User talk:Mohammed ALDOUB - Revision history

Mohammed ALDOUB at 18:03, 22 September 2012

2012-09-22T18:03:40Z

Mohammed ALDOUB at 17:53, 22 September 2012

2012-09-22T17:53:34Z

Mohammed ALDOUB at 21:40, 12 August 2012

2012-08-12T21:40:30Z

Mohammed ALDOUB at 21:38, 12 August 2012

2012-08-12T21:38:30Z

Mohammed ALDOUB at 21:15, 12 August 2012

2012-08-12T21:15:55Z

Mohammed ALDOUB at 21:15, 12 August 2012

2012-08-12T21:15:14Z

Mohammed ALDOUB at 21:14, 12 August 2012

2012-08-12T21:14:50Z

Mohammed ALDOUB at 21:02, 12 August 2012

2012-08-12T21:02:59Z

Mohammed ALDOUB at 22:19, 7 August 2012

2012-08-07T22:19:16Z

Mohammed ALDOUB at 21:13, 7 August 2012

2012-08-07T21:13:09Z

@@ Line 1: / Line 1: @@
-== User Legal and Political Protection Cheat Sheet ==
+== User Privacy and Anonymity Protection Cheat Sheet ==
 == Introduction ==
 The political and legal impact of online activities has been rising significantly over the years, with users now able to take down entire governments and change legislation using online services and social networking. This fact puts into focus the grave danger users are getting introduced to by using these online services, especially in oppressive regions around the world.
 == Scope of Threats ==
-An array of potential threats surrounds online users, and this cheat sheet focuses on political and legal threats that users might face by using these online services, especially social networking and communication platforms. The various reports of imprisonments and even execution for users in some parts of the world simply for using online services must be taken seriously by web developers.
+An array of potential threats surrounds online users, and this cheat sheet focuses on privacy and anonymity threats that users might face by using these online services, especially social networking and communication platforms. The various reports of imprisonments and even execution for users in some parts of the world simply for using online services must be taken seriously by web developers.

@@ Line 107: / Line 107: @@
 == Allow Connections from Anonymity Networks ==
-Anonymity networks, such as the Tor Project, give users in tumultuous regions around the world a golden chance to escape surveillance, to access information or to break censorship barriers. More often than not, activists in troubled regions use such networks to report injustice or send uncensored information to the rest of the world, especially mediums such as social networks, media streaming websites and e-mail providers.
+Anonymity networks, such as the Tor Project, give users in tumultuous regions around the world a golden chance to escape surveillance, access information or the ability to break censorship barriers. More often than not, activists in troubled regions use such networks to report injustice or send uncensored information to the rest of the world, especially mediums such as social networks, media streaming websites and e-mail providers.
 Web developers and network administrators must pursue every avenue to enable users to access services from behind such networks, and any policy made against such anonymity networks need to be carefully re-evaluated with respect to impact on people around the world.
 For more information about anonymity networks, and the user protections they provide, please refer to:
@@ Line 116: / Line 118: @@
 - [http://www.i2p2.de I2P Network]
 == Prevent IP Address Leakage ==
-Preventing leakage of user IP address is of great significance when user protection is in scope. Any application that hosts external 3rd party content, such as avatars or signatures, must take into account the benefits of allowing users to block 3rd-party content from being loaded in the application page.
+Preventing leakage of user IP address is of great significance when user protection is in scope. Any application that hosts external 3rd party content, such as avatars, signatures or photo attachments; must take into account the benefits of allowing users to block 3rd-party content from being loaded in the application page.
 If it was possible to embed 3rd-party, external domain images, for example, in a user's feed or timeline; an adversary might use it to discover a victim's real IP address by hosting it on his domain and watch for HTTP requests for that image.
@@ Line 130: / Line 135: @@
 If the web application cannot provide enough legal or political protections to the user, or if the web application cannot prevent misuse or disclosure of sensitive information such as logs, the truth must be told to the users in a clear understandable form, so that users can make an educated choice about whether or not they should use a particular service.
 Honesty goes a long way towards cultivating a culture of trust between a web application and its users, and it allows many users around the world to weigh their options carefully, preventing harm to users in various contrasting regions around the world.

