Re: securing web form interaction

[prev] [thread] [next] [Date index for 2005/02/16]

From: Arshavir Grigorian
Subject: Re: securing web form interaction
Date: 14:41 on 16 Feb 2005

ben syverson wrote:

>
> On Feb 15, 2005, at 12:02 PM, Jonathan Vanasco wrote:
>
>>     preemptive defense of potential SQL injection attacks
>
>
> Check out mod_security <http://www.modsecurity.org>; -- it has this 
> built-in. (There's an intro here: 
> <http://www.onlamp.com/pub/a/apache/2003/11/26/mod_security.html>;, and 
> the main guy is writing a book called "Apache Security" for O'Reilly, 
> <http://www.apachesecurity.net/>; which should be interesting.
>
>>     'human only' readable gifs on forms to preemtively defent 
>> against  bots without using some crazed throttling scheme
>
>
> There may be a pre-made module out there, but your best bet is to use 
> ImageMagick or gd to generate your own from perl. The more unique your 
> images are, the better...
>
> Although, you may want throttling implemented somewhere in your setup 
> to prevent basic DoS attacks... Check out 
> <http://www.snert.com/Software/mod_throttle/>;.
>
> - ben
>
FWIW, the technique of generating 'human only' images is called 
*[captcha* (an acronym for "/*c*/ompletely /*a*/utomated /*p*/ublic 
/*T*/uring test <http://en.wikipedia.org/wiki/Turing_test>; to tell 
/*c*/omputers and /*h*/umans /*a*/part")]

http://en.wikipedia.org/wiki/Captcha

Search CPAN for captcha. There are a few modules that already do this 
sort of thing.



Arshavir

(message missing)

securing web form interaction
Jonathan Vanasco 18:02 on 15 Feb 2005

Re: securing web form interaction
ben syverson 18:36 on 15 Feb 2005

Re: securing web form interaction
Arshavir Grigorian 14:41 on 16 Feb 2005

Apache::Request equivalent of CGI::Capture?
David Naughton 21:48 on 16 Feb 2005

Re: Apache::Request equivalent of CGI::Capture?
Adam Kennedy 01:52 on 17 Feb 2005

Re: Apache::Request equivalent of CGI::Capture?
Joe Schaefer 02:22 on 17 Feb 2005

Re: securing web form interaction
Sean Davis 18:40 on 15 Feb 2005

RE: securing web form interaction
Adam Prime x443 19:07 on 15 Feb 2005

Re: securing web form interaction
Ian Joyce 19:09 on 15 Feb 2005

Re: securing web form interaction
Octavian Rasnita 19:19 on 15 Feb 2005

Re: securing web form interaction
Perrin Harkins 20:24 on 15 Feb 2005

RE: securing web form interaction
Adam Prime x443 19:11 on 15 Feb 2005

Re: securing web form interaction
Malcolm J Harwood 21:19 on 15 Feb 2005

Re: securing web form interaction
Octavian Rasnita 19:20 on 15 Feb 2005

Re: securing web form interaction
ben syverson 20:33 on 15 Feb 2005

Re: securing web form interaction
Octavian Rasnita 08:10 on 16 Feb 2005

RE: securing web form interaction
Adam Prime x443 21:13 on 15 Feb 2005

Re: Apache::Request equivalent of CGI::Capture?
Stas Bekman 03:40 on 17 Feb 2005

Re: Apache::Request equivalent of CGI::Capture?
William McKee 14:49 on 17 Feb 2005