Questions tagged [security]

Preventing a system from unauthorized access, modification, disruption, or destruction.

Filter by
Sorted by
Tagged with
3
votes
2answers
145 views

Implications on automatically “open” third party domain aliasing to one of my subdomains

I have a domain, let's call it www.mydomain.com where I have a portal with an active community of users. In this portal users cooperate in a wiki way to build some "kind of software". These software ...
3
votes
1answer
247 views

User registration usability vs security

What are cons and pros of the following: asking to repeat password asking to have a certain length-password asking to repeat e-mail address using captcha sending confirmation e-mail what do you ...
1
vote
3answers
119 views

What are some internet trends that you've noticed over the past ~10 years? [closed]

I'll give an example of one that I've noticed: the number of web sites that ask for your email address (GOOG ID, YAHOO! ID, etc.) has skyrocketed. I can come up with no legitimate reason for this ...
0
votes
2answers
458 views

block users by country in .htaccess

Is there a way to block users from a particular region. Currently I have compiled a list of over 100 IP addresses that I block in my .htaccess file. Unfortunately as the list grows I see a great ...
2
votes
1answer
231 views

Is SimplePHPBlog a secure blogging engine?

Has anyone used the blog engine SimplePHPBlog? It is a simple blog engine that uses only text files (no database). My problem with it is that the content directory where the texts files are stored ...
2
votes
1answer
233 views

A single request appears to have come from all the browsers? Should I be worried?

I was looking over my site access logs when I noticed a request with the following user agent string: "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.2.12) Gecko/20101026 Firefox/3.6.12\...
5
votes
2answers
1k views

Trigger IP ban based on request of given file?

I run a website where "x.php" was known to have vulnerabilities. The vulnerability has been fixed and I don't have "x.php" on my site anymore. As such with major public vulnerabilities, it seems ...
6
votes
5answers
7k views

Disallow robots.txt from being accessed in a browser but still accessible by spiders?

We make use of the robots.txt file to prevent Google (and other search spiders) from crawling certain pages/directories in our domain. Some of these directories/files are secret, meaning they aren't ...
1
vote
0answers
301 views

Does the Adblock Plus extension prevent malicious code from downloading/executing? [closed]

Firefox and Chrome are my favourite browsers. The main reason is an extension called Adblock Plus. Basically, it blocks all the ad networks if you subscribe to one of the lists, like EasyList. Does it ...
0
votes
1answer
154 views

Free forum engine with good anti-attack mechanisms [duplicate]

Possible Duplicate: What Forum Software should I use? I am looking for forum engine (for discussions) with good attack countermeasures built in. Windows (preferrably) or Linux. Free (as beer). I ...
0
votes
1answer
278 views

Developing payment gateway

I have an idea of developing internet payment gateway similar to PayPal or Webmoney. Since i'm only sophomore at Computer Science, and i've only taken intermediate programming classes, i've no idea ...
1
vote
1answer
174 views

Is there a way of listing files for a directory if it contains index.html?

On my server (over which I have little control), directories are listed by default, so for mysite.com/images I get: Index of /images Parent Directory BirdsAreHere.png CanYouSpot-AdBlank....
7
votes
3answers
234 views

How should a site respond to automated login attempts with phony usernames?

For the last couple weeks I've been seeing a consistent stream of 15-30 invalid login attempts per hours on my site. Many of them are non-sensical usernames that nobody would ever register for real, ...
1
vote
3answers
292 views

Are there any security considerations if users are allowed to upload flash files

Lets say I have a website where users are allowed to upload files which will be displayed publicly as a portfolio gallery. For example, users might upload screenshots of a website they designed, or a ...
1
vote
1answer
66 views

Problematic using Captcha on billing page

I have simple captcha on user page. I want make it refresh if user input incorrect captcha, I just wanna ask Should I do it or I just add a simple button to refresh it.
1
vote
1answer
176 views

What is the purpose of the appserv_root requests?

