Quote from: Kazuldur on November 20, 2016, 12:36:46 PM

Quote from: dmitritrader78 on November 20, 2016, 12:25:26 PM

Quote from: Kazuldur on November 19, 2016, 06:34:55 PM

Quote from: tomos81 on November 19, 2016, 02:11:42 PM

hi,
you can rename your "project" to Kamikaze Microwallet service also, without HTTPS Tongue

+1, using this is suicide. No HTTPS and it looks like they're hosting a bunch of other stuff on the same server (it doesn't even have it's own domain) together with other stuff.

We have added SSL support.

You didn't deploy HTTPS correctly, you're vulnerable to https://blog.cloudflare.com/yet-another-padding-oracle-in-openssl-cbc-ciphersuites/ . There are more problems (check https://www.ssllabs.com/ssltest/analyze.html?d=wmzona.com ), but this one is critical.

Thanks Kazuldur, I have fixed (CVE-2016-2107). Now WmZona Microwallet Service is highly secured.

dmitritrader78

Posts

Merits