Archive for 'Web security' Category
Month of PHP bugs summary
Well, the "Month of PHP Bugs" has concluded, exposing 41 security issues in the PHP web development language. Some don’t agree with this method of publishing vulnerabilities, but sometimes it’s necessary to help developers focus on security. Embarrassment is an highly effective motivator. Personally I think this was sorely need for PHP and Stefan Esser [...]
Read the rest of this entry...Extended Validation SSL ineffective?
A quick follow-up to a previous post about the new “Extended Validation / high assurance” SSL certificates that SSL vendors are selling at a premium and are now supported in some web browsers like MS Internet Explorer 7. Researchers are Stanford University have published the results of a study (PDF) showing that use of these [...]
Read the rest of this entry...Hardening PHP servers with suhosin
PHP is extremely popular for small-scale web application development. However, PHP has a long history of major security problems and applications written in PHP tend to have their own major security holes. As much as security administrators might like to ban PHP from their web servers, we can’t… it’s far too popular. The Hardened PHP project [...]
Read the rest of this entry...Secure web development teaching resources
Web developers have it tough. Just getting the basic functions of an application working reliably in the stateless, ever-changing, browser bug infested environment of the web is challenging enough. There’s not much time to also keep up to date on security issues. I’ve written and delivered security courses for web developers and coming up with [...]
Read the rest of this entry...High assurance SSL certificates
Verisign and browser vendors have been working on a “high assurance / extended validation” type of SSL certificate. I just learned about this from an article at The Register where a Verisign exec is complaining about Mozilla. The idea behind this “new” type of SSL certificate is that it has a field indicating the certificate [...]
Read the rest of this entry...