← Older revision		Revision as of 21:40, 12 August 2012
Line 132:		Line 132:

	Honesty goes a long way towards cultivating a culture of trust between a web application and its users, and it allows many users around the world to weigh their options carefully, preventing harm to users in various contrasting regions around the world.		Honesty goes a long way towards cultivating a culture of trust between a web application and its users, and it allows many users around the world to weigh their options carefully, preventing harm to users in various contrasting regions around the world.
		+
		+	More insight regarding secure logging can be found at:
		+
		+	1- [https://www.owasp.org/index.php/Logging_Cheat_Sheet OWASP Logging Cheat Sheet]

← Older revision		Revision as of 21:38, 12 August 2012
Line 116:		Line 116:

	2- [http://www.i2p2.de I2P Network]		2- [http://www.i2p2.de I2P Network]
		+
		+
		+	== Prevent IP Address Leakage ==
		+
		+	Preventing leakage of user IP address is of great significance when user protection is in scope. Any application that hosts external 3rd party content, such as avatars or signatures, must take into account the benefits of allowing users to block 3rd-party content from being loaded in the application page.
		+
		+	If it was possible to embed 3rd-party, external domain images, for example, in a user's feed or timeline; an adversary might use it to discover a victim's real IP address by hosting it on his domain and watch for HTTP requests for that image.
		+
		+	Many web applications need user content to operate, and this is completely acceptable as a business process; however web developers are advised to consider giving users the option of blocking external content as a precaution. This applies mainly to social networks and forums, but can also apply to web-based e-mail, where images can be embedded in HTML-formatted e-mails.
		+
		+
		+	== Honesty & Transparency ==
		+
		+	If the web application cannot provide enough legal or political protections to the user, or if the web application cannot prevent misuse or disclosure of sensitive information such as logs, the truth must be told to the users in a clear understandable form, so that users can make an educated choice about whether or not they should use a particular service.
		+
		+	Honesty goes a long way towards cultivating a culture of trust between a web application and its users, and it allows many users around the world to weigh their options carefully, preventing harm to users in various contrasting regions around the world.

@@ Line 17: / Line 17: @@
 == Guidelines ==
-'''1- Strong Cryptography:
-'''
+== Strong Cryptography ==
 Any online platform that handles user identities, private information or communications must be secured with the use of strong cryptography. User communications must be encrypted in transit and storage. User secrets such as passwords must also be protected using strong, collision-resistant hashing algorithms with increasing work factors, in order to greatly mitigate the risks of exposed credentials as well as proper integrity control.

← Older revision		Revision as of 21:15, 12 August 2012
Line 113:		Line 113:

	1- [https://www.torproject.org The Tor Project]		1- [https://www.torproject.org The Tor Project]
		+
	2- [http://www.i2p2.de I2P Network]		2- [http://www.i2p2.de I2P Network]

← Older revision		Revision as of 21:14, 12 August 2012
Line 100:		Line 100:

	For details regarding session management, please refer to:		For details regarding session management, please refer to:
		+
	1- [https://www.owasp.org/index.php/Session_Management_Cheat_Sheet OWASP Session Management Cheat Sheet]		1- [https://www.owasp.org/index.php/Session_Management_Cheat_Sheet OWASP Session Management Cheat Sheet]
		+
		+
		+	== Allow Connections from Anonymity Networks ==
		+
		+	Anonymity networks, such as the Tor Project, give users in tumultuous regions around the world a golden chance to escape surveillance, to access information or to break censorship barriers. More often than not, activists in troubled regions use such networks to report injustice or send uncensored information to the rest of the world, especially mediums such as social networks, media streaming websites and e-mail providers.
		+
		+	Web developers and network administrators must pursue every avenue to enable users to access services from behind such networks, and any policy made against such anonymity networks need to be carefully re-evaluated with respect to impact on people around the world.
		+
		+	For more information about anonymity networks, and the user protections they provide, please refer to:
		+
		+	1- [https://www.torproject.org The Tor Project]
		+	2- [http://www.i2p2.de I2P Network]

← Older revision		Revision as of 21:02, 12 August 2012
Line 71:		Line 71:

