In a client-server model, the server serves services to the client.

learn more… | top users | synonyms

2
votes
1answer
30 views

OpenVPN: Storage location and creation of keys/certificates?

I am re-setting up some OpenVPN infrastructure to be more secure than the original and wanted some guidance. It's noted that the best security policy is to keep the Certificate Authority (CA) offline ...
1
vote
4answers
163 views

Authentication with an untrusted server

I asked a related question earlier, but I want to ask a broader version this time: To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
2
votes
1answer
70 views

What should a client verify after getting a client certificate?

I have a client that generates a csr, sends it to a server, the server then sign it and return the certificate as a String. the String is then decoded to a x509Certificate (using Bouncycastle's ...
1
vote
1answer
109 views

Is it safe to store public key encrypted password in the Mobile Device for authentication purposes?

I have a Apache Cordova hybrid mobile app that needs to authenticate users, but we don't want to prompt for credentials every time the app is used. Some options came to my mind: Store the password ...
3
votes
2answers
138 views

How to troubleshoot “client certificate” related errors in 2 way HTTPS

I have a webserver which is asking for client certificate for mutual authentication. I have what I think is the right certificate loaded into my client browser. However, the browser is not able to ...
0
votes
1answer
63 views

Create https session between server and client

I'm doing a project about security transactions and i'm wondering if to establish a connection based on https both client and server need to have a ssl implementation installed to preform the ...
1
vote
1answer
155 views

When SSL detect a replay attack?

Suppose an attacker records all messages of a SSL handshake (RSA one-way), and starts a replay attack. When (after which message) can the server possibly detect the attack? Now suppose the attacker ...
2
votes
2answers
101 views

OpenSSL SSL enabled client application, server verification?

I am writing an OpenSSL SSL enabled client application which connects to a Google server. I have the SSL working and I can monitor the traffic and see that it is definitely encrypted. I am using ...
22
votes
1answer
2k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
1
vote
1answer
87 views

Client authentication flaw in old Netscape SSL protocol

Below is a screenshot from the paper "Prudent Engineering Practice for Cryptographic Protocols" by Martin Abadi and Roger Needham. I can't see what's wrong with the protocol and what the fix achieves. ...
2
votes
1answer
324 views

Using client certificates for website authentication

I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
0
votes
1answer
93 views

What are the risks of connecting via VNC to an untrusted host?

There are questions about connecting to an untrusted host via SSH [1] [2], RDP, and with X11 forwarding enabled. What about when connecting via VNC? What risks are there to the client? To be clear: ...
0
votes
1answer
1k views

iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates)

As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2. ...
0
votes
1answer
89 views

Transmission of messages

I am currently developing a game which will be run in a client, they will sign up for this game online and create their account there, their information will be stored into a MySQL database. I am ...
3
votes
3answers
1k views

Revoke a certificate without index.txt

I generate self-signed client certificates for a little Apache server hosted under my stairs. The script below was hacked together for this purpose - note it uses the 'mini-CA' x509 method, therefore ...
1
vote
2answers
207 views

How to uniquely identify / tag client devices to whitelist VPN access?

I'm just wondering if there is any way to uniquely identify or tag client devices like laptops and towers in order to whitelist them for vpn access. (Note: This is a thought-experiment at the moment, ...
2
votes
2answers
266 views

Web Service Security Checklist - Tracing and Debugging

I have been reading this security checklist about web service design: http://msdn.microsoft.com/en-us/library/ff648304.aspx One of the suggestions is that you should disable the following in ...
2
votes
2answers
185 views

SSL/TLS Client Authentication by IP

Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example: There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
4
votes
2answers
3k views

Certificate Chain checking

I have a very specific question. A client verifies a sever by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (According to the ...
37
votes
5answers
3k views

Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?

I've been worried about this password manager, PasswordBox that seems to be gathering quite a bit of steam lately. They seem to have raised VC funding and are offering a free password management and ...
2
votes
2answers
434 views

SSL: How to send generated client certificate from server to avoid MITM?

The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
-1
votes
2answers
409 views

Generate openSSL certificates from within C code using commands?

This is an openSSL command for generating a private key and a certificate, openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key The question I have is whether there is some ...
6
votes
1answer
4k views

SSL Cert Types and Key Usage

I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
6
votes
2answers
429 views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
1
vote
0answers
224 views

Fuzz a client with sulley [closed]

I want sulley to bind to an interface, wait for a connection and fuzz the reply to the client. How can I act as a server with sulley to fuzz a client ?
1
vote
1answer
143 views

Client vs Server security for business critical application (crossplatform)

We have the option to develop a software either based on Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
0
votes
2answers
502 views

Keeping the password secret over regular http

I would like to at first be clear that this is for poor site owners who can't afford the SSL option but require logins to their site, potentially from a public kiosk, and need a secure method of ...
11
votes
5answers
2k views

Is it worth the effort to store FTP passwords encrypted?

I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...