Security Checklist
securitychecklist.org
Security Checklist
1–10 of 65 posts
Re: Security Checklist
#2This seems great! Now, all that is needed is someone who will automate this list across X most popular websites.
Re: Security Checklist
#3It'd be nice if this was an actual checklist. i.e. checkboxes rather than images of a checkmark so that you could run through it.
Re: Security Checklist
#4Quibbles:
* You're right now fine with 2048 bit keys. The thing that jeopardizes 2048 bit keys might end up knocking RSA out entirely.
* There's really no point to fail2ban if you disabled passwords for SSH, and doing that is much more important than fail2ban.
* The checklist item for password security should make it clear that you need a password hash (PBKDF2, bcrypt scrypt, Argon2), not just a "hash".
Given the context, the only big thing that's missing is HPKP.
Re: Security Checklist
#5There's a problem with viewing security as a "checklist" problem, it treats everything as binary, black or white problem/solutions. In reality, this is _far_ from the case. For example:
> Is TLS1.2 the only supported protocol?
Do you know what the implications are from actually implementing that? One probably should do additional research before making that decision.
> Have you ensured that your content cannot be embedded in a frame on another website?
X-Frame-Options isn't the only way to achieve that.
> Have you ensured that the Internet Explorer content sniffer is disabled?
This really is only relevant if your site is hosting untrusted content.
> Are you using fail2ban to throttle ssh login attempts?
> Have you disabled password-based login over ssh, and only allowed key-based login?
The first really is of debatable value if the second is also used.
> Do forms set a cross-site request forgery cookie?
Cookies are not the only way to do this. More common, in my experience, is including the csrf token in the dom (either in a form field as a "hidden" input or as a meta tag)
> Do you have an account recovery flow? Delete it immediately.
Lol.
It's a great checklist for someone who knows what every item on the list is and more importantly, _why_ it is on the list - but it is not something that should be blindly followed.
Re: Security Checklist
#6> Are all form fields (with the exception of password fields) validated with a restrictive regex?
Please, whatever you do, do not try to regex validate people's names. A friend couldn't complete an order on a site the other day because it was rejecting his name as "invalid" per its shitty regex.
See also Falsehoods Programmers Believe About Names[1]
[1] http://www.kalzumeus.com/2010/06/17/falsehoods-programmers-b...
Re: Security Checklist
#7What is the meaning of the last point?
> Do you have an account recovery flow? Delete it immediately.
Re: Security Checklist
#8Is the problem with account recovery the fact that it means "deleted" isn't actually deleted?
Re: Security Checklist
#9What is the meaning of the last point? > Do you have an account recovery flow? Delete it immediately.
They seem to be saying you should have no online process to deal with lost passwords, forgotten userids, etc.
Which is, of course, not practical in most situations.
Re: Security Checklist
#10> Do you have an account recovery flow? Delete it immediately.
What about users who need to, you know, recover their account?