Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I'm starting a brand new project. The main access from the client side app will be via an API written in ASP.Net MVC3.
I'm looking for discussions on how best to handle logging information for security access as well has how to handle Phishing and Brute Force.
On the Information side of things, I'd also like some ideas on what to keep track of to help me both better improve the application in the future and to be able to market it better.
Anyone got any suggestions or links?

share|improve this question

closed as not a real question by Wyatt Barnett, Walter, psr, Jim G., Matthieu Aug 26 '12 at 12:28

It's difficult to tell what is being asked here. This question is ambiguous, vague, incomplete, overly broad, or rhetorical and cannot be reasonably answered in its current form. For help clarifying this question so that it can be reopened, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

1  
I think this would make 3 or 4 good questions but it is way too nebulous as it stands now. –  Wyatt Barnett Aug 15 '12 at 17:19
add comment

1 Answer 1

up vote 2 down vote accepted

Behind good design and good defense lies

Deep Profound Knowledge

So, first of all, I suggest that you read these links as you're not exposed to phishing or brute force attacks and other types of attacks like cookie poisoning, CSRF, form spoofing, HTTP injection, etc. are there waiting for you.

http://www.imperva.com/products/wsc_web-application_attacks.html http://www.blackhat.com/presentations/bh-asia-02/bh-asia-02-shah.pdf

For logging, I recommend that you use cookie-based authentication, and consider these points for cookies:

  1. Make'em HttpOnly
  2. Make your session cookies session (well, then name says that)
  3. Try to make your cookies secure if possible (SSL, or TLS)
  4. Encrypt your cookie value
  5. Rename your cookie from time to time as the name of a cookie also matters

One of the common patterns to prevent brute force attack is to delay the process by forbidden login intervals, that is, if a user failed to login for say n times, prevent other login requests for say 15 minutes.

Another pattern is to lock user on n times of unsuccessful login retry, and create an unlock mechanism that involves human participation somehow.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.