What makes a SSL certificate “signed”?
When you buy a SSL certificate from Comodo, it is signed by Comodo and therefore trusted. How is it signed though? Why can't anyone sign the certificate pretending to be Comodo?
4
votes
4answers
567 views
PCI DSS compliance for a VPS using Centos
I have a VPS with linode, great hosting by the way.
I am confident with centos apache ect but I know nothing about PCI DSS compliance, I usually let SagePay or PayPal deal with it.
But I have a ...
