Hot answers tagged security
CloudFlare's Flexible SSL does not negate the need for a certificate on their servers. They will simply be providing you one for free. So there is still an SSL certificate tied to your domain that they provide. It only negates the need of a certificate on the origin server. From the discussion on the CloudFlare Blog Actually, we'll be providing a ...
This link explains what the CloudFlare SSL options are. Flexible SSL, at least at this time, does not fully encrypt to your server. The issue being discussed on the blog by Matthew ("Actually, we'll be providing a free certificate that's pinned to the domain that you can install on your server for end-to-end crypto.... for free") isn't available just yet. ...
As of August 2014 Google has officially indicated that HTTPS will be used as a ranking signal. This means that even if your website is a completely static website, if you care about SEO you should at least consider setting up an SSL certificate. Of course HTTPS is just one ranking signal out of hundreds, so there are probably more important things you can ...
Depending on how users access the site, you might be able to authenticate simply by their IP address. There is also HTTP authentication, both basic and digest. But if you need to differentiate between multiple users then these need to be stored somewhere, and regardless of the method used, this is a "database".
Oh boy are there! OAuth (Facebook, Google, Twitter), SAML, LDAP, PAM, HTTP Basic, HTTP Client Certificate, IP restriction, 2-Factor authentication, RSA token, biometrics.
Yes, this bot is trying to exploit JCE. It’s probably using a very powerful publicly available exploit (+ mirror) for JCE < 2.0.11. Although this is a really outdated version, many instances are still in the wild. JCE 2.0.11 was released on 2011-08-29, the exploit has been available after the release (if its author kept his word). If JCE is not installed ...
There is not enough information for anyone to really know what is going on here. But here is what you may be missing. Any system has several services installed along with applications; FTP, HTTP, SSH, DNS, and PHP and Java are fairly common. You will have more. Each service and application can be vulnerable. PHP and Java are environments/languages that can ...
We've made a tool for that – SslCheck. We've got tired of checking every web page manually and created a crawler. It goes through all pages and shows you which ones have "non-secure" content. All you need to do is enter you root URL. Hope it saves someone some time.
Only top voted, non community-wiki answers of a minimum length are eligible