How can one go about verifying the security and legitimacy of a web application before accessing it?
dhulk's answer has some good info, but I think those are secondary.
Let's start with some basics:
Is it running on https? Look in your address bar. If the URL starts with https, then traffic to and from this app is encrypted.
Just because it's running on https doesn't guarantee that it's secure. The company (or person) who built the site has full access to any information that you send in.
Examine the certificate Double-click on the lock icon to see certification information (the position of the lock varies from browser to browser). Look at whom the certificate is issued to. If the name of the company doesn't seem familiar, do some google searches to figure out what the relationship is between the certificate holder and the service.
Research its reputation. Do some google and twitter searches. Try things like "don't trust X" or "security of X" (where X is the service)
All in all, you're looking for a consistent picture that suggests that the operators of the site are up front and trustworthy. It's still no guarantee, but it's a great start before you divulge personal information.
What you're after may be a little difficult. However, if you use Firefox there are a couple of things I do to protect myself from pages I haven't been before.
Second, I just came across this a few days ago, HTTPS Everywhere switches you to the HTTPS version of several sites which will offer you greater security. In addition to that, you can add as many rule sets as you want so that any site you come across and want to use the HTTPS version (has to be available of course) you can.
Hope this helps.
Suggesting some non-technical points you might want to consider in addition to the safety measures mentioned by others. They do require you to use the site to some degree so you'll have to be prepared to view portions of the site, so if you're really worried you might want to take precautions first (no script, disabling cookies etc.).
- There's a Contact Us page that lists a physical address and phone number for the company.
- All links point to where they claim to point to - check the URL in the status bar is what you expect it to be.
- They let you look round the site before signing up. While you can't expect access to all content, you should be able to view some - low-resolution images, the first paragraphs of articles etc.
- Any costs are clearly set out before you sign up.
- There's a no-cost option that allows access to some content.
- The site shouldn't ask you to install anything on your computer.
While I wouldn't expect all of these to be always present (apart from the contact us page) - after all each site is different - I would expect some content for free.
My primary concern is security, not so much legitimacy. Sometimes, a site is just so new, you're not going to find much about it.
For security, I would test whether the site prevents XSS, CSRF, directory traversal, buffer overflows, SQL injection, etc. There are various ways to test any of the above exploits, and any site that fails your test should be viewed with concern.