Reputation
850
Top tag
Next privilege 1,000 Rep.
See votes, expandable usercard
Badges
1 7 10
Newest
 Good Answer
Impact
~41k people reached

  • 0 posts edited
  • 1 helpful flag
  • 80 votes cast
Apr
12
awarded  Good Answer
Dec
28
comment Will data be encrypted if an HTTP page POSTs to a HTTPS handler that redirects back to HTTP?
@symcbean - You can require the authentication cookie for every page you want to protect, so they are served exclusively to HTTPS requests. It is quite common to have a public area and a private area for members, the private pages would require SSL and only the public pages could be called with HTTP. As already said, SSL for the whole site is the best approach.
Dec
23
awarded  Yearling
Dec
23
answered Will data be encrypted if an HTTP page POSTs to a HTTPS handler that redirects back to HTTP?
Oct
12
comment Securing images from browsers and humans
@Ryan - You can choose the URL freely, in your case it could look like this: <img src="image.php?id=12abdi341ldkfjoi">. Then you can implement a php page called "image.php" and this page gets the id as parameter and returns the image as response. The example above in the answer is appropriate, if your application can handle "beautified" URLs, but this is not necessary. The keywords you are looking for are `http response Content-Type'.
Oct
11
answered Securing images from browsers and humans
Aug
21
comment Another website is mirroring and ranks above my site in search results
Website cloning seems to be a new trick, a lot of websites are misused at the moment. There are news at Heise (german) about this topic. The usual solution (aside from reporting the fake-site) seems to be, to feed special content to the IP-adresses of the crawlers, so they will for example show a link to your real site.
Jun
9
awarded  Yearling
Nov
8
comment How to delete all your old website data from the internet?
@AkkyAwesøme - Probably you see this error page, because no file can be found at URL rohbits.com/test . I think hongkiat wrote a .htaccess file as in the example above. With the $1 it would redirect rohbits.com/test to www.rohbits.com/blog/test, without the $1 it would redirect all urls to www.rohbits.com/blog/ . Did it actually solve your problem?
Nov
7
comment Will using HTTPS hurt my site's SEO or other statistics?
Not even this is bullet proof, but it could possibly thwart some automated attacks. 1) SSL-strip could simply remove the java-script that checks the cookie. 2) SSL-strip could easily offer SSL itself, then you would get a secure cookie as well as a valid certificate, though this certificate would be different of the domain you requested (but who checks that?).
Nov
7
comment Will using HTTPS hurt my site's SEO or other statistics?
It is the first request that makes the difference. If the user cares, he can start with HTTPS (typing the url with https:// into the browser bar), this makes SSL-strip impossible on SSL-only sites. Whenever the user starts with HTTP as the first page, then SSL-strip can talk to the user with HTTP and to the site with HTTPS. A switching site will prevent the user from choosing HTTPS for the first request.
Nov
7
revised How to delete all your old website data from the internet?
Added info about changed page structure.
Nov
7
comment Will using HTTPS hurt my site's SEO or other statistics?
Actually a correct answer, but keep in mind that sites switching between HTTP and HTTPS cannot be secured against SSL-strip.
Nov
7
answered How to delete all your old website data from the internet?
Nov
4
awarded  Caucus
Sep
23
comment Pixels - A cry for some insight
@CarrotFile - A thank-you never hurts, it's the motivation to write such in-depth answers as the one from krowe. Maybe you saw a protected answer, but that's only to prevent loads of "unhelpful" comments or trivial answers that should be comments.
Sep
22
answered Pixels - A cry for some insight
Sep
19
comment What are the problems of httponly and secure cookies?
@Toto - Because they do not use HTTPS at all. You cannot use the Secure flag on a HTTP site, the cookie would not be sent back by the browser and you would loose the session. And yes, a site cannot be secure without HTTPS, but SO is not considered to be a site with critical data, and SSL is not for free.
Sep
19
answered What are the problems of httponly and secure cookies?
Aug
26
comment Form validation - security and input specification
@Elmer - As vollie pointed out, validation is an important first step. Another good thing to make your code more secure, is to use parametrized queries (supported by PDO or mysqli). Of course it helps understanding how SQL-injection works, maybe you are interested in my small demo, (just click the next-arrow to get a malicious input).