I see a lot of requests for nonexistent php files on my website. They tend to have a querystring like appserv_root=http://www.example.com, using domains with evil-looking php code. I am pretty ...
0
votes
1answer
151 views

Why does my certificate provider ask me to disable its root certificate?

I received an SSL certificate from GoDaddy yesterday and their instructions to install the certificate seemed weird. To be precise, they asked me to disable their root certificate in server. NOTE: ...
5
votes
3answers
250 views

Any tools for measuring the security of a site?

I'm wondering is there any tool for measuring or testing the security of a website ? I've written some ASP.NET web-app , So i would like measure the security of my own application and if there is ...
3
votes
1answer
73 views

Cost effective way to provide static media content

I'd like to be able to deliver around 50MB of static content, either in about 30 individual files up to 10MB or grouped into 3 compressed files, around 5k to 20k times a day. Ideally I'd like to put ...
1
vote
1answer
1k views

Significant number of non-HTTP requests hitting my site

I'm seeing a significant number of non-HTTP requests hitting a site I just launched. They show up in the server (nginx) logs as non-ASCII and get rejected (correctly) with a 400 status. Here are ...
6
votes
2answers
237 views

Managing accounts on a private website for a real-life community

I'm looking at setting-up a walled-in (i.e. mostly private, with a small public-facing login page) website for a real-life community of people, and I was wondering if anyone has any experience with ...
1
vote
3answers
152 views

Security considerations for my first eStore

I have a website through which I am going to sell few products. It is hosted on a simple shared-hosting and does not have SSL. On the products page, each product has a Buy Now button created from my ...
3
votes
1answer
3k views

How to improve WOT score of a site?

I don't understand why my site Trustworthiness and Vendor Reliability are considered bad by WOT. I do not have ADS, I never spammed my site around, I do not have links that point to untrusted sites. ...
4
votes
2answers
470 views

How does amazon get away without verifying emails?

I was playing around with Amazon's Check out process today and I noticed something odd. Amazon does not make you activate your account or verify your email address. I only had to enter my email twice ...
-1
votes
1answer
2k views

Best free Vulnerability Scanners that check your websites PHP & MySQL code? [duplicate]

Possible Duplicate: Best free Vulnerability Scanners that check your websites PHP & MySQL code? I'm looking for a free vulnerability scanner to check whether my website has common ...
2
votes
1answer
105 views

Web Directories Monitor Script

I have some troubles with injections on my shared hosting account where I run a lot of sites with a lot of different technologies: wordpress, drupal, joomla, osticket etc... I installed wordpress ...
5
votes
5answers
1k views

Site compromised .htaccess files everywhere

Some of the sites we're hosting are compromised by... I don't know what. Every directory on the webserver contains a .htaccess file which redirects a user coming from a search engine to a page which ...
0
votes
1answer
166 views

Controlling Access using htpasswd and htaccess

I've got a bit of a peculiar problem on my site. I'm using a .htaccess and .htpasswd file to protect the root of the site. This works great, but when I try to view a video file on my site, it prompts ...
10
votes
1answer
712 views

How did Google manage to crawl my 403 pages?

I had a couple private files in a directory on my school folder. You could see that the files existed by going to myschool.edu/myusername/myfolder, but trying to access the files themselves via ...
4
votes
7answers
470 views

Hacked by our own hosting company!

OK, so our hosting company decided to clone our site and database onto a new serve. Without our knowledge or permission they then edited our code to point to the new database. The old server was left ...
4
votes
2answers
1k views

How to help WikiLeaks remain up and running? [closed]

WikiLeaks is under a lot of attack. It has been ousted from DNS servers, Amazon has kicked it out. It is facing massive DDOS attacks. Under these circumstances what can WikiLeaks do to remain afloat?
4
votes
4answers
298 views

How to restrict access to my site using htaccess

How to disallow access to site except me?
7
votes
3answers
1k views

Important fields in HTTP header from security perspective

What are the Important fields in HTTP header from security perspective? I tried to google it but unable to find. Can anybody provide me a link to read about it? Thanks in advance.
4
votes
3answers
290 views

Are files in a hidden directory safe?

