Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

learn more… | top users | synonyms

-3
votes
0answers
57 views

What do you need to make your own R.A.T.? [on hold]

I'm looking for an exhaustive & precise list: Which programming language, which software I have to use etc... Something to make one pretty customized, with options like keylogger, files transfer, ...
0
votes
2answers
125 views

Storing unencrypted, confidential data in client memory

I am currently working on a service which lets users store client-side encrypted data and access it anywhere. The client connects through a browser and the webapp is written in JavaScript. To easier ...
3
votes
1answer
87 views

Asymmetric / end to end encryption for web messaging app

Background I'm trying to design a secure and sustainable web app for messaging. The purpose is to learn how to create secure web application. The application is suppose to be written in Javascript ...
1
vote
0answers
39 views

How is Tresorit client-side encryption key stored and managed?

I am using Tresorit on Mac OS X and iPhone. When I am using it there is always applied client-side encryption before posting the file to cloud. The key used for encryption is AES-256 and CFB mode of ...
1
vote
1answer
94 views

What precautions I can take to secure software against user?

I want to build a client that connects to my server and uses server API. You can consider this as a banking application because data security is the most important thing. Since the users or hackers ...
4
votes
1answer
49 views

Securing client-side data from users

So my problem, in its general form, is encrypting test questions such that a client-side testing application can access the questions while students cannot. The naive approach, in my opinion, is to ...
1
vote
2answers
127 views

How to be sure laptop's trusted certificates are safe

I have a Windows 8.1 Lenovo laptop. The evil Superfish app and certificate have been removed. My laptop has 36 certificates in certmgr.msc current user\third-party root certification ...
1
vote
2answers
55 views

Client side encryption with sustainability as a service

I only need 2 things. 1) The user to know that only him (not even then admins) can decrypt his data that rely on my server. He will always provide his key to decrypt data. 2) To be able to provide ...
1
vote
1answer
26 views

Can a Certificate Authority associated with Active Directory publish a client certificate to a browser?

Can I use some integration of Windows Active Directory and a Certificate Authority to embed a client certificate in a browser that will be trusted by a server? I have a private domain and control ...
0
votes
1answer
106 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...
1
vote
1answer
42 views

SSL with client certificate authentication

can somebody explain to me if for example i use Server certificate, with 2048bit keys and client certificate with only 512bit strength, does this use in any way affect the security of the established ...
2
votes
3answers
74 views

Verify client-side created data

I have a Java applet, which records the whole screen of the user and uploads the images to the server. If one would be able to (and many people could, I know) falsify the screen recording they could ...
11
votes
3answers
665 views

How do RSA SecureID ® Keys Work?

I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
0
votes
1answer
39 views

Is there any security concern if I sent the security token, issued from a trusted IdP, to javaScript?

Is there any problem if I sent the identity token, which has been issued from a trusted IdP, to javaScript code in order to use it in an Ajax call to a web method with authentication? Is there any ...
0
votes
1answer
126 views

Verify CDN javascript's integrity

CDNs speed up the loading of websites by allowing caching for frequently used javascript libraries like jquery. How do we know if they have modified the javascript before serving it to my clients? ...
3
votes
3answers
107 views

What's the best way to secure the responses in a single page web app after logout?

I've read some of the great responses to storing and passing session keys in a single page web application (i.e., a web "site" that runs mostly on the client-side, getting data from the server by ...
2
votes
1answer
52 views

Clarification on OAuth Client Secret

I have a little trouble understanding, how to use OAuth to secure an API. So I developed a RESTful service, which I would like to secure to authenticated access. I first opted for HTTP Basic + TLS, ...
5
votes
2answers
275 views

Using Client-side certificates for Authentication

Why aren't client-side certificates used for Authentication? Then user has to remember only 1 password to unlock his windows account which stores the certificates. I understand that if user access ...
0
votes
1answer
109 views

Looking for [intentionally made] vulnerable applications suitable for practicing different penetration techniques (NOT a web apps, user side ones)

I'm looking for different kinds of applications which is intentionnaly (or not) made vulnerable and so are suitable for practicing different penetration techniques, like SQL injections, buffer ...
0
votes
1answer
103 views

Securing user's data against an attacker that may gain server root

I'm designing a web application that is going to handle very sensitive data, storing it on behalf of its users. A kind of online safe, if you will. A user's secure data should only be visible to her, ...
20
votes
6answers
2k views

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

I'm cross posting this question from Programmers.SE because I think it's equally on-topic here and would like to pose the question to this community as well. This seems like a programming question ...
0
votes
0answers
24 views

Client side ssl auth by signing with server key [duplicate]

So I followed this for setting up client ssl certs using openssl: http://drumcoder.co.uk/blog/2011/oct/19/client-side-certificates-web-apps/ It basically walks through creating a new CA key, and then ...
2
votes
2answers
207 views

Does client side encryption really add security?

A lot of password managers seems to promote client-side encryption as a key feature of their service. For example : LastPass, Firefox Sync, PasswordBox, etc... They all say something like Even we ...
0
votes
1answer
109 views

How to execute an XSS attack against a site that uses client side protection?

Say I have a site that allows me to save my name to the database, and that name is then displayed to other users. I have determined that if I save the following as my name: Abe ...
1
vote
1answer
79 views

Encrypted NAS where only clients know the (decryption) key

Is there an implementation of a file-sharing network protocol where the server has no idea what data is being stored, but can serve the encrypted files to clients that will decrypt them on-the-fly (if ...
2
votes
1answer
1k views

Correct way to perform secure two way encryption on a web site

I'm currently working a project that requires me to store sensitive information (mainly passwords and other information) on a web server via a standard python/flask website. This information is to be ...
1
vote
2answers
165 views

How can one find keyloggers in javascript?

