Articles


About This Series

Last time, we covered a scenario in which a threat actor found leaked RSA private keys used by a TLS wildcard certificate for “Poor Corp.” By chaining the leaked private key with DNS misconfigurations, the attacker was able to impersonate a Poor Corp subdomain and use it to create highly effective phishing emails.

In this series, we will dissect not just what an attacker can do to get access to credentials, but also what they would do after getting that initial access. We will walk through a different threat scenario in each part of the series and tell stories of malicious hackers that are either true, based on a true incident, or reasonably theoretical.

Source de l’article sur DZONE

Many websites today use some type of traditional Content Delivery Network (CDN), which means improvements in website load times, decreases in bandwidth, and better redundancy and security. But not everything is optimized, specifically when it comes to images, and image CDNs can help with that! 

Traditional vs. Image CDNs

A traditional CDN treats images as static. If you want to tailor images to better match various mobile device types, then you need to create many variants of each image and upload them to your web server. It also means you must develop responsive code that will tell the server and CDN which image variant to deliver. This is clunky, time-consuming, and inefficient. For a large website, the amount of code needed can be astronomical. Using this static image model, there’s just no realistic way for each image to be effectively sized and compressed for every possible device model – at this point, there are thousands of them. The combination of these two unfortunate factors leads to potentially slow load times and poor UX caused by oversized images delivered to mobile devices.

So what is an image CDN? An image CDN builds on the traditional CDN model with the addition of device detection and image optimization. Instant detection of the device model and browser requesting the images is done right at the device-aware edge server (true edge computing!) Additional information, including screen resolution and dimension, pixels per inch, and support for next-gen image formats (such as WebP, JPEG 2000/JP2, and AVIF), provides even more details crucial for superior image optimization. Using this information derived from device-aware edge servers, the image CDN optimizes each image and serves the perfect version for each device and resolution, meaning users get the finest webpage experience faster.

A Bit About the Edge (Whoa, Living on the Edge?)

With a single server website, a web request would have to travel from the requestor, back to the origin server (wherever that was geographically located), be processed, and then travel back to the requestor. Depending on the physical distance between the requestor and the origin server, this could introduce a great deal of latency, which means lag time on page loads. 

A traditional content delivery network (CDN) is a global network of servers that optimizes web performance by using the node geographically closest to the user for faster delivery of assets. It takes static content like images and stores them on the edge. But usually, these edge servers are relatively simple in terms of their role in business processes. They mostly index, cache, and deliver content. And traditional CDNs like to keep edge servers simple because of concerns over CPU usage, storage, and scalability.

But what if these edge servers could also provide computing power that enhances performance and business processes? This is called edge computing. Slowly, CDNs are starting to open their edge servers to allow enterprises to deploy apps/services on the edge. Likewise, Cloud computing networks (e.g., AWS, Azure, Google Cloud) provide virtualized server capacity around the world for those who want to use geographically distributed servers. In a sense, Edge Computing is a marriage of the CDN (where edge servers synchronize/work with each other) and Cloud computing (where servers are open to applications). 

Edge computing is a fascinating concept, but what is the killer app that will enhance business processes and improve website performance? The addition of device detection to edge computing provides the ability to transform from delivery of static images to a new model where images are dynamic and tailored exactly to devices. 

Edge computing is computing that is done in a geographically distributed space, with many servers located at or near the source of the web request. This reduction in bandwidth and latency leads to fast processing times, increased site speed, and improved customer experience. And edge computing doesn’t require new infrastructure — it leverages the networks of existing providers to create Points of Presence (POP) around the globe. 

The Edge Servers are…Aware?

Device-aware edge servers, like those used by the ImageEngine image CDN, take edge computing to a new level. Device detection is actually one of the use cases where edge computing really shines. Normally, the edge server would have to send a Javascript query to the device to figure out any information about a requesting device’s model, browser, operating system. But with a device-aware edge server, the User Agent string is captured and decoded. This contains all of the information necessary for device detection without the need for any back and forth – a definite speed improvement. So you’re starting ahead of the game! 

Each time a new request comes to the device-aware edge server, the image is processed by that server (meaning optimized for that specific device parameters) and stored right there in cache, primed for future use. This is done in three stages: changing image size based on device resolution, compressing the image using an image optimization tool, and selecting the most efficient file format for the device. 

If the device-aware edge server has already processed a request from a similar device model before, then it can serve the device-optimized image from its edge cache, leading to a lightning-fast server response — and ImageEngine’s device-aware edge servers can serve up cached images 98% of the time! Not only is there geographical proximity because of the distributed global POP network, but the smaller size of the optimized image compared to the full-sized original cuts up to 80% off the image payload. This can cut up to several seconds off page load times. When almost 70% of people say that page speed influences their likelihood of making a purchase, every single second counts! 

