Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Simple ways to improve the security of a web app

blog.fiesta.cc

Post reply on HN
Print view View original

11–20 of 23 posts

Re: Simple ways to improve the security of a web app

#11

Post by mdirolf »

makmanalp wrote: post #8

http://www.theregister.co.uk/2011/06/21/startssl_security_br... Yeah, fuck that. Like hell am I going to use a free CA as suggested. They have no incentive to keep things secure or in working order at all. Great article otherwise though!

Ha fair enough, and thanks! One problem with the CA system is that (as far as I understand) it really doesn't matter whether you choose a particularly secure CA or not - you're as vulnerable as the most vulnerable CA. That's why something like public-key pinning is important.

Re: Simple ways to improve the security of a web app

#12

Post by icehawk »

makmanalp wrote: post #8

http://www.theregister.co.uk/2011/06/21/startssl_security_br... Yeah, fuck that. Like hell am I going to use a free CA as suggested. They have no incentive to keep things secure or in working order at all. Great article otherwise though!

That doesn't really follow.

"The hackers behind the attack on StartCom failed to obtain any certificates that would allow them to spoof websites in a similar fashion, and they were also unsuccessful in generating an intermediate certificate that would allow them to act as their own certificate authority, Nigg said in an email."

As opposed to the Comodo breach where the attackers successfully managed to get fake certificates for several high-profile sites.

Re: Simple ways to improve the security of a web app

#14

Post by alpb »

mdirolf wrote: post #6
rwolf wrote: post #2

I came in swinging to tear apart yet another oblivious security article, but you actually taught me something. Looking up X-Frame-Options and X-Content-Security-Policy now--thanks!

Glad you enjoyed it.

Learned a lot for my next startup. Thanks a lot for this post. I really appreciate.

Re: Simple ways to improve the security of a web app

#15

Post by mike-cardwell »

Your Strict-Transport-Security definition is missing the "includeSubDomains" flag. STS is a lot more effective if you use that flag.

You should discuss how X-Frame-Options prevents sites legitimately loading your pages inside frames too. I believe Reddit does this amongst others in order to displays a small control panel at the top of the page. X-Frame-Options is appropriate for many sites, but perhaps not for blogs.

You should talk about how CSP prevents most bookmarklets from working. For example readability and instapaper. I really like CSP, but people should be made aware of this.

Re: Simple ways to improve the security of a web app

#16

Post by mike-cardwell »

makmanalp wrote: post #8

http://www.theregister.co.uk/2011/06/21/startssl_security_br... Yeah, fuck that. Like hell am I going to use a free CA as suggested. They have no incentive to keep things secure or in working order at all. Great article otherwise though!

They're not a free CA. They're a business that sells certificates, and just so happens to also give out certain types of certificates for free.

They have just as much incentive to secure their systems as any other CA. Their reputation is just as important to them.

It doesn't matter which CA you use. If your CA, or any other trusted CA is compromised, you're affected exactly the same.

Re: Simple ways to improve the security of a web app

#17

Post by david_a_r_kemp »

I may be going over old ground, but don't the CSP violations reports ( see https://developer.mozilla.org/en/Security/CSP/Using_CSP_viol... ) open up another attack vector?

I know people who actually implement this are going to have their heads screwed on around the right way, but having a page where you know you can generate server processing, and that is potentially not going to have much security around it screams out to me to be a good place to start an attack from.

Especially as the spec is a bit vague about exactly what happens when (no head specified for example, doesn't say about including cookies or any other information). Also, fiesta.cc's CSP Report URI returns a response that says to keep the connection open.

And, if you manage to get a script injected to a popular page, the site itself acts as a distribution system to enable distribution to multiple users.

Something about this says it's not been thoroughly thought through to me.

Re: Simple ways to improve the security of a web app

#18

Post by mike-cardwell »

david_a_r_kemp wrote: post #17

I may be going over old ground, but don't the CSP violations reports ( see https://developer.mozilla.org/en/Security/CSP/Using_CSP_viol... ) open up another attack vector? I know people who actually implement this are going to have their heads screwed on around the right way, but having a page where you know you can generate server processing, and that is potentially not going to have much security around it screams…

On that page you'll notice it mentions "request-headers". That was in FF4 and FF5, but was removed in FF6 because of something I reported.

The headers sent in the report included "Proxy-Authorization", so it was possible to steal web proxy credentials by forcing a policy violation on your site. Chromes implementation didn't include the headers from the start. For more info:

https://grepular.com/Mozilla_Security_Bug_Reveals_Web_Proxy_...

And the original report (which was recently "unclassified"):

https://bugzilla.mozilla.org/show_bug.cgi?id=664983

Re: Simple ways to improve the security of a web app

#19

Post by mdirolf »

mike-cardwell wrote: post #15

Your Strict-Transport-Security definition is missing the "includeSubDomains" flag. STS is a lot more effective if you use that flag. You should discuss how X-Frame-Options prevents sites legitimately loading your pages inside frames too. I believe Reddit does this amongst others in order to displays a small control panel at the top of the page. X-Frame-Options is appropriate for many sites, but perhaps not for blogs.…

Yeah, I decided not to get into all of the options of each header. Partially because I was writing from a plane without wifi and partially because the response I was hoping for was "these things exist - I'll go read the docs on them".

That said, your points about X-Frame-Options and CSP are definitely important for usability. Maybe I'll update the post w/ some of those details.

Post reply on HN