48

There are a lot of factors that went into it including: Browser and server technology for security with virtual hosts. You used to need a dedicated IP address per secure site, but that is not the case anymore using SNI. Lower cost and free security certificates. Let's Encrypt now issues about half of all certificates for free. Ten years ago I was ...


46

Is there any way of identifying whether or not my visitors are using one of these plugins and how best to support it? By far the best way to support password managers is to use normal <form> tags and a normal form. If you don't do anything clever, then the password manager will do its job.


41

is there any other way to make my connection secured ? Google isn't just complaining about "security" (which could include a number of different topics), it is specifically targeting encryption / HTTPS. With plain HTTP the connection between the client and server is unencrypted, allowing anyone to potentially see and intercept anything that is submitted. It ...


32

Your image tags must currently look like: <img src="http://example.com/images/image.jpg"> That http in there means that the image is NOT served securely. An attacker could change the image in transit and thereby change how your otherwise secure page looks to your users. Instead you could use any of the following to serve the images securely: Link ...


18

The answers thus far talk about various pull and push reasons as to why HTTPS is becoming more and more popular. However, there are 2 major wake-up calls from around 2010 and 2011 that showed how important HTTPS actually is: Firesheep allowing session hijacking, and the Tunisian government intercepting Facebook logins to steal credentials. Firesheep was a ...


13

Yes. Users can install LastPass as a browser plugin. Thus you can rely on client side scripting languages to check if LastPass is installed. For instance, using NavigatorPlugins.plugins allows you to get the a PluginArray object, listing the plugins installed in the application: function getLastPassVersion() { var lastpass = navigator.plugins['...


12

The typical case of certificates issued by a trusted party (Let's Encrypt etc) Server certificates are essential because the client needs to verify that it speaks with the expected server in order to detect man in the middle attacks. To authenticate itself against a client the server needs for this the certificate itself which is public and the private key ...


11

since it's easy to view the source of a site and its Google Analytics code, could somebody take that code and add it to their own site(s) and completely mess up my site's analytics data? Yes, Google Analytics code and Property ID's can be hijacked, as covered here. The motivation might be just that, to mess up your analytics data, or an attempt to get you ...


11

There was what became to be called Operation Aurora which (allegedly) was Chinese crackers breaking into USA computers like Google's. Google went public with Operation Aurora in 2010. Seems they decided to convert the loss into value by showing efforts of securing their products. So instead of losers they show up as leaders. They needed real efforts ...


10

They do this because they can go back later on when the thread is forgotten about (e.g. less likely to be moderated) and switch the image with a spam advertisement. Doing it doesn't require anything more then switching out images on their end so even if you delete the account as long as the post remains they will be successful and with virtually no work on ...


10

It's not about emailing plain text passwords vs. a URL, it's about storing passwords in plain text vs. hashing them. Storing passwords in plain text is not considered secure because if the site (or server, or database...) is exploited, the hacker has access to the user's account on that site along with any other site on which they use the same username and ...


9

Apache Httpd starts off as a process run by root to be able to listen to ports < 1024 (80 for HTTP and 443 for HTTPS). Normal users can't do that. In addition, some configuration files are only readable by root, during the launch process. For example, your Apache user (e.g. www-data) shouldn't need to be able to read your private key file if you've ...


9

You can encode your code using ionCube and similar products. Your client won't be able to view, study or take it. However, everything can be reverse engineered meaning that, no matter how you encode your code, it can be decoded. For example, ionCube can be decoded with decry.pt. It works, I can confirm it. So you'll never be able to really secure your code ...


9

When a new bug is found, in this case in wordpress, the first thing hackers will do is try to find vulnerable sites that use wordpress. A good way of doing it is trying to find wp-admin pages on google. Maybe will even use automated tools to find-and-exploit sites based on that. Avoiding that would be the main security reason for doing it. If you have no ...


