Re: Hash for data in transit
Robert Hajime Lanning <[email protected]>
| Newsgroups | gmane.comp.security.web-applications |
|---|---|
| Message-ID | <[email protected]> |
Well, outside of an AES128-SHA1 SSL connection, there really isn't much that can be done for transit protection. I would not trust any JavaScript implementation of form data hashing. Since that is all modifiable on the client side. If you can't even trust certificates, how are you going to trust the client platform? On Wed, Jul 21, 2010 at 8:26 AM, Richard High <[email protected]> wrote: > HTTPS is already configured. This doesn't meet the required baseline > security for web apps. According to published DISA directives. > > Richard High Security Engineer, CISSP > Information Management Group, Inc. > [email protected] > [email protected] > NSA:[email protected] > SIPR: [email protected] > JWICS: [email protected] > Work Location Fairfax: (703)573-5000x401 > Pentagon Fax: (703) 695-3070 > 4050 Legarto Rd Suite 200 > Fairfax, VA 22033 > > ________________________________ > From: [email protected] on behalf of Robert Hajime Lanning > Sent: Tue 7/20/2010 6:42 PM > To: [email protected] > Subject: Re: Hash for data in transit > > On Tue, Jul 20, 2010 at 1:03 PM, <[email protected]> wrote: >> Does anyone know of any tools out there that can be used to ensure >> the integrity of data while in transit from a web app and a user >> using a website to enter information? > > https will between the browser and the webserver. > -- And, did Galoka think the Ulus were too ugly to save? -Centauri This list is sponsored by Cenzic -------------------------------------- Let Us Hack You. Before Hackers Do! It's Finally Here - The Cenzic Website HealthCheck. FREE. Request Yours Now! http://www.cenzic.com/2009HClaunch_Securityfocus --------------------------------------