	2- [https://www.owasp.org/images/4/4b/OWASP_defending-MITMA_APAC2012.pdf Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and and Pinning of Certs, by Tobias Gondrom]		2- [https://www.owasp.org/images/4/4b/OWASP_defending-MITMA_APAC2012.pdf Securing the SSL channel against man-in-the-middle attacks: Future technologies - HTTP Strict Transport Security and and Pinning of Certs, by Tobias Gondrom]
		+
		+
		+	== Panic Modes ==
		+
		+	A panic mode is a mode that threatened users can refer to when they fall under direct threat to disclose account credentials. Many times such threats around the world are accompanied by violence, blackmail or even imprisonment.
		+
		+	Giving users the ability to create a panic mode can help them survive these threats, especially in tumultuous regions around the world. Unfortunately many users around the world are subject to types of threats that most web developers do not know of or take into account.
		+
		+	Examples of panic modes are modes where distressed users can delete their data upon threat, log into fake inboxes/accounts/systems, or triggers to backup/upload/hide sensitive data.
		+
		+	The appropriate panic mode to implement differs depending on the application type. A disk encryption software such as TrueCrypt might implement a panic mode that starts up a fake system partition if the user entered his distressed password.
		+
		+	E-mail providers might implement a panic mode that hides predefined sensitive emails or contacts, and allow reading innocent e-mail messages only, usually as defined by the user, while preventing the panic mode from overtaking the actual account.
		+
		+	An important note about panic modes is that they must not be discoverable. An adversary inside a victim's panic mode must not have any way, or as little possibilities as possible, of finding out the truth. This means that once inside a panic mode, most non-sensitive normal operations must be allowed to continue (such as sending or receiving email), and that further panic modes must be possible to create from inside the original panic mode (If the adversary tried to create a panic mode on a victim's panic mode and failed, the adversary would know he/she was already inside a panic mode, and might attempt to hurt the victim).
		+
		+	Another solution would be to prevent panic modes from being generated from the user account, and instead making it a bit harder to spoof by adversaries. For example it could be only created Out Of Band, and adversaries must have no way to know a panic mode already exists for that particular account.
		+
		+	The implementation of a panic mode must always aim to confuse adversaries and prevent them from figuring out the truth about victim accounts and data, as well as the existence of panic modes for a particular account.
		+
		+	For more details regarding TrueCrypt's hidden operating system mode, please refer to:
		+
		+	1- [http://www.truecrypt.org/docs/?s=hidden-operating-system TrueCrypt Hidden Operating System]
		+
		+	== Remote Session Invalidation ==
		+
		+	In case user equipment is lost, stolen or confiscated, or under suspicion of cookie theft; it might be very beneficial for users to able to see their current online sessions and disconnect/invalidate any suspicious lingering sessions, especially ones that belong to stolen or confiscated devices. Remote session invalidation can also help if a user suspects his session details were stolen in a Man-in-the-Middle attack.
		+
		+	For details regarding session management, please refer to:
		+	1- [https://www.owasp.org/index.php/Session_Management_Cheat_Sheet OWASP Session Management Cheat Sheet]

@@ Line 1: / Line 1: @@
 == User Legal and Political Protection Cheat Sheet ==
@@ Line 52: / Line 44: @@
 HSTS has average support on popular user agent, such as Mozilla Firefox and Google Chrome. Nevertheless, it remains very useful for users who are in consistent fear of spying and [https://www.owasp.org/index.php/Man-in-the-middle_attack Man in the Middle Attacks].
 For more details regarding HSTS, please visit:
@@ Line 58: / Line 52: @@
 - [https://tools.ietf.org/html/draft-ietf-websec-strict-transport-sec-11 IETF Draft for HSTS]

@@ Line 37: / Line 37: @@
 - [https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet Cryptographic Storage Cheat Sheet]
 - [https://www.owasp.org/index.php/Authentication_Cheat_Sheet Authentication Cheat Sheet]
 - [https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet Transport Layer Protection Cheat Sheet]
 - [https://www.owasp.org/index.php/Guide_to_Cryptography Guide to Cryptography]
 - [https://www.owasp.org/index.php/Testing_for_SSL-TLS_%28OWASP-CM-001%29 Testing for TLS/SSL]