9

This looks like the output of a browser extension, which means only users with the extension installed will see the badge. For example, Mcafee SECURE Safe Browsing place a similar badge next to "safe" sites according to TrustedSite.com You can apply for such a badge at https://www.trustedsite.com/signup?re=addsite


8

It's very simple to spoof a User-Agent header and pretend to be a Google Bot. But much harder to fake the I.P. from which the request is coming. Check that the I.Ps making these request are owned by Google.


8

If you are using apache, and you have a index file specified (which is present), there is no way to trick apache into not using the index file. It will simply cause a 404. Some frameworks put a index.php file into every single directory, with as little content as this: <?php // silence is golden ?> The simple reason to actually put a file, is that ...


8

First of all -- this really depends on your server configuration -- if such modifications are allowed to be performed on directory level (section is not locked on parent/server level). In order to disable execution of specific file extension yo need to know the handler name that is responsible for this. On each system this name can be different, especially ...


8

Some folks get a fair amount of traffic by allowing themselves to be framed by social network sharing sites like StumbleUpon - if your page is at all likely to be shared, I'd avoid doing this, and handle instances of framing in another way. Also, your site can already be sucked in and repurposed by benign services like Google Translate - and I believe an ...


8

From their suggestion page: The technology has to be discoverable in either the page body, cookies or server headers. In theory, this could also involve things like testing known locations, such as http://example.com/wp-admin/ Most applications let you hide various bits of such identifying information, but on the whole: get over it if not. Hiding what ...


8

You have implemented a Cross Site Scripting (XSS) vulnerability. This type of injection vulnerability can be used by an attacker to steal the credentials of your users, or make users perform actions on your site or against other sites without their knowledge. For more information about XSS see wikipedia: http://en.wikipedia.org/wiki/Cross-site_scripting ...


8

Without additional safety, no. Random URLs are crawled all the time. However, this is good when done with a sign-on page to authenticate the user. An intermediate solution is to make sure the status page contains no personal data, only general info. For example, 'PAID BY CC' rather than 'PAID by VISA 1234567891' and 'Shipped' instead of 'Shipped to John Doe,...


8

Security issue? Doubt it. It just makes your site more visible to people who likes to attack wordpress sites. Other than the visibility everything is the same, security through obscurity is not something you should rely on anyway. Useless? Definitely. There is no reason to allow indexing of your admin login in your site. You don't want your users finding a ...


8

Bruteforce hashes You could bruteforce the hash that is stored in the database. WordPress uses phpass for hashing. Per default, WordPress does not use blowfish or similar, but just md5 with an iteration count of 8192. If you just want to find really bad passwords, bruteforcing is certainly feasible. But I would consider this a rather big violation of ...


7

Charge them real money for each account.


7

There is no direct threat from having Thumbs.db uploaded, even if people were able to download them they wouldn't get any information worth having. It does maybe highlight an issues with your upload process though, this is one of the reasons why FTP is an inefficient way to upload files, extra files that you may not have intended to upload will go up.


7

One alternative to CAPTCHA and less intrusive with better UX is the honeypot method. It's rather simple: you create an input field in the HTML that you hide with javascript. You then check on the server side whether it was filled in or not, if left empty the visitor is human, if filled in a bot. The reason it works is because javascript is still too ...


7

It's a script for uploading more files onto the server. The code looked familiar to me, so I Googled one of the strings in it: it's a modified version of the sample PHP file upload code from this page. Unlike the sample code, however, the modified version sets the $uploaddir variable to the same directory it's run from, so anyone using it can upload more ...


7

This website: https://pointless.net/ Is dnssec signed and uses a TLSA record (RFC6698) to secure the SSL certificate (Which is also signed by CA CERT, a sort of open source web of trust CA). I run my own nameservers and use Easydns as my registrar - however Easydns doesn't support putting a DS record in the .net zone so I use the ISC Domain Lookaside ...


7

Without knowing more about your app or seeing some real code it is hard to give any detailed security advice. That being said here are some things that come to mind after reading your post: 1: Keep your config file with the database connect info and salt key outside the public directory and chmod it to 444 or 644. You can access one directory above your ...


Only top voted, non community-wiki answers of a minimum length are eligible