What The Hell? SSL Certification is a Bribe

Copyright © 2009 What The Hell? Security What does SSL stand for?   H-Y-P-N-O-T-I-S-M. No, really. Give me the first answer that comes to your mind. Don’t filter it. Why do you purchase SSL certificates for your site? You answered something having to do with security, right? You are so not right. What you’re doing [...]

What The Hell? A Certified Webform!

Copyright © 2009 What The Hell? Security Assume for a moment that you are a legitimate business entity called Example.com.  By legitimate I mean you have been vetted in a way that demonstrates you qualify for an Extended Validation SSL (EV-SSL) certificate, whether or not you actually own one or even want to.  You publish [...]

What The Hell? Moore’s Law and Web Security

Copyright © 2009 What The Hell? Security Convenient to the point I make here, the terms Moore’s Law and Hypertext were both coined in 1965. Since then, if I’m counting correctly on fingers and toes, CPUs should have improved by roughly a factor of (2 **(((2009 – 1965)*12)/18)) = 676,414,963.  The actual number doesn’t matter [...]

What The Hell? Post-Click Fraud is the New Phishing

Copyright © 2009 What The Hell? Security Phishing is so pre-”What The Hell Security.”   Here’s what post-click fraud has that phishing doesn’t. In name: jargon-free (sorry d00dz) capitalizes on an understood concept (fraud) describes its boundaries (the fraud after the click, not the fraud after the card trick) In meaning: encompasses all link-aware applications (office [...]

What The Hell? Dispose of Phishing?

Copyright © 2009 What The Hell? Security Phishing used to be a bounded phenomenon. Mirriam-Webster Online defines it as “a scam by which an e-mail user is duped into revealing personal or confidential information which the scammer can use illicitly.“ Translation: Receive an email thick with Romanian accent; click on “Click hear” [sic]; transcribe your [...]

What The Hell? The Real Web Fraud: SSL

Copyright © 2009 What The Hell? Security What do you call a ubiquitous security technology that has only ever delivered on half its promise?   SSL. Don’t get me wrong.  SSL has proven pretty decent at delivering transport  security.   For B2B applications requiring mutual authentication, that is.  (Ironically, in many cases those applications use manually-exchanged [...]

Follow

Get every new post delivered to your Inbox.