Summary

While some attacks get a lot of press and glory, the trust relationships that drive society's reliance on the web are paramount. Attacks on these trust mechanisms are very concerning given that they often leave users and application developers unaware of the compromise. Many of the other threats covered in this book and represented on the OWASP Top 10 are something that the web application's owners can control or have in their power to remediate. Cryptographic or PKI-based attacks, however, involve other aspects outside their realm, such as the certificate authority's integrity, the network's tolerance for ARP injections, and the integrity of local area networks outside the application's own domain. In the case of attacks such as Heartbleed and POODLE, even the software relied upon to deliver these services can be guilty of the ultimate compromise...