Background: I have little knowledge of hashing and encryption, so please bear with me. I have posted a related question here: ...
I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS. One of the ...
I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
I've recently been doing some research on Host-Proof Hosting, specifically in a web app environment. It seems like a pretty rock solid method of security, but I'm certainly not a security expert and ...
Client side malware (keyloggers, screenscrapers etc.) is a great risk. It can't be effectively stopped from side of ordinary application. Only users themselves can do some measures to prevent risk ...
There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari. Here's what it looks like: <form action="processkey.cgi" method="post" ...
We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
For instance, lets look at a common login system for a website HTTPS connection is made User submits credentials via POST Server-side code hashes the password and looks if it matches the user name ...
Most browsers allow users to view the source of a web-page quite easily and modern even provided detailed analysis. Often this code includes critical client side scripts in the form of JS/jQuery, ...
If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?
In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...