[S5 Slides] Security in Web Applications

#1

Post by costan » Mon, Jan 11, 2010, 4:40 PM UTC

[S5 Slides] Security in Web Applications
6.470.scripts.mit.edu

Re: [S5 Slides] Security in Web Applications

#2

Post by costan » Mon, Jan 11, 2010, 4:41 PM UTC

Zipped source code: http://6.470.scripts.mit.edu/lectures/security/security_in_w...

Live source code: http://github.com/costan/security_in_webapps_slides

Re: [S5 Slides] Security in Web Applications

#3

Post by aidenn0 » Mon, Jan 11, 2010, 7:35 PM UTC

1) Don't use anything fast (like md5) to hash your passwords. Use many-rounds of md5 or sha-1, or use something specifically designed for password hashing like eksblowfish

2) Don't escape your SQL, use parameterized queries

Re: [S5 Slides] Security in Web Applications

#4

Post by brlewis » Mon, Jan 11, 2010, 7:35 PM UTC

How good is md5 plus a 4-character (digits, actually, in the slides) salt?

Re: [S5 Slides] Security in Web Applications

#5

Post by guitarjunkie » Mon, Jan 11, 2010, 11:42 PM UTC

costan wrote: post #2

Zipped source code: http://6.470.scripts.mit.edu/lectures/security/security_in_w... Live source code: http://github.com/costan/security_in_webapps_slides

Thank you! Can you recommend any good case study collections on web security?