POET vs ASP.NET: DotNetNuke

What people said

Recommends Aristos · 2010-03 · Stack Overflow · on “Can some hacker steal a web browser cookie from a user and login with that name on a web site?”

I am working on this, and I am coming up with an idea, that I am not sure if it is 100% safe, but is an idea. My idea is that every user must pass from the login page. If some one stole the cookie, is not pass the login page, but is go direct inside to the rest pages. He can not pass the login page, because did not know the really password, so if he pass he fail anyway. So I place an extra session value, that the user have been pass with success the login page. Now inside every critical page, I check that extra session value and if found it null, I login off and ask again for the password. Now I do not know, maybe all that done all ready by microsoft, need to check it more. To check this ide

Cites Venemo · 2010-09 · Stack Overflow · on “How serious is this new ASP.NET security vulnerability and how can I workaround it?”

I've just read on the net about a newly discovered security vulnerability in ASP.NET. You can read the details here. [LINK] The problem lies in the way that ASP.NET implements the AES encryption algorithm to protect the integrity of the cookies these applications generate to store information during user sessions. This is a bit vague, but here is a more frightening part: The first stage of the attack takes a few thousand requests, but once it succeeds and the attacker gets the secret keys, it's totally stealthy.The cryptographic knowledge required is very basic. All in all, I'm not familiar enough with the security/cryptograpy subject to know if this is really that serious. So, should all AS

Cites Colin Newell · 2010-09 · Stack Overflow · on “Is there a different way to do ASP.Net forms authentication that's already built and audited?”

Like a lot of people I've gone with ASP.Net Forms authentication because it's already written and writing our own security code we're told is generally a bad idea. With the current problems with ASP.Net I'm thinking it might be a good time to look at alternatives. Important: ASP.NET Security Vulnerability - ScottGu [LINK] Video demonstrating attack [this video] Microsoft advisory including workaround [LINK] From what I understand Microsoft tend to store things on the client side because it makes it easier to operate over server farms without needing database access calls. I don't really care about server farms though and I'd like to simply have an opaque cookie that demonstrates my lack of trust

Cites Matt Kocaj · 2010-09 · Stack Overflow · on “ASP.NET MVC TempData in browser cookie”

Be really careful what you store in the client's cookie. Generally it's a bad idea to keep stuff there. Not trying to judge, but it's doing this sort of stuff that led to DotNetNuke suffering badly [this video] from the recent oracle padding exploit [LINK] .

Cites Vimal Raj · 2010-09 · Stack Overflow · on “POET Attack on ASP.Net 4 [dnn]: Is there any way to block it?”

Possible Duplicate: How serious is this new ASP.NET security vulnerability and how can I workaround it? [LINK] I just saw this video that shows a vulnerability in ASP.Net. Is there any way that we can block this kind of attacks? POET Attack on dnn [this video]

Cites Aristos · 2010-09 · Stack Overflow · on “How serious is this new ASP.NET security vulnerability and how can I workaround it?”

From what I read until now... The attack allows someone to decrypt sniffed cookies, which could contain valuable data such as bank balances They need the encrypted cookie of a user that have been already logged in, on any account. They also need to find data in cookies - I hope that developers do not store critical data in cookies :). And there is a way that I have below to not let asp.net store data in the login cookie. How can someone get the cookie of a user that is online if he doesn't get his hands on the browser data? Or sniff the IP packet ? One way to prevent that is to not allow cookies to transport without ssl encryption. <httpCookies httpOnlyCookies="true" requireSSL="true" /> Als

Cites oleksii · 2012-08 · Stack Overflow · on “Published MVC site, How to Password Protect Databases?”

You should always encrypt sensitive information stored in a config file. You can do it programmaticaly or via aspnet_regiis (see docs [LINK] for more details). Why? Because people can download a web.config file in plain text through different vulnerabilities and then they can read all the connection strings, user names, passwords etc. Possible attack list: MS10-070 [LINK] with a video [this video] Any other user on the machine can read web.config. This adds a huge list off all disclosed and non-disclosed attacks on the OS itself. Attack on the IIS FTP and subsequent web.config transmission, for example this one [LINK]

Cites Aristos · 2012-11 · Stack Overflow · on “How to Remain loggin throughout the website”

@LawrenceJohnson And take a look to this video [this video] they stole (at this time) a full encrypted cookie - imaging how easy is to stole a non encrypted and secure cookie like the one is used on the sesison.

Cites Aristos · 2013-05 · Stack Overflow · on “System.Web.UI.ViewStateException ,Invalid viewstate”

I am sorry that say that but your site did not have anything worng , and you need to re-enable your EventValidations as soon as possible. What you see is an attempt to hack your site [LINK] by sending many test numbers with your ViewState trying to find your hash key [this video] . The IP you give have a big list of activity the last few days [LINK] . Now, alternative what may cause this error is the breaking of the ViewState. You can compress it and split it [LINK] if you have too big ViewState. You can also disable all the controls that not needed [LINK] . Also you can add a log to see from inside what's is going on right on a base page [LINK] .