Talk:OWASP Application Security FAQ - Revision history

Jmc.owasp at 20:34, 31 December 2014

2014-12-31T20:34:14Z

Rick.mitchell: /* Cache info is wrong */ new section

2013-05-28T15:08:00Z

‎Cache info is wrong: new section

Ryan Dewhurst: added md5 hashing discussion

2013-03-22T21:03:55Z

added md5 hashing discussion

Jlampe at 14:35, 23 February 2009

2009-02-23T14:35:01Z

Rahul s55: Need for more questions and answers

2007-04-24T05:01:04Z

Need for more questions and answers

OWASP: Talk:OWASP AppSec FAQ moved to Talk:OWASP Application Security FAQ: Wikipedia standard

2006-07-03T12:36:36Z

Talk:OWASP AppSec FAQ moved to Talk:OWASP Application Security FAQ: Wikipedia standard

Varunvnair: should we rename the OWASP AppSec FAQ article?

2006-07-03T03:19:36Z

should we rename the OWASP AppSec FAQ article?

New page

I feel that this page/article should be renamed to "OWASP Application Security FAQ". The complete form is usually preferred in Wikipedia articles and it does make the page title more readable and probably more search engine friendly. --[[User:Varunvnair|Varunvnair]] 23:19, 2 July 2006 (EDT)

← Older revision		Revision as of 20:34, 31 December 2014
Line 8:		Line 8:

	The "SSL" sections here are getting pretty dated. For example, there's no mention of "AES" or "SHA1" and the only mentioned symmetric key bit lengths are 40 and 128. ''[[User:Jlampe\|Jlampe]] 09:35, 23 February 2009 (EST)''		The "SSL" sections here are getting pretty dated. For example, there's no mention of "AES" or "SHA1" and the only mentioned symmetric key bit lengths are 40 and 128. ''[[User:Jlampe\|Jlampe]] 09:35, 23 February 2009 (EST)''
		+
		+	The SSL section indicates, "After the initial SSL negotiation is done and the connection is on HTTPS, everything is encrypted including the page request. So any data sent in the query string will also be encrypted." This statement is technically not correct. While the connection between the client and the server are secured, the request and response are not encrypted, but are unreadable by a third party who might examine the network traffic packet details and thusly largely secured from eavesdropping. I would suggest changing the language to read, "After the initial SSL negotiation is done and the connection is secured, everything sent over the secured connection between the client and server is secured from eavesdropping, including the page request."

	== MD5 Password Hashing ==		== MD5 Password Hashing ==

← Older revision		Revision as of 15:08, 28 May 2013
Line 12:		Line 12:

	The FAQ talks about hashing passwords with MD5. I believe bcrypt is the current accepted standard. ''[[User:Ryan Dewhurst\|Ryan Dewhurst]] 22:02, 22 March 2013 (GMT)''		The FAQ talks about hashing passwords with MD5. I believe bcrypt is the current accepted standard. ''[[User:Ryan Dewhurst\|Ryan Dewhurst]] 22:02, 22 March 2013 (GMT)''
		+
		+	== Cache info is wrong ==
		+
		+	"If a webpage is delivered using SSL, no content can be cached."
		+
		+	That's just totally wrong. I use Firefox to diagnose caching issues with SSL content all the time. [[User:Rick.mitchell\|Rick.mitchell]] 15:08, 28 May 2013 (UTC)

← Older revision		Revision as of 21:03, 22 March 2013
Line 8:		Line 8:

	The "SSL" sections here are getting pretty dated. For example, there's no mention of "AES" or "SHA1" and the only mentioned symmetric key bit lengths are 40 and 128. ''[[User:Jlampe\|Jlampe]] 09:35, 23 February 2009 (EST)''		The "SSL" sections here are getting pretty dated. For example, there's no mention of "AES" or "SHA1" and the only mentioned symmetric key bit lengths are 40 and 128. ''[[User:Jlampe\|Jlampe]] 09:35, 23 February 2009 (EST)''
		+
		+	== MD5 Password Hashing ==
		+
		+	The FAQ talks about hashing passwords with MD5. I believe bcrypt is the current accepted standard. ''[[User:Ryan Dewhurst\|Ryan Dewhurst]] 22:02, 22 March 2013 (GMT)''

← Older revision		Revision as of 14:35, 23 February 2009
Line 4:		Line 4:

	I think more questions and answers should be included into the OWASP Application Security FAQ. This requires contribution from other readers. If an answer needs clarification, please mention it in 'Discussion'.		I think more questions and answers should be included into the OWASP Application Security FAQ. This requires contribution from other readers. If an answer needs clarification, please mention it in 'Discussion'.
		+
		+	== SSL Could Use a Refresh ==
		+
		+	The "SSL" sections here are getting pretty dated. For example, there's no mention of "AES" or "SHA1" and the only mentioned symmetric key bit lengths are 40 and 128. ''[[User:Jlampe\|Jlampe]] 09:35, 23 February 2009 (EST)''

← Older revision		Revision as of 05:01, 24 April 2007
Line 1:		Line 1:
	I feel that this page/article should be renamed to "OWASP Application Security FAQ". The complete form is usually preferred in Wikipedia articles and it does make the page title more readable and probably more search engine friendly. --[[User:Varunvnair\|Varunvnair]] 23:19, 2 July 2006 (EDT)		I feel that this page/article should be renamed to "OWASP Application Security FAQ". The complete form is usually preferred in Wikipedia articles and it does make the page title more readable and probably more search engine friendly. --[[User:Varunvnair\|Varunvnair]] 23:19, 2 July 2006 (EDT)
		+
		+	== Need for more questions and answers ==
		+
		+	I think more questions and answers should be included into the OWASP Application Security FAQ. This requires contribution from other readers. If an answer needs clarification, please mention it in 'Discussion'.

← Older revision	Revision as of 12:36, 3 July 2006
(No difference)