Web Security, Privacy & Commerce
Summary Table of Contents
The Web Security Problem
Risk Analysis and Best Practices
History and Terminology
A Packet's Tour of the Web
Who Owns the Internet?
Understanding Cryptography
Symmetric Key Algorithms
Public Key Algorithms
Message Digest Functions
Cryptography and Web Security
Working Cryptographic Systems and Protocols
What Cryptography Can't Do
Legal Restrictions on Cryptography
What Is SSL?
SSL: The User's Point of View
Physical Identification
Using Public Keys for Identification
Real-World Public Key Examples
Understanding Digital Certificates with PGP
Certification Authorities: Third-Party Registrars
Public Key Infrastructure
Open Policy Issues
Understanding Privacy
User-Provided Information
Log Files
Understanding Cookies
Web Bugs
Conclusion
Choosing a Good Service Provider
Picking a Great Password
Cleaning Up After Yourself
Avoiding Spam and Junk Email
Identity Theft
Blocking Ads and Crushing Cookies
Anonymous Browsing
Secure Email
Using Backups to Protect Your Data
Preventing Theft
When Good Browsers Go Bad
Helper Applications and Plug-ins
Microsoft's ActiveX
The Risks of Downloaded Code
Conclusion
Java
JavaScript
Flash and Shockwave
Conclusion
Planning for the Forgotten Threats
Protecting Computer Hardware
Protecting Your Data
Personnel
Story: A Failed Site Inspection
Current Host Security Problems
Securing the Host Computer
Minimizing Risk by Minimizing Services
Operating Securely
Secure Remote Access and Content Updating
Firewalls and the Web
Conclusion
A Legacy of Extensibility and Risk
Rules to Code By
Securely Using Fields, Hidden Fields, and Cookies
Rules for Programming Languages
Using PHP Securely
Writing Scripts That Run with Additional Privileges
Connecting to Databases
Conclusion
Planning for Your SSL Server
Creating SSL Servers with FreeBSD
Installing an SSL Certificate on Microsoft IIS
Obtaining a Certificate from a Commercial CA
When Things Go Wrong
Protecting Via Redundancy
Protecting Your DNS
Protecting Your Domain Registration
Your Legal Options After a Break-In
Criminal Hazards
Criminal Subject Matter
Access Control Strategies
Controlling Access with Apache
Controlling Access with Microsoft IIS
Client Certificates
A Tour of the VeriSign Digital ID Center
Why Code Signing?
Microsoft's Authenticode Technology
Obtaining a Software Publishing Certificate
Other Code Signing Methods
Pornography Filtering
PICS
RSACi
Conclusion
Policies That Protect Privacy and Privacy
Policies Children's Online Privacy Protection Act
P3P
Conclusion
Charga-Plates, Diners Club, and Credit Cards
Internet-Based Payment Systems
How to Evaluate a Credit Card Payment System
Copyright
Patents
Trademarks
Actionable Content
A. Lessons from Vineyard.NET
B. The SSL/TLS Protocol
C. P3P: The Platform for Privacy Preferences Project
D. The PICS Specification
E. References