Preventing a system from unauthorized access, modification, disruption, or destruction.

learn more… | top users | synonyms (1)

50
votes
10answers
4k views

Storing credit card details

I need to store credit card numbers for recurring billing through our 3rd party merchant. Are there any standards I need to adhere to regarding the storage of the details? We've been accepting credit ...
35
votes
9answers
2k views

Tools to check for common vulnerabilities?

Are there any good tools (desktop or online) which allow you to check whether your website has common vulnerabilities (e.g. SQL Injection, XSS)?
15
votes
6answers
4k views

How Can I Secure A VPS Installation?

What are the basic steps to securing a VPS installation that I plan to install Webmin on to host my blogs and personal projects?
14
votes
5answers
551 views

Force Using SSL on Site now?

I am starting to see a majority of websites starting to use SSL as a standard practice for viewing the website securely now thanks to the revelations of Edward Snowden about the NSA surveillance that ...
14
votes
2answers
460 views

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from?

If I need HTTPS / SSL encryption on my web site, does it matter who I get my certificate from? Are some SSL certificate vendors better than others? If so, why?
13
votes
1answer
193 views

Could somebody hijack my Google Analytics for a site?

I track many websites in Google Analytics. Recently I accidentally added tracking code for site A to site B, which I noticed a couple of weeks later. By then, one website had two weeks of no visitors, ...
13
votes
4answers
240 views

Prevent possible spammer from linking to my site

We own a website which, through google search results, we determined is either being linked to improperly or for spam purposes by another completely random source. They recently registered a domain ...
11
votes
3answers
138 views

Is it sufficient to secure a order status page just by a random URL?

After a (corporate) customer bought some items in our online shop, we send an email with an overview what he has bought to him. We'd like to inform our customer about received payments, packet ...
11
votes
2answers
3k views

How to find domain registrar and DNS hosting with good DNSSEC support?

Simplified problem I want to buy a domain and make a website that is fully secured with DNSSEC. I want to make sure that only the one right SSL certificate could be validated by the browsers and all ...
10
votes
2answers
548 views

Forum Spam Question. Why are Chinese hackers posting tiny images on my forum

My forum is getting attacked by spammers with Chinese IP's. Replies are created to discussion topics, always short responses and along with the response an image is inserted using forum code which is ...
10
votes
4answers
566 views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
10
votes
5answers
172 views

Is PCI compliance scrutinised?

After reading the very strongly worded recommendations regarding the storage of credit card details here, I've got to wonder - what happens if a non-PCI compliant company starts storing credit card ...
9
votes
3answers
3k views

what is wwws.site.com

I know about https for securing important pages like login and such. But why would someone create a separate subdomain like wwws as well? for example https://wwws.site.com/login
9
votes
1answer
411 views

Why chmod 777 is not secure?

chmod 777 file change the permissions of the file file to read, write, and execute for all. Ok, so the file can be manipulated in any way by any script on the server. But why is this not ...
9
votes
1answer
307 views

Is an externally-hosted subdomain a security risk?

A company I've been developing a web site for wants to keep their current domain, which is something like company.parentcompany.com. Because we wanted to use a different CMS, the parent company ...
9
votes
1answer
602 views

How did Google manage to crawl my 403 pages?

I had a couple private files in a directory on my school folder. You could see that the files existed by going to myschool.edu/myusername/myfolder, but trying to access the files themselves via ...
8
votes
2answers
23k views

Can I skip the PEM pass phrase question when I restart the webserver?

After buying a multi-domain SSL certificate I have started testing it with the Nginx webserver (following documentation in their SSL wiki page). Everything is fine, it works and I get a green ...
8
votes
8answers
382 views

What are the reasons to have a two step login? (Username on one page, password on the second.)

So I've recently been encountering more two step login processes, where I'm required to enter my username on one page and my password on a second. I really don't like this pattern, as it requires an ...
8
votes
4answers
1k views

Are “trustmarks” such as McAfee Secure worth the cost?

There are a number of services that will scan a website for vulnerabilities and allow the display of a "trustmark" image if the site passes their tests. This allegedly increases the level of trust a ...
8
votes
2answers
298 views

Does the 'Server' header serve any purpose?

For example, when I dump the response header for my server I get: Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.5 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g Is this used for anything? Is ...
8
votes
2answers
145 views

Are there any disadvantages to Cloudflare’s “Flexible SSL”?

Cloudflare let you serve your site over SSL without having to purchase and install a security certificate, a product they call “Flexible SSL”. (They act as a proxy and serve your site over SSL from ...
8
votes
3answers
2k views

Prevent spam using Honey Pots

I am really curious about how to prevent comment spam in a forum using a honey pot trap for spam bots. What if CSS and javascript is turned off in a browser? Do you see any other disadvantages in ...
7
votes
5answers
584 views

Better Spam Protection than reCAPTCHA?

I hope this is a valid question to ask here... but knows anyone a better spam protection than reCAPTCHA? We've now using reCAPTCHA for some time but got now the situation that obviously more and more ...
7
votes
3answers
1k views

Important fields in HTTP header from security perspective

What are the Important fields in HTTP header from security perspective? I tried to google it but unable to find. Can anybody provide me a link to read about it? Thanks in advance.
7
votes
5answers
216 views

What do I need to do to enable my site to accept credit cards?

I want to store my customers' credit card information in my database so that they can quickly check out again without having to re-enter their info. What do I need to know about security/https/etc to ...
7
votes
1answer
157 views

Is there any good reason I would want my website to be framed?