Some image CDNs detect the device information and group the devices into “buckets” of similar types and serve an image based on that type. While this is certainly an advancement over a traditional CDN, and works passably well for some common devices, it still isn’t a truly optimal solution. There are so many variants of browser, screen size,  resolution, etc., even among very similar devices, that images are still often oversized (too large payloads) and lead to poor load speed. A true image CDN, such as ImageEngine, serves the perfect image for every device, every time.

So Now You Want To Get Started (Don’t Worry, It’s Really Simple)

One of the best things about the ImageEngine image CDN is the ease of integration – and it can integrate into any platform that supports a 3rd-party CDN. All you need is to sign up for an account and receive a delivery address during your two (yes, 2!) minute signup process. This delivery address is used to redirect image traffic for optimization and superior delivery performance. Next, you’ll have to make some slight adjustments to img tags on your website, but that’s really all the work you’ll need to do. There are no DNS changes during a standard (generic delivery address) integration. You read that right, none at all. Contrast that to a traditional CDN integration, where there is just no way around some messing around in the DNS – in fact, usually some fairly extensive DNS changes. 

This low-code, virtually no code, integration saves you time. It saves you money. It saves you the hassle of putting multiple team members on a new project. And it means that you can be up and running in about 15 minutes with a standard install. You can be serving optimized images to your site visitors at blazing fast speeds before lunch! And don’t worry, ImageEngine has an experienced integration support team available to answer any questions you might have. 

There’s also no issue with adding the ImageEngine image CDN on top of an existing CDN. Traditional CDNs may have security features that you may prefer to keep for your site. It requires slightly more integration but provides the same benefits of a solo ImageEngine implementation — screaming fast image load times and perfectly optimized images from device-aware edge servers. All that is recommended is that the ImageEngine image CDN actually serve the images directly, not simply process them, to get maximum benefits.

Adopt an Image CDN and See The Benefits

We’ve learned that image CDNs bring numerous benefits to your site AND your business. Using device-aware edge servers, image CDNs provide measurably better UX to your visitors. Pages load potentially seconds faster with perfectly optimized images, meaning your customers get to the heart of your message right away, and you don’t lose potential sales. 

Image CDNs are actually 30%+ faster than most traditional CDNs, improving site speed accordingly. From an SEO perspective, that’s huge! And your SEO gets an additional boost from the improvement to your Largest Contentful Paint scores (which can help you gain valuable rank on Google’s SERPs). Implementation is simple and fast. You get all this, plus cost savings: since you have smaller payloads because of the fully optimized images, you’re delivering fewer gigabytes of data.

Source

The post Image CDNs: How Edge Computing Provides a Faster Low Code Image Solution first appeared on Webdesigner Depot.

Source de l’article sur Webdesignerdepot

 

Contexte

Sept vulnérabilités concernant le serveur DNS de Microsoft ont fait l’objet d’un correctif à l’occasion de la mise à jour mensuelle de mars 2021. Parmi ces vulnérabilités, deux permettent un déni de service alors que les cinq autres permettent une exécution de …
Source de l’article sur CERT-FR

It’s no secret that having a custom domain name is an essential piece of any company’s branding strategy. While there are a myriad of hosting plans available that offer domains like your company.webhost.com, making the shift from one of those to simply yourcompany.com is an important step.

However, your domain branding strategy need not end there. Domain mapping offers an opportunity for web developers and online business owners the ability to improve their marketing campaigns, protect their brands from competitors, cut down on costs, and develop a more efficient workflow.

What is Domain Mapping?

Domain mapping refers to how visitors to your website are directed to different domains and subdomains and what URLs will be displayed in the visitors’ browsers.

When you first set up your online business, one of the very first things that you do is register a domain name for your company website. But depending on the business, it could be wiser to actually register multiple domain names at once. This is because you will want to lease the primary domain name you plan on using in addition to all related TLDs. This way, cybersquatters will not be able to hold your domain name hostage, especially once you have grown into a more established brand.

For example, if you register the name yourcompany.com, you might also want to register yourcompany.net and yourcompany.org. Then you might set up a URL redirect so that visitors to the latter two sites will be redirected to yourcompany.com. However, with a domain redirect, visitors to yourcompany.net and yourcompany.org will be redirected to yourcompany.com, meaning the URL in their browser will appear as yourcompany.com no matter what they typed.

With domain mapping, this isn’t the case. A visitor to yourcompany.net will still see that URL in their browser even if the content is actually being hosted on yourcompany.com.

Benefits of Domain Mapping

Although domain mapping may seem a bit esoteric and complex at first, it serves several purposes and offers many benefits:

1. Make Web Addresses Easier to Remember

Imagine that your restaurant chain, Larry’s Lunches, just opened a new chain on 116th Street in New York City. Your first instinct may be to direct customers to larryslunches.com/116thstnyc, but that domain is a bit long and hard to remember. Instead, you might want to register the domain larrys116th.com for customers for that specific store.

