Tell me more ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.
up vote 7 down vote favorite
1

How can one go about verifying the security and legitimacy of a web application before accessing it?

share|improve this question

6 Answers

up vote 5 down vote accepted

dhulk's answer has some good info, but I think those are secondary.

Let's start with some basics:

Is it running on https? Look in your address bar. If the url starts with https, then traffic to and from this app is encrypted.

Just because it's running on https doesn't guarantee that it's secure. The company (or person) who built the site has full access to any information that you send in.

Examine the certificate Double-click on the lock icon to see certification information (the position of the lock varies from browser to browser). Look at whom the certificate is issued to. If the name of the company doesn't seem familiar, do some google searches to figure out what the relationship is between the certificate holder and the service.

Look for a privacy policy. This should specify what they do with the information you give them. It doesn't guarantee that they'll obey their stated policy, of course.

Research its reputation. Do some google and twitter searches. Try things like "don't trust X" or "security of X" (where X is the service)

All in all, you're looking for a consistent picture that suggests that the operators of the site are up front and trustworthy. It's still no guarantee, but it's a great start before you divulge personal information.

share|improve this answer
Thanks for the input on this as a follow up, I made another specific question that you may be able to help on: webapps.stackexchange.com/questions/807/… – Woot4Moo Jul 1 '10 at 14:10
Decent answer, but dhulk's concerns are anything but secondary. Cross-site scripting attacks are good way to get your computer hijacked by unknown parties, so his NoScript recommendation is very important. – Scott A. Lawrence Jul 1 '10 at 15:21
Yeah, regarding NoScript, the only place I don't use it is here at work since I'm a web developer and I'm usually just looking at Google, Stack Overflow, and sites that I've built, so I'm not concerned as much with scripting attacks at that point. – dhulk Jul 1 '10 at 16:23
I didn't mean to imply that dhulk's concerns were of less importance. Instead I meant that there are other items I would examine first. NoScript is a very nice solution -- for those of us who understand what it's doing. I think that the vast majority of web users don't know, don't care and shouldn't need to know what is handled by scripting vs static HTML. With NoScript installed, these users will be befuddled by an apparently non-working site. – Doug Harris Jul 1 '10 at 17:14
Very true, I often forget myself that I have it running and slight frustrations always occur when I visit a new site and it doesn't work. It's not something that novices are going to want to use really. – dhulk Jul 1 '10 at 17:20
up vote 4 down vote

Suggesting some non technical points you might want consider in addition to the safety measures mentioned by others. They do require you to use the site to some degree so you'll have to be prepared to view portions of the site, so if you're really worried you might want to take precautions first (no script, disabling cookies etc.).

  • There's a Contact Us page that lists a physical address and phone number for the company.
  • All links point to where they claim to point to - check the URL in the status bar is what you expect it to be.
  • They let you look round the site before signing up. While you can't expect access to all content, you should be able to view some - low resolution images, the first paragraphs of articles etc.
  • Any costs are clearly set out before you sign up.
  • There's a no cost option that allows access to some content.
  • The site shouldn't ask you to install anything on your computer.

While I wouldn't expect all of these to be always present (apart from the contact us page) - after all each site is different - I would expect some content for free.

share|improve this answer
up vote 3 down vote

What you're after may be a little difficult. However if you use Firefox there are a couple of things I do to protect myself from pages I haven't been before.

Firstly, I use the NoScript add-on for Firefox. It keeps Javascript from running on sites that you don't explicitly allow.

Second, I just came across this a few days ago, HTTPS Everywhere switches you to the HTTPS version of several sites which will offer you greater security. In addition to that you can add as many rule sets as you want so that any site you come across and want to use the HTTPS version (has to be available of course) you can.

Hope this helps.

share|improve this answer
HTTPS Everywhere is an awesome suggestion. Are they making an extension for Chrome? – jinsungy Jul 1 '10 at 13:53
Not sure really, I just learned about it recently, but I sure hope so. – dhulk Jul 1 '10 at 13:55
I will take a look into HTTPS Everywhere – Woot4Moo Jul 1 '10 at 14:14
i cant see how the existence of https ensures the web app is "secure". you transfer encrypted stuff to them and behind your back they sell the data. maybe i didn't get the meaning of the question in the first place... – akira Jul 1 '10 at 14:33
@akira it doesn't really, but the web application being secure isn't all you need to be concerned with. There's not really a way to ensure that your data is safe as even people that claim to take care of your information (remember Google buzz?) can accidentally do things with your data that you'd rather not do. – dhulk Jul 1 '10 at 16:21
up vote 1 down vote

You can never be 100% certain.

Different browsers can help you in different ways:

IE has several security features

As does Firefox

And Chrome too

All three have a feature which will detect possible mallware, phishing, out of date or bad certificates.

share|improve this answer
up vote 0 down vote

My primary concern is security, not so much legitimacy. Sometimes, a site is just so new, you're not going to find much about it.

For security, I would test whether the site prevents XSS, CSRF, directory traversal, buffer overflows, SQL injection, etc. There are various ways to test any of the above exploits, and any site that fails your test should be viewed with concern.

share|improve this answer
up vote 0 down vote

Install WOT or SiteAdvisor or look-up the site on their website. Go to the site's page and read the reviews.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.