I'm building a website that's not security-critical in any way at all, so having somebody put a page in an <iframe> is not particularly dangerous to its users. However, as my website doesn't ...
7
votes
3answers
118 views

Found Odd File on Site: Should I Be Concerned?

I found a php file that was uploaded to our web server that had sneaked past our form validation. I did some searching and there was very little information regarding this file, however the small ...
7
votes
4answers
209 views

Webhosting company able to unhash passwords?

Tonight I was using the cPanel of a web-site I host and when I went to change the password I received a warning that I couldn't change the password to my desired password because it was too similar to ...
7
votes
3answers
198 views

How should a site respond to automated login attempts with phony usernames?

For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
7
votes
2answers
3k views

How to use cookies in a secure manner to authenticate users?

In most cases I like using cookies to remember returning users to my websites. In my early/foolish days, I would store a UserID (auto-increment integer) in a cookie and if the user returned I would ...
6
votes
3answers
383 views

Using two salts for user authentication?

When storing user credentials in a database, we all know that hashing the password is the bare minimum you should do, but salting it before hashing is better. The salt should be randomly generated, ...
6
votes
6answers
5k views

Identify “non-secure” content IE warns about [closed]

As many know, if you serve a page over https and the content loads resources (images, stylesheets, js, SWF objects, etc) over http, older versions of Internet Explorer will show the user a warning ...
6
votes
3answers
265 views

How to fix a site that Google tells you is infected

I work for a company that setup a website, this one thelinearshop.com (warning this site contains malware so don't go there if you are concerned), before I started working for them. The site uses ...
6
votes
3answers
157 views

Why don't we see websites hashing passwords before sending them? [closed]

(Note about the question title: by "we" I mean myself) Everytime I log on to any website, I have this thought that website asking me for my password and sending it back to the server is just basic ...
6
votes
1answer
529 views

Security: Hide mysql connection details file

Ok, so I know this must be a very basic question, but my problem is the following: I have developed my first PHP mini-app (so I'm fairly new to this) and I am pretty sure that there are two files of ...
6
votes
1answer
320 views

A bounce-rate attack to manipulate SEO?

This is a question to experienced people that might help us shed some light on the issue. We noticed a very strange behavior on our site, in Google Analytics. Some dude from Finland, namely, from ...
6
votes
2answers
600 views

Online gift certificates: Systems to avoid fraud

What good methods are there out there for avoiding fraud with electronic gift certificates (ones which are created and the information distributed electronically via website)? I'm looking to ...
6
votes
2answers
153 views

Does https site needs extra configuration after installation of SSL certificate?

I recently developed an incentive website for a European bank, and one of the requirements was SSL - the website displays some personal customer data (though no financial or really sensitive data). ...
6
votes
3answers
205 views

Is website security accreditation worth having?

My site handles sensitive data, is there any website security accreditation that is well respected and worth having?
6
votes
1answer
95 views

Is it necessary for a web developer to know how to hack website?

I'm a web developer. I'm just wondering that is it necessary for a web developer to know how to hack website than developing a website?
6
votes
3answers
171 views

How would you establish user credibility for your web app?

One of the problems with general public facing apps is to deal with fake user accounts. Using an Open ID service doesn't solve this, as anyone can open multiple Google accounts and register as many ...
6
votes
2answers
122 views

Using WordPress for large collaborative site

I work for a government agency, and we're thinking about creating a new, fairly large site using WordPress as the platform. It would involve allowing quite a few people around the state access to the ...
6
votes
3answers
214 views

PayPal Basic vs PayPal Pro and credit card security

This link provides a comparison between PayPal Basic and PayPal Pro plans. To me basic PayPal is ideal but I need to be able to transfer funds between two PayPal accounts and for that I have to ...
6
votes
1answer
107 views

What secure domain registry services exist?

I'm using a domain registry service that only requires a username and password to log in. Are there any domain registry services that require a second factor in addition to a password?
6
votes
1answer
5k views

Thawte/GeoTrust/VeriSign 2048 Bit Root migration and Intermediate SSL Certificates

Thawte, GeoTrust, VeriSign and other Certificate Authorities are currently in the process of changing from a 1024 bit MD5 based root certificate to a 2048 bit SHA-1 based root to "keep in line with ...
5
votes
3answers
1k views

How To Hide From BuiltWith?

Out of curiosity, does anyone know how builtwith.com works? How does it identify the platform or app a website is using? And most importantly does anyone know how to hide the details from it? Somehow ...
5
votes
4answers
517 views

404 page echoing request URI - security risk?

I just noticed the default 404 page on one of my hosting accounts displays the requested URI. <!--#echo var="REQUEST_URI" --> I faintly remember hearing or reading that this is a potential ...
5
votes
2answers
2k views

How can I secure an installation of MediaWiki?

I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
5
votes
1answer
2k views

Why has Apache begun running a single process as root, and another as root and the wwwdata user?

I am running Apache Worker-MPM, PHP 5.3.2, and FCGID. Apache runs better than before, but I noticed that there is an apache process running as root and a second process that runs as both root and ...
5
votes
3answers
753 views

Disadvantages of a fake phpMyAdmin honeypot that causes ip blacklisting and robots.txt disallow/exclusion of the honeypot?

I'm trying to figure out whether I should set up a honeypot system with a fake phpMyAdmin (site gets hits all the time with people spidering for insecurities with that app). My thought was to create ...