Talk:.NET Security Cheat Sheet - Revision history

Xandersherry at 20:35, 20 November 2014

2014-11-20T20:35:01Z

2014-11-20T01:35:24Z

2014-11-19T22:03:58Z

2013-04-05T02:53:24Z

2013-02-15T01:02:36Z

Created page with "This is a work in progress. Comments welcome. ~~~~"

New page

This is a work in progress. Comments welcome.
[[User:Bill Sempf|Bill Sempf]] 01:02, 15 February 2013 (UTC)

← Older revision		Revision as of 20:35, 20 November 2014
Line 9:		Line 9:

	This: [https://www.owasp.org/index.php/.NET_Security_Cheat_Sheet#Forms_authentication Disable slidingExpiration and Forms Authentication Ticket timeout.] doesn't make any sense. What is the rational behind this bullet? Can we figure out what the guidance is supposed to be, so it can be expressed more coherently? --[[User:Xandersherry\|Xandersherry]] ([[User talk:Xandersherry\|talk]]) 19:35, 19 November 2014 (CST)		This: [https://www.owasp.org/index.php/.NET_Security_Cheat_Sheet#Forms_authentication Disable slidingExpiration and Forms Authentication Ticket timeout.] doesn't make any sense. What is the rational behind this bullet? Can we figure out what the guidance is supposed to be, so it can be expressed more coherently? --[[User:Xandersherry\|Xandersherry]] ([[User talk:Xandersherry\|talk]]) 19:35, 19 November 2014 (CST)
		+
		+	I've updated the form auth timeout guidance to be closer to what Jim originally put in the cheat sheet and which I think is better advice for most use cases, but I've strengthened it a bit to reflect that it can be a area of concern and shouldn't be overlooked. If it isn't clear, or there's disagreement around this position, I'd be happy to discuss it further. --[[User:Xandersherry\|Xandersherry]] ([[User talk:Xandersherry\|talk]]) 14:35, 20 November 2014 (CST)

← Older revision		Revision as of 01:35, 20 November 2014
Line 6:		Line 6:
	In the [https://www.owasp.org/index.php/.NET_Security_Cheat_Sheet#Encryption Encryption section] of the page, there's a bullet that mentions that SHA512 is the strongest hashing algorithm in the framework. While this is certainly true for some uses of hashing (not password hashing, which I've added another bullet to cover) would it be useful to add more detail to what you might want to use SHA-512 for?		In the [https://www.owasp.org/index.php/.NET_Security_Cheat_Sheet#Encryption Encryption section] of the page, there's a bullet that mentions that SHA512 is the strongest hashing algorithm in the framework. While this is certainly true for some uses of hashing (not password hashing, which I've added another bullet to cover) would it be useful to add more detail to what you might want to use SHA-512 for?
	--[[User:Xandersherry\|Xandersherry]] ([[User talk:Xandersherry\|talk]]) 16:03, 19 November 2014 (CST)		--[[User:Xandersherry\|Xandersherry]] ([[User talk:Xandersherry\|talk]]) 16:03, 19 November 2014 (CST)
		+
		+
		+	This: [https://www.owasp.org/index.php/.NET_Security_Cheat_Sheet#Forms_authentication Disable slidingExpiration and Forms Authentication Ticket timeout.] doesn't make any sense. What is the rational behind this bullet? Can we figure out what the guidance is supposed to be, so it can be expressed more coherently? --[[User:Xandersherry\|Xandersherry]] ([[User talk:Xandersherry\|talk]]) 19:35, 19 November 2014 (CST)

← Older revision		Revision as of 22:03, 19 November 2014
Line 3:		Line 3:

	As this goes into public beta, please add examples and samples. Much of this guidance is just a stub. Please fill things out as you have the availability! Remember, anyone with an account can attribute. If you want to be more anonymous, please email me and I'll make adjustments. [[User:Bill Sempf\|Bill Sempf]] 02:53, 5 April 2013 (UTC)		As this goes into public beta, please add examples and samples. Much of this guidance is just a stub. Please fill things out as you have the availability! Remember, anyone with an account can attribute. If you want to be more anonymous, please email me and I'll make adjustments. [[User:Bill Sempf\|Bill Sempf]] 02:53, 5 April 2013 (UTC)
		+
		+	In the [https://www.owasp.org/index.php/.NET_Security_Cheat_Sheet#Encryption Encryption section] of the page, there's a bullet that mentions that SHA512 is the strongest hashing algorithm in the framework. While this is certainly true for some uses of hashing (not password hashing, which I've added another bullet to cover) would it be useful to add more detail to what you might want to use SHA-512 for?
		+	--[[User:Xandersherry\|Xandersherry]] ([[User talk:Xandersherry\|talk]]) 16:03, 19 November 2014 (CST)

← Older revision		Revision as of 02:53, 5 April 2013
Line 1:		Line 1:
	This is a work in progress. Comments welcome.		This is a work in progress. Comments welcome.
	[[User:Bill Sempf\|Bill Sempf]] 01:02, 15 February 2013 (UTC)		[[User:Bill Sempf\|Bill Sempf]] 01:02, 15 February 2013 (UTC)
		+
		+	As this goes into public beta, please add examples and samples. Much of this guidance is just a stub. Please fill things out as you have the availability! Remember, anyone with an account can attribute. If you want to be more anonymous, please email me and I'll make adjustments. [[User:Bill Sempf\|Bill Sempf]] 02:53, 5 April 2013 (UTC)