Tagged Questions
7
votes
2answers
848 views
How to protect against clickjacking attack but allow legit iframes?
I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
2
votes
5answers
281 views
Can web application do anything to prevent risk from client-side malware?
Client side malware (keyloggers, screenscrapers etc.) is a great risk. It can't be effectively stopped from side of ordinary application. Only users themselves can do some measures to prevent risk ...
4
votes
2answers
112 views
Changing windows client form values at runtime
I am performing a code audit of an older VB6 application which uses dynamically constructed SQL to execute against the database. While I see this as a SQL injection point, the developer contends that ...
17
votes
3answers
2k views
What useful things can I do with the html5 “keygen” element?
There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari.
Here's what it looks like:
<form action="processkey.cgi" method="post" ...
8
votes
2answers
592 views
Security Concerns on clientside(Javascript)
We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
7
votes
1answer
968 views
How should I protect in-app Android payments when using a separate server?
I am currently implementing Android in-app payments, and am wondering what attack vectors I should look out for.
I have a simple application to view server-generated content. I want to allow the user ...
21
votes
9answers
1k views
Why do some people really hate security via client-side?
For instance, lets look at a common login system for a website
HTTPS connection is made
User submits credentials via POST
Server-side code hashes the password and looks if it matches the user name
...
1
vote
1answer
185 views
Securing clients side scripts
Most browsers allow users to view the source of a web-page quite easily and modern even provided detailed analysis. Often this code includes critical client side scripts in the form of JS/jQuery, ...
9
votes
5answers
823 views
How can I securely authenticate the client application sending me data?
We have a web service logging/recording user data sent over https by our client application. Is there a way to securely ensure that the data is getting sent by the client application and not by a fake ...
