Hot answers tagged

81

You will need to follow (to the letter) and preferably exceed the PCI DSS standard. This is, in no way, an easy task to accomplish nor should it be taken trivially. I strongly recommend that you find a third party processor that can handle this for you and integrate it into your billing system. It goes WAY beyond just having SSL and encrypting the ...


46

Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it? By far the best way to support password managers is to use normal <form> tags and a normal form. If you don't do anything clever, then the password manager will do its job.


35

As suggested, I asked the question on ServerFault: http://serverfault.com/questions/161768/restart-webserver-without-entering-a-password But the short answer is: Backup your key: > cp server.key server.key.org Strip out the password: > openssl rsa -in server.key.org -out server.key [enter the passphrase] The newly created server.key file has ...


30

Your image tags must currently look like: <img src="http://example.com/images/image.jpg"> That http in there means that the image is NOT served securely. An attacker could change the image in transit and thereby change how your otherwise secure page looks to your users. Instead you could use any of the following to serve the images securely: ...


21

It's never a good idea to store credit card details ever. You're just setting yourself up for a fall, any decent payment gateway will allow you to do recurring transactions with a token where you don't have to store the credit card details.


14

I agree and disagree with Andreas' answer. Yes, it totally depends on your userbase. But my grandma sure as hell doesn't care if her favourite site has been 'secured' by McAfee. She'd want to know what a coffee company has to do with her website. And as a sysadmin I also know that those certifications are bogus to a certain extent. However, I also ...


13

Many answers you seek can be found at the Payment Card Industry Compliance Guide website. Their Links page is particularly useful. The best suggestion would be to let a third party handle this storage.


13

danlefree's answer to this similar question is quite relevant here: http://webmasters.stackexchange.com/questions/2458/how-difficult-is-an-unmanaged-vps/2464#2464 Securing a server is more than just a one-off task. Initial one-off tasks include: Hardening SSHd (there are a number of tips and tutorials out there for this, this was the first good looking ...


13

No, it is not used for anything important. (Netcraft's server market share surveys probably use it, as presumably do other 3rd party surveys.) Yes, it is a (very) small security issue. Of course your server should be secured and up to date at all times, but having an extra layer of 'obscurity' on top of a well secured server is only beneficial. If nothing ...


13

Is there any way of identifying whether or not my visitors are using one of these plugin? Yes. Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed. For instance, using NavigatorPlugins.plugins allows you to get the a PluginArray object, listing the plugins installed in ...


11

since it's easy to view the source of a site and its Google Analytics code, could somebody take that code and add it to their own site(s) and completely mess up my site's analytics data? Yes, Google Analytics code and Property ID's can be hijacked, as covered here. The motivation might be just that, to mess up your analytics data, or an attempt to get ...


10

websecurify is the best FOSS projects I have found.


10

One reason is that it's easier to gain user access to a linux server than it is to gain root or the specific user that's allowed to access the script. If you set the permissions so anyone can access/modify/delete all important scripts, then you're removing a layer of security that user based permissions provide. If someone fumbles across a user account then ...


10

They do this because they can go back later on when the thread is forgotten about (e.g. less likely to be moderated) and switch the image with a spam advertisement. Doing it doesn't require anything more then switching out images on their end so even if you delete the account as long as the post remains they will be successful and with virtually no work on ...


10

It's not about emailing plain text passwords vs. a URL, it's about storing passwords in plain text vs. hashing them. Storing passwords in plain text is not considered secure because if the site (or server, or database...) is exploited, the hacker has access to the user's account on that site along with any other site on which they use the same username and ...


9

You can encode your code using ionCube and similar products. Your client won't be able to view, study or take it. However, everything can be reverse engineered meaning that, no matter how you encode your code, it can be decoded. For example, ionCube can be decoded with decry.pt. It works, I can confirm it. So you'll never be able to really secure your code ...


9

When a new bug is found, in this case in wordpress, the first thing hackers will do is try to find vulnerable sites that use wordpress. A good way of doing it is trying to find wp-admin pages on google. Maybe will even use automated tools to find-and-exploit sites based on that. Avoiding that would be the main security reason for doing it. If you have no ...


8

Does your 3rd Party Merchant not include the option for Continuous Credit Card Payments - most of the major ones here in the UK certainly do (DataCash, RBS World Pay, etc.). Basically, you submit the Card Details once to them, with a request for a CCC authority (which, if I recall correctly needs to include the expected schedule and regular amount), and ...


8

I've used MediaWiki as a CMS on quite a few occasions, though my goal has been to publish (i.e. allow anyone else to view and only editors access to write) content but restrict edit access. To lock down write privileges: $wgGroupPermissions['*']['createaccount'] = false; $wgGroupPermissions['*']['edit'] = false; $wgGroupPermissions['*']['editpage'] = false;...


8

I wrote an answer, then read a little more, and substatially edited my answer. This question has already been debated on Stack Overflow. The accepted answer on this question is a good starting point, follow the links. My take is that: The static salt (which you call global) is somewhat valuable because: It is simple to implement, and doesn't require a ...


8

Email activation doesn't stop automated registration and it's generally a nuisance for the user. Amazon is in the business of making it as easy as possible for you to register and drill down through their checkout structure so you pay them. An email activation system is just a speed bump with no worthwhile purpose. What does Amazon care if you didn't ...


8

There's no good reason to do this. Some marketing person probably suggested it. In fact, it's a bad idea, because it teaches users to trust the host name and not the browser's security indicators (lock icon, etc.)


8

Comodo have a root certificate whose public key is included in your web browser. The private key that matches the public key is used to sign SSL certificates that Comodo issue, and it can't be faked because no one else has the private key that matches the public key in the web browser.


8

It's very simple to spoof a User-Agent header and pretend to be a Google Bot. But much harder to fake the I.P. from which the request is coming. Check that the I.Ps making these request are owned by Google.


8

Some folks get a fair amount of traffic by allowing themselves to be framed by social network sharing sites like StumbleUpon - if your page is at all likely to be shared, I'd avoid doing this, and handle instances of framing in another way. Also, your site can already be sucked in and repurposed by benign services like Google Translate - and I believe an ...


8

From their suggestion page: The technology has to be discoverable in either the page body, cookies or server headers. In theory, this could also involve things like testing known locations, such as http://example.com/wp-admin/ Most applications let you hide various bits of such identifying information, but on the whole: get over it if not. Hiding what ...


8

Without additional safety, no. Random URLs are crawled all the time. However, this is good when done with a sign-on page to authenticate the user. An intermediate solution is to make sure the status page contains no personal data, only general info. For example, 'PAID BY CC' rather than 'PAID by VISA 1234567891' and 'Shipped' instead of 'Shipped to John Doe,...


8

Security issue? Doubt it. It just makes your site more visible to people who likes to attack wordpress sites. Other than the visibility everything is the same, security through obscurity is not something you should rely on anyway. Useless? Definitely. There is no reason to allow indexing of your admin login in your site. You don't want your users finding a ...


8

Bruteforce hashes You could bruteforce the hash that is stored in the database. WordPress uses phpass for hashing. Per default, WordPress does not use blowfish or similar, but just md5 with an iteration count of 8192. If you just want to find really bad passwords, bruteforcing is certainly feasible. But I would consider this a rather big violation of ...



Only top voted, non community-wiki answers of a minimum length are eligible