Web security | Why encrypting your data at the source is a must!
For too long software developers and solution providers think building an SSL (HTTPS) based tunnel and solution is truly secure; but it isn’t.
Let me get this off my chest -> SSL/HTTPS communications are only part of the solution!
When building solutions and architectures, SSL based communications only encrypt the flow of data and not the data itself - not at the source.
So if you find yourself owned by malware or going through advance sniffers and rogue proxies, the data you send in "the tunnel" will be accessible - in clear!
Here's a basic scenario for you.
Let's say you’re going on your bank account and a malicious user was able to install a rogue proxy on your computer or on the wifi/network connection you're using.
When you enter your username and password and click on through, the data you just entered in the form is most usually sent in clear to web servers.
In plain English, for most web solutions if the data is intercepted, your login information (username and password) is accessible in clear text and possibly grabbed by a malicious user.
And to show this, look below and find what a rogue software installed on your machine or in the network flow can do.
In the image below - at the bottom, you’ll see that my username and password are in clear. And this isn't Facebook or Google, this is one of my bank accounts...
Notice the two orange rectangles at the bottom of the image -> my username and password are in clear text!
Now this bank isn't the only one, and my goal isn't to bash them in any way, but it goes to show how we can do better in security.
Many, if not most, security professionals make the mistake of thinking SSL connections are fundamentally secure and take care of all connection-related risks as comms are encrypted.
But many professionals forget that SSL encrypts the tunnel of data, and not the data itself!
To better our security solutions, please stop focusing on passwords and HTTPS for a moment and focus on encrypting the data at the source.
In this day and age, we need this.
Now, of course, many of you will say “boomseb, anyone could technically record keystrokes and so on" and you're right!
But let's at least encrypt login form data when the user enters it to minimize risks at a more reasonable level.
And to do so, you don't have to be a genius, solutions and code libraries are accessible and exist for this exact need and they should be used more frequently.
Knowing these details, your following security architecture and software solutions should integrate the following in your next update...
Encrypt data sent from the login form. This should be a de facto standard on the web.
Your solution shouldn't accept just any SSL certificate. So check for pinning and certificate sources before accepting connections to your solutions.
Control what type of browser and platform can safely connect to your solution. If you accept any browser or OS on the planet, you put your solution at risk.
Implement a 2-step authentication mechanism. This isn't perfect, but can at least minimize the risk of malicious users grabbing usernames and passwords and riding in the wind.
Geolocation security controls should be integrated in every solution. Stop thinking all your clients are connecting from anywhere on the planet... Especially if a client uses your service in a specific country, then 5 minutes later connects from another country.
So that's it, have fun and code safe. If you don't do it for yourself, at least do it for others and keep them safe ; )