Hot answers tagged

81

You will need to follow (to the letter) and preferably exceed the PCI DSS standard. This is, in no way, an easy task to accomplish nor should it be taken trivially. I strongly recommend that you find a third party processor that can handle this for you and integrate it into your billing system. It goes WAY beyond just having SSL and encrypting the ...


30

Your image tags must currently look like: <img src="http://example.com/images/image.jpg"> That http in there means that the image is NOT served securely. An attacker could change the image in transit and thereby change how your otherwise secure page looks to your users. Instead you could use any of the following to serve the images securely: ...


28

As suggested, I asked the question on ServerFault: http://serverfault.com/questions/161768/restart-webserver-without-entering-a-password But the short answer is: Backup your key: > cp server.key server.key.org Strip out the password: > openssl rsa -in server.key.org -out server.key [enter the passphrase] The newly created server.key file has ...


21

It's never a good idea to store credit card details ever. You're just setting yourself up for a fall, any decent payment gateway will allow you to do recurring transactions with a token where you don't have to store the credit card details.


14

I agree and disagree with Andreas' answer. Yes, it totally depends on your userbase. But my grandma sure as hell doesn't care if her favourite site has been 'secured' by McAfee. She'd want to know what a coffee company has to do with her website. And as a sysadmin I also know that those certifications are bogus to a certain extent. However, I also ...


13

Many answers you seek can be found at the Payment Card Industry Compliance Guide website. Their Links page is particularly useful. The best suggestion would be to let a third party handle this storage.


13

danlefree's answer to this similar question is quite relevant here: http://webmasters.stackexchange.com/questions/2458/how-difficult-is-an-unmanaged-vps/2464#2464 Securing a server is more than just a one-off task. Initial one-off tasks include: Hardening SSHd (there are a number of tips and tutorials out there for this, this was the first good looking ...


12

No, it is not used for anything important. (Netcraft's server market share surveys probably use it, as presumably do other 3rd party surveys.) Yes, it is a (very) small security issue. Of course your server should be secured and up to date at all times, but having an extra layer of 'obscurity' on top of a well secured server is only beneficial. If nothing ...


11

since it's easy to view the source of a site and its Google Analytics code, could somebody take that code and add it to their own site(s) and completely mess up my site's analytics data? Yes, Google Analytics code and Property ID's can be hijacked, as covered here. The motivation might be just that, to mess up your analytics data, or an attempt to get ...


10

websecurify is the best FOSS projects I have found.


10

One reason is that it's easier to gain user access to a linux server than it is to gain root or the specific user that's allowed to access the script. If you set the permissions so anyone can access/modify/delete all important scripts, then you're removing a layer of security that user based permissions provide. If someone fumbles across a user account then ...


10

They do this because they can go back later on when the thread is forgotten about (e.g. less likely to be moderated) and switch the image with a spam advertisement. Doing it doesn't require anything more then switching out images on their end so even if you delete the account as long as the post remains they will be successful and with virtually no work on ...


10

It's not about emailing plain text passwords vs. a URL, it's about storing passwords in plain text vs. hashing them. Storing passwords in plain text is not considered secure because if the site (or server, or database...) is exploited, the hacker has access to the user's account on that site along with any other site on which they use the same username and ...


9

You can encode your code using ionCube and similar products. Your client won't be able to view, study or take it. However, everything can be reverse engineered meaning that, no matter how you encode your code, it can be decoded. For example, ionCube can be decoded with decry.pt. It works, I can confirm it. So you'll never be able to really secure your code ...


8

Does your 3rd Party Merchant not include the option for Continuous Credit Card Payments - most of the major ones here in the UK certainly do (DataCash, RBS World Pay, etc.). Basically, you submit the Card Details once to them, with a request for a CCC authority (which, if I recall correctly needs to include the expected schedule and regular amount), and ...


8

I've used MediaWiki as a CMS on quite a few occasions, though my goal has been to publish (i.e. allow anyone else to view and only editors access to write) content but restrict edit access. To lock down write privileges: $wgGroupPermissions['*']['createaccount'] = false; $wgGroupPermissions['*']['edit'] = false; $wgGroupPermissions['*']['editpage'] = ...


8

I wrote an answer, then read a little more, and substatially edited my answer. This question has already been debated on Stack Overflow. The accepted answer on this question is a good starting point, follow the links. My take is that: The static salt (which you call global) is somewhat valuable because: It is simple to implement, and doesn't require a ...


8

Email activation doesn't stop automated registration and it's generally a nuisance for the user. Amazon is in the business of making it as easy as possible for you to register and drill down through their checkout structure so you pay them. An email activation system is just a speed bump with no worthwhile purpose. What does Amazon care if you didn't ...


8

There's no good reason to do this. Some marketing person probably suggested it. In fact, it's a bad idea, because it teaches users to trust the host name and not the browser's security indicators (lock icon, etc.)


8

Comodo have a root certificate whose public key is included in your web browser. The private key that matches the public key is used to sign SSL certificates that Comodo issue, and it can't be faked because no one else has the private key that matches the public key in the web browser.


8

It's very simple to spoof a User-Agent header and pretend to be a Google Bot. But much harder to fake the I.P. from which the request is coming. Check that the I.Ps making these request are owned by Google.


8

Some folks get a fair amount of traffic by allowing themselves to be framed by social network sharing sites like StumbleUpon - if your page is at all likely to be shared, I'd avoid doing this, and handle instances of framing in another way. Also, your site can already be sucked in and repurposed by benign services like Google Translate - and I believe an ...


8

From their suggestion page: The technology has to be discoverable in either the page body, cookies or server headers. In theory, this could also involve things like testing known locations, such as http://example.com/wp-admin/ Most applications let you hide various bits of such identifying information, but on the whole: get over it if not. Hiding what ...


8

Without additional safety, no. Random URLs are crawled all the time. However, this is good when done with a sign-on page to authenticate the user. An intermediate solution is to make sure the status page contains no personal data, only general info. For example, 'PAID BY CC' rather than 'PAID by VISA 1234567891' and 'Shipped' instead of 'Shipped to John ...


7

It matters as much as you and your users thinks it matters. Sending passwords over http as plain text does leave them vulnerable to packet sniffing. Now whether someone is going to actually bother sniffing those packets is a whole other story. If you want to ensure your users the most secure experience possible, use SSL for their login submissions. If you ...


7

Here's some I use: # Don't allow any pages to be framed by my site or any others # Defends against Clickjacking! Header set X-Frame-Options DENY # Only allow JavaScript from the same domain to be run. # Also, don't allow inline JavaScript to run. Header set X-Content-Security-Policy "allow 'self';" # Turns on IE 8 XSS prevention tools Header set ...


7

Charge them real money for each account.


7

There is no direct threat from having Thumbs.db uploaded, even if people were able to download them they wouldn't get any information worth having. It does maybe highlight an issues with your upload process though, this is one of the reasons why FTP is an inefficient way to upload files, extra files that you may not have intended to upload will go up.


7

One alternative to CAPTCHA and less intrusive with better UX is the honeypot method. It's rather simple: you create an input field in the HTML that you hide with javascript. You then check on the server side whether it was filled in or not, if left empty the visitor is human, if filled in a bot. The reason it works is because javascript is still too ...



Only top voted, non community-wiki answers of a minimum length are eligible