Tag Info

New answers tagged

0

Unfortunately, there is no way to do cryptography securely in JavaScript. To summarize key points of the link: JavaScript has no secure random number generator and no secure key store, meaning it cannot securely generate or store encryption keys. There is no way to guarantee the browser itself is not compromised. Without SSL/TLS, there is no way to ...


4

It is impossible to prevent this issue from happening completely. There are two things you can do that will help but not completely migrate the problem: Use SSL only: If you control both the client and the server than there is no reason you can't encrypt the traffic, this prevents people from sniffing out your API calls by studying your traffic - it also ...


1

I think the main reason those people disable JavaScript is not security per se but rather privacy. Face it, a page using less than a couple web analytics solutions is hard to come by these days. Whatever you're doing on the web, you leave some trace of it and the big players know your every step (not that you're personally significant to any of them). Even ...


0

Instead of sending a url, send a url and a confirmation code that's not part of the URL You can still make the combo good for just one use, and for a limited amount of time.


2

Disabling JavaScript is really just a security measure for most of those "security enthusiasts," and I wouldn't modify your development to support them. Sure, it can offer some benefits such as overall speed to access the site, but, in my opinion, it's not necessary to disable unless you have something to hide. Just explain to them that in order to ...


6

Those anti-spam servers probably assume that the HTTP GET method is idempotent,which means that each time you use that method on a URL, you get the same result back. Unfortunately for you, this is also how that method is specified in the HTTP standard. One way to get one-time use tokens to work is to count only when you receive a POST to that URL. This ...


0

One main account, but many to rule them all The primary AWS account credentials should never be shared, especially as a means to provide access to multiple users. Instead, account managers should use AWS Identity and Access Management (IAM) to generate unique credentials for individual users. Once created, an account manager can more easily manage the ...



Top 50 recent answers are included