Assuming no XSS and a client-side only page, how can a keylogger be identified in javascript code? Should I simply look for the id of the targeted fields and possibly some sort of DOM traversal to ...
0
votes
2answers
186 views

How can a keylogger gather & transmit data from a client-only webapp run from file?

For a client-side only webapp run from file, how can a keylogger gather data and then transmit it? In this scenario, please limit the scope to the client code only, that an attacker somehow has ...
0
votes
2answers
941 views

client SSL authentication .pem file and .crt files

So I have minimal knowledge of security really but I'm a primary developer on an application which handles some sensitive data that we want to be secure. The application communicates with one other ...
0
votes
1answer
2k views

How is the Premaster secret used in TLS generated?

I believe that it uses some combination of the random values sent in the hello messages. From RFC 2246: (TLSv1.0) RSA encrypted premaster secret message Meaning of this message: If RSA is ...
0
votes
1answer
29 views

Can JS templates for admin-only pages be public

In my page admins-only section is very responsive, so I have to use both server and client side templating. Obviously server side templates are stored outside of web-root and routing takes care of ...
1
vote
4answers
206 views

Using client certificate to authenticate an app

I'm building a backend for the mobile app with a public-facing HTTP API endpoint. Despite being publicly visible, this endpoint is only meant to be used by my app, i.e. I don't want people to send ...
2
votes
2answers
129 views

Client Authentication Certificate Not Expiring, but “parent” cert IS

So I have a client-authencation cert installed on client PCs, which doesn't expire for 5 more years. Unfortunately, the cert on our gateway which is used to validate the client cert, expires this ...
2
votes
1answer
134 views

What should a client verify after getting a client certificate?

I have a client that generates a csr, sends it to a server, the server then sign it and return the certificate as a String. the String is then decoded to a x509Certificate (using Bouncycastle's ...
0
votes
1answer
183 views

How can I handle user authentication and sessions in my app?

I'm currently building an authentication module and I've got a question. I have set up a server with an API and want my users to authenticate to this server, but I use AngularJS for the site. ...
1
vote
2answers
116 views

Creating an application in which all user content is encrypted

Does any one have references or sources on how to approach developing a web application in which the content is encrypted and unreadable for the developers or company owners; I'm referring to content ...
3
votes
2answers
72 views

Is letting just anybody see the appearance/html/javascript of your admin pages a security risk?

Ok so consider the scenario in which you have two projects, one is a RESTful API, and the other is a public facing website. The API uses cookie/token based authentication, and contains all of the ...
3
votes
1answer
82 views

How to (programmaticaly or by other means) encrypt or protect customer data

I am working on a web project and I want to (as far as possible) handle user data in a way that reduces damage to the users privacy in case of someone compromising our servers/databases. Of course we ...
0
votes
2answers
121 views

For a computer client, is physical security the most important measure?

Is being online all the time the root of all evil, when it comes down to private computer clients security? Would a not-always-connected-to-the-internet system, solve most of our problems? In a ...
2
votes
2answers
652 views

XSS in HTML meta tag

There is a web application which contains a search function. When I search for aaaaaaaaxss I get this: <meta property="the:property" content="100 Results for aaaaaaaaxss (Page 1)" /> It strips ...
0
votes
2answers
807 views

Heartbleed client side attack: What can the attacker obtain? [duplicate]

If I have got this right in my head it would be a simple enough task to combine arp spoofing on a public WiFi to redirect clients to an evil SSL server which sends malformed heartbeat requests or to ...
3
votes
4answers
1k views

How to securely share key between two remote devices?

Assuming I have a server/client topology, currently I'm facing the problem that I want to generate some key on the client side and somehow make the remote server get it securely. I'm using AES on ...
1
vote
1answer
165 views

Review of approach to client-side only hashing and encryption for web application

Background: I have little knowledge of hashing and encryption, so please bear with me. I have posted a related question here: ...
0
votes
1answer
279 views

What are the risks of connecting via VNC to an untrusted host?

There are questions about connecting to an untrusted host via SSH [1] [2], RDP, and with X11 forwarding enabled. What about when connecting via VNC? What risks are there to the client? To be clear: ...
1
vote
2answers
599 views

Digital Signatures of XML, PDF and Office Documents on every platform

I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not ...
1
vote
1answer
87 views

Digitally signed scripts as a way to thwart XSS

As a blanket approach to dealing with XSS attacks, rather than having to remember to escape user-generated code, is there a way to instruct the browser not to execute any script or script-function ...
0
votes
0answers
21 views

How can it be possible to have encrypted communication between a server and a client if the server has only a public key [duplicate]

If only the server has an electronic certificate (User ID, Version, Public key), how can be possible the encrypted communication between the client and the server?
-1
votes
2answers
2k views

How are client side hacks created? [closed]

Many games today are prereleased in an alpha/beta state and instantly overwhelmed by "hackers" downloading programs manipulating the game itself to become overpowered. I guess they make injections ...
4
votes
1answer
881 views

Is 'Forge' Javascript crypto library secure? [closed]

I need a client-side crypto library. I've seen https://github.com/digitalbazaar/forge linked many times on stackexchange. Forge seems to be the most complete and well-documented crypto library for JS. ...
11
votes
4answers
2k views

Preventing reverse-engineering of client application

I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS. One of the ...