In “Secure Your Web Application’s I/O” (InstantDoc ID 25227), I discussed methods for securing your Web applications from a design and programming standpoint. Now, it’s time to take a look at securing your users' experience—specifically, through the logon mechanism. Gone is the day when you could simply create an .htaccess file and just use the built-in, basic authentication mechanism in HTML, which was easy and simple but incredibly unsecure. The rise in quantity and sophistication of phishing, social engineering, identity theft, and other online fraud attacks make passwords alone an ineffective security measure for most online transactions, particularly those that recur and involve access to personal financial information. It's one thing for someone to gain access to your Amazon or free email account; it's another thing entirely for someone to crack your online banking account. . . .
Register
