4 ms·
4096 bit RSA key is overkill and slow. 2048 is fine for years You probably need to support TLS 1.1 for some older clients Password entropy checks should only
by elchief 11y ago
4096 bit RSA key is overkill and slow. 2048 is fine for years
You probably need to support TLS 1.1 for some older clients
Password entropy checks should only be used in a corporate environment. You'll lose customers in a retail environment. You should certainly encourage your customers to use high entropy passwords, but forcing them to will just lose you money.
Login throttling and IP banning is a waste of time. Login throttling will just DoS yourself. You need CAPTCHA or Proof of Work.
Synchronizing Token (CSRF token in hidden form fields) is better than CSRF cookies
Use a real HTML parser (*Soup) to invalidate XSS form input not regex
- tombrossman 11y agoI see a surprising number of tutorials on blogs recommending 4096bit keys and I do wonder if people know just how much extra load that is. A properly set up HTTPS site with 2048bit certs will be pretty fast - about the same as HTTP and your time will be better spent optimizing other things like images. For anyone curious about how much slower try "openssl speed rsa2048 rsa4096" for a quick benchmark. The results are ugly.
- theandrewbailey 11y agoI might be missing something, but I've never come across software having TLS 1.1 support without TLS 1.2.
- elchief 11y agohttps://en.wikipedia.org/wiki/Template:TLS/SSL_support_history_of_web_browsers https://en.wikipedia.org/wiki/Template:TLS/SSL_support_histo... Plus user agents that aren't browsers