I have a directory on my ISP's web server, I don't want users to see files inside that directory, so I have a index.html file in it to redirect user to my main page, I wonder someone could still write ...
2
votes
2answers
477 views

Restrict access to web directory with .htaccess

Let me just say that doing this sort of thing with .htaccess files has never been a strong point for me. Let's say that I have a directory in my web root: /dir/data Within that directory let's say ...
2
votes
1answer
497 views

Google Analytics shows 0 Visits?

I checked Analytics yesterday for pageviews, and had several hundred of them (for yesterday). Not today when I check "Yesterdays" stats (which yesterday showed several hundreds), it shows 0...? How ...
1
vote
1answer
1k views

iFrames from Skydrive: yes, no, how

I have a two-pronged question. First: SEO Concerns aside, should I be concerned about using iFrames on my site as far as viruses etc go? I am using skydrive to host my images and it provides an ...
1
vote
1answer
474 views

scorecardresearch dot com: weird tracking pixel

I'm seeing very weird behaviour in relation to this domain and a tracking image. On a specific page on our site, I'm seeing a script that's being added dynamically, apparently via flash (I wasn't even ...
2
votes
1answer
119 views

Looking for usability studies of user authentication methods and interfaces, do you know of any?

Been having issues with stackexchange creating weird usernames for me and grouping them with my account, it appears to be a known issue, and emailed the stackexchange team... which leads me to my ...
1
vote
1answer
192 views

Are there security risks involved in moving from a CMS that uses SQL to one that uses XML?

I've used a lot of content management systems in my day (drupal, wordpress, joomla, etc.) and they have all been database driven using MySQL. While the security updates for many CMS offerings out ...
0
votes
2answers
2k views

Godaddy - folder with password protection

Godaddy windows shared hosting on IIS6, but will probably migrate to IIS7 soon. Is there easy way to setup folder with password protection, so when I try to access secure folder, login dialog pops up?...
6
votes
3answers
410 views

Using two salts for user authentication?

When storing user credentials in a database, we all know that hashing the password is the bare minimum you should do, but salting it before hashing is better. The salt should be randomly generated, ...
11
votes
4answers
1k views

Does SSL really matter for most websites?

I've been pretty paranoid about learning to "do security right" for this site I'm building (first non-trivial site I've made), and I've noticed something that bothers me: SSL. I've read plenty of ...
6
votes
2answers
511 views

HTTP for one part of the site, HTTPS for other

We have a site which is HTTP, but it has an admin part. How can we secure the admin part with HTTPS? For example, WordPress (which I know) is located at http://foo.com, but we want to have https://...
5
votes
3answers
390 views

SSL versus EV SSL

As I understand it, SSL certificates verify the connection between the host and the browser, preventing MITM attacks. Is it true that EV SSL verifies the host itself, thus preventing (in theory) ...
1
vote
2answers
265 views

HTTP Server invalid request/connection throttling

I have a custom HTTP server. When F5 is held down in a browser the server gets slammed with requests. How can I detect and limit these (or any other) invalid connections? It seems that I would have ...
11
votes
2answers
3k views

Does the 'Server' header serve any purpose?

For example, when I dump the response header for my server I get: Server: Apache/2.2.11 (Ubuntu) PHP/5.2.6-3ubuntu4.5 with Suhosin-Patch mod_ssl/2.2.11 OpenSSL/0.9.8g Is this used for anything? Is ...
3
votes
5answers
354 views

Variable IPs: How variable are they? Best practices for tracking

There are a lot of questions on StackOverflow relating to session security / session hijacking, but there doesn't seem to be a really good solution to the problem. The three most common suggestions ...
7
votes
2answers
3k views

How can I secure an installation of MediaWiki?

I want to run an installation of MediaWiki as a Internet-accessible personal wiki, running on wiki.mysite.com. However, I want to ensure that I am the only one who can read and write to this wiki. In ...
16
votes
6answers
5k views

How Can I Secure A VPS Installation?

What are the basic steps to securing a VPS installation that I plan to install Webmin on to host my blogs and personal projects?