With domain mapping, you can serve up the content from your main domain, larryslunches.com, while still having your visitors see larrys116th.com. This makes it easier to brand your sites without having to manage several different sites.

2. Boost Your Web Development Career

If you are a web developer yourself but are not admittedly well-acquainted with domain mapping already, you would do well to change that.

One of the easiest ways would be to look at online web development programs that one can take to read through documentation to get caught up to speed on how domain mapping can help their efforts and how to implement it. These kinds of programs can be more comprehensive than university courses and offer an impressive 88% job success rate for those who successfully complete the programs.

3. Shield Your Brand from Competitors

Remember, it’s a good idea to purchase several different related domains in anticipation of competitors snatching them up from you. Choosing the right domain names is essential to protecting your brand.

For example, Larry’s Lunches might want to snag larrysnyclunches.com and larrysfamouslunches.com as well. However, simply leaving those domains parked can be a bit of a waste, and managing multiple domains can be a pain in and of itself.

But with domain mapping, you can manage those domains just as easily as if they were your primary site, so you no longer need to leave them empty.

4. Save Time and Lower Development Expenses

Development isn’t cheap, and time is money. While the maintenance costs for a website are already high enough, adding in separate domains can sometimes break the bank due to the increased complexity of managing so many different moving pieces.

Domain mapping can lower expenses and save time by keeping everything tidy and in one place. By managing everything from a single WordPress installation, for example, you can push updates to all your subdomains at once, saving you from the tedium of going through each domain and making the same updates.

5. Manage Client Sites from One Place

If you’re a freelance developer or run an agency, using domain mapping for some of your clients’ sites can save you time as well. For example, if several clients want blogs, and you use the same infrastructure for them, you can easily push updates and changes to all of them at the same time. In short, domain mapping can make maintaining sites much easier and quicker.

How to Implement Domain Mapping

If you’re sold on the benefits of domain mapping, here’s a quick primer on the steps you’ll need to take to get started:

  1. Choose a domain registrar: The ideal registrar you choose should come with a number of important features including adequate hosting for keeping your website visitor friendly, SSL certification to ensure security, 24/7 customer support, comprehensive packages that make it easy to operate your online business.
  2. Register the domains you’re interested in: These can either be domain misspells (otherwise known as typosquatting), like youcompany.com, yourcmpany.com, etc, or related domains like yournewproduct.com, yournewlocation.com, etc. Whatever you decide to go with, you’ll need to have it registered before you can get started.
  3. Install WordPress Multisite: WordPress is one of the easiest ways to develop websites, and that holds true for domain mapped sites as well. Plus, considering WordPress sites account for over a third of the entire internet, you can’t go wrong with the famed CMS. All you need to do is install WordPress and, once that’s installed, open wp-config.php and add define(‘WP_ALLOW_MULTISITE’, true) above the /*.
  4. Configure your DNS settings: Next, you’ll need to point all your name servers to your hosting account. These changes can take up to 72 hours to go into effect.
  5. Add domains to your hosting plan: From your hosting platform, you’ll need to link your custom domains. You can usually do this from your cPanel.
  6. Map subsites to your custom domains: Once you have your domains set up, you’ll need to link them through WordPress. To do so, simply login and navigate to Sites -> Add New. After you assign them a subdomain or subdirectory name, you can click Edit and add your custom domain. Then just hit Save Changes, and you’re good to go.

Take note that domain mapping is not necessary for transferring a domain name. When you map a domain, you’re simply telling your domain where it can find your website on the internet through having your name servers updated. When you change your name, it only affects where the domain has been resolved.

The Bottom Line

While domain mapping isn’t necessary for all websites, it can still be a major timesaver. By utilizing it properly, you can greatly improve the standing of your online business by saving time and money, making website management easier, and improving the branding of your sites.

 

Featured image via Unsplash.

Source


Source de l’article sur Webdesignerdepot

Like it or not, we’re slowly edging towards a two-tier web: those sites that are secure, and…everything else.

There was a time on the web, when we didn’t have SSL certificates, and lots of people’s data got stolen. To address the problem, and regain users’ trust SSL certificates were introduced to secure sites handling sensitive data. And because they were initially a niche technology, you paid through the nose for them.

(An SSL certificate, for those that don’t know, is the difference between http:// and https://)

Then, thanks in part to privacy initiatives, and in part to high-profile data breaches, a few big players decided that all data should be protected. And the next thing you know, Google’s using SSL certificates as a ranking factor. And then suddenly browsers are warning people that non-SSL certified sites are insecure and they should “Get Out of Here!” And before long your hobby blog about cat-friendly board games is being billed hundreds of dollars a year just to be seen on the web.

Choosing whether to jump on the SSL bandwagon is simple: you have to have one. Finding an affordable SSL certificate, now that’s a challenge.

Most hosting companies will provide you with an SSL certificate as an add-on, and they’ll charge you anything up to $200 per year for it.

That’s why we’re blown away by ZeroSSL, because ZeroSSL is the first practical opportunity to grab an SSL certificate for your site, for free!

Get an SSL Certificate for Free

Now, it must be said that ZeroSSL isn’t the first place to offer a free SSL certificate. Plenty of hosts offer a “free” SSL certificate for the first year, when you pay for premium hosting. And there’s Let’s Encrypt which offers free certificates if you can work out how to access them.

ZeroSSL is just the first place to offer a genuinely free SSL certificate that you don’t need a post-grad degree in server engineering in order to use.

Get a Free SSL Certificate from ZeroSSL

Using ZeroSSL’s free-forever plan you can register three 90-day certificates entirely free. You’ll never need to pay for them, just renew every few months.

ZeroSSL also offers a variety of packages for simplifying your SSL management. The Basic package for example starts at $8/month and offers unlimited 90-day certificates, and even three 1-year certificates so you can renew annually and forget about them the rest of the time.

ZeroSSL also scales; if you need unlimited 1-year certificates — because you have, erm, unlimited websites? — that’s possible too.

Where ZeroSSL Excels

ZeroSSL offers a number of benefits over its competitors.

Firstly there’s the full-featured management console, that makes SSL management transparent. It sounds like a little thing, but with many other suppliers the first thing you know about your SSL certificate expiring is your site breaking.

ZeroSSL…makes managing your certificates…insanely easy.

ZeroSSL has an easy-to-use REST API, which can be used with the language of choice: PHP, Ruby, ASP, anything. It makes managing your certificates for multiple sites insanely easy.

Verifying SSL certificates can be confusing, and technically difficult. But ZeroSSL streamlines the process with automatic CSRs and one-step email validation (even for multiple domains) — considerably faster and easier than industry standard DNS validation. There’s even a one-click check to make sure your certificate is installed correctly.

Most importantly, ZeroSSL offers superb technical support on all of its paid plans. So if you’re one of the many people who started reading this post without fully understanding what an SSL certificate is, you can be confident that if you run into difficulties getting set up, there’s someone available 24/7 to dig you out of the hole.

Getting Started with ZeroSSL

If by now you’re planning to try ZeroSSL, the best place to start is the free-forever plan. ZeroSSL allows you to upgrade, downgrade, or cancel at any time, so it makes sense to start with the no-credit-card option and upscale if you need it.

Using ZeroSSL’s dashboard you can create a free 90-day SSL certificate in minutes, and the step-by-step installation instructions will guide you all the way through.

ZeroSSL’s 1-year certificates are the gold-standard of SSL protection

ZeroSSL auto-generates certificates in different formats depending on your choice of platform, to speed up installation.

You can register certificates for multiple domains — you will have to verify each domain individually, but it’s simple to setup. Premium plan users can even use wildcards, allowing you to secure a site with multiple sub-domains, from a single certificate.

ZeroSSL’s 1-year certificates are the gold-standard of SSL protection and are the option that most site owners will come to rely on.

If you’re running an agency and you’re responsible for maintaining multiple client sites, ZeroSSL is made for you. ZeroSSL’s dashboard gives you one central location to monitor the status of all of your SSL certificates, and you can set expiry reminders to notify you by email when a certificate is about to expire.

Automated SSL Renewal with ZeroSSL

If that sounds too much work, and you’d like to automate your SSL certificates, ZeroSSL has you covered.

ZeroSSL works with both its own dedicated ACME Certbot, and more than ten other third-party ACME clients to fully automate your SSL certificates absolutely free, on a rolling 90-day schedule.

If you really know what you’re doing, you might even consider the ZeroSSL’s REST API. It enables certificate creation, validation, renewal, and management using HTTPS Get calls and JSON responses. The API handles millions of requests per month using 256-bit bank-level HTTPS encryption. You can access the API for free, and the Pro plan offers unlimited access.

Go Get Certified

There are millions of sites that drop traffic every month because they lack an SSL certificate.

Whatever your site, it’s not a question of whether you need an SSL certificate, it’s how you can affordably manage to create, install, and monitor a certificate.

ZeroSSL solves all of the problems of SSL certificate management, and for the majority of users, its free-forever plan is all you’ll ever need.

Head over to zerossl.com today to boost your traffic with a free SSL certificate.

 

[– This is a sponsored post on behalf of ZeroSSL –]

Source


Source de l’article sur Webdesignerdepot