Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

learn more… | top users | synonyms

3
votes
1answer
106 views

How secure is HTML5 web storage (sessionStorage and localStorage)?

I'm thinking of using either sessionStorage or localStorage to store some important user data. The extension's functionality will only work in the context of a particular website that defaults to ...
-3
votes
1answer
45 views

Which WYSIWYG editor has the best security reputation? [on hold]

I would like to use a pre-built WYSIWYG editor such as TinyMCE or CKEditor in a website that I'm building. Since I expect my users to be entering confidential information into the editor it is ...
-3
votes
4answers
124 views

Which cryptographic algorithm should be used on client side to encrypt file before uploading to a cloud which is only for storing purpose?

I want to develop a website which will take the files from my computer encrypt it with my key and upload it on cloud which is only for storage purpose and decrypt it after downloading it on my ...
0
votes
1answer
35 views

Access to raw html source code after angular client side processing

I need help to check if parameters are sensible to XSS injections in a webpage generated by angularjs. Today, many websites are using angularjs in order to deport client page construction at the ...
0
votes
2answers
372 views

How can a keylogger gather and transmit data from a client-only webapp run from file?

For a client-side only webapp run from file, how can a keylogger gather data and then transmit it? In this scenario, please limit the scope to the client code only, that an attacker somehow has ...
0
votes
2answers
127 views

I want to encrypt certain entries in a database. Is this a good plan?

I'm working on a web app and want to offer the users the option to "encrypt" their account. This wouldn't encrypt everything related to them in the database. Just certain critical fields. I've ...
7
votes
1answer
6k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
14
votes
3answers
5k views

How do RSA SecureID ® Keys Work?

I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
-4
votes
1answer
71 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
2
votes
2answers
116 views

How do I know that malware on the client computer does not modify data transmitted to my webapp?

I am working on a web application and have had an idea of a new feature I would like to add. The feature includes getting data from the user on their open system and receiving it on my server. For the ...
2
votes
0answers
64 views

How exactly does “Apache Shiro's” hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. ...
1
vote
3answers
49 views

Is there an added benefit to authentication within a part of an application, after authenticated into the main application?

Essentially I have a application that is 2 parts. One part is on the user's machine, which will upload files to my server, and the other part is a web application that works with those files. ...
1
vote
1answer
87 views

Client-side encryption using public-key

My situation: Login password from a POST request is left in browser memory in clear text as long as cache is not cleared (manually/closing browser). Connection is HTTPS. Possible Solution: ...
4
votes
1answer
43 views

REST and confidential state - the trusted client problem etc?

With REST client sessions are not handled by maintaining server side state. Any such state needed for subsequent calls is passed to the client and then passed back to the server as part of those calls....
1
vote
0answers
50 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
7
votes
2answers
4k views

How to remember a trusted machine using two factor authentication (like Google's system)

We are developing a web application that will use two factor authentication. We are likely to try and emulate something similar to that used by google, where to login you enter a username and password,...
4
votes
3answers
666 views

Are there any addons that disable only some functionality of scripts?

Tor comes bundled with NoScript. Correct me if I'm wrong but that's because client sided scripts can determine the originating IP address regardless of who the traffic is passed through. But NoScript ...
3
votes
1answer
75 views

How Vulnerable Is An Older Version Of Outlook As An Email Application?

I am significantly displeased with some of the newer versions of Microsoft Outlook. I would prefer to continue using my older version from Office 2000 (on Windows 7 using workarounds). As a networked ...
3
votes
3answers
355 views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
7
votes
2answers
10k views

Certificate Chain checking

I have a very specific question. A client verifies a server by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (according to the ...
-1
votes
1answer
31 views

Decrypting packets sent from a server to a client, how to figure out the key, having both decoded packets and encoded packets

I have written a packet sniffer which succesfully intercepts all the packets sent from a server to my computer. The problem is that the packets are encrypted(of course) and i need to decrypt them. An ...
26
votes
7answers
4k views

Is it possible to modify your user agent http header for malicious use?

The Google crawl bot uses the user agent "Googlebot", and I am wondering if this knowledge can be used maliciously. Let's say in a random website, the Googlebot user agent is allowed to access an ...
35
votes
9answers
11k views

If “you can never trust the client”, then why do companies such as Valve rely solely on client-side verification?

In video games, most anticheat software is run clientside (e.g. PunkBuster or Valve Anti-Cheat)- but isn't one of the first rules of security to never trust the client? If so, then why do these ...
13
votes
2answers
371 views

Can client-side hashing improve after-the-fact security in response to password leaks?

Several questions on this site address client-side password hashing, and none of them admit to any security benefit beyond protecting other sites the user might use the same password for. However, ...
2
votes
1answer
83 views

Is the Framekiller really safe against clickjacking?

I am using this code. In the header section of the page, this CSS rule: html{display:none;} And then this javascript: if (self == top) document.documentElement.style.display = 'block'; else ...
3
votes
3answers
83 views

Is it possible to modify jQuery client code to call a remote API in an unintended way?

Is it possible for someone to modify the JQuery code of a remote page and make it call the remote APIs in a different way than intended? Suppose the website www.domain.com has a jquery.js script ...
1
vote
0answers
18 views

Web Scraper with client-side certs [closed]

I am building a web scraper that logs into websites, does some searches and collects results. The websites I've been logging into right now have all been pretty standard. I have been notified that ...
2
votes
1answer
96 views

Licensing system for client side code web application

I have a client-side web application running on SharePoint Site Collection, each site collection has it's own unique id. I want to use a licensing process to lock the app to a site collection. This ...
3
votes
1answer
102 views

Where to store IV and salt when doing clientside encryption with no server

I'm making a chrome app that does client side encryption of user messages. There is no server in my architecture. The encrypted text messages are saved as files in the user's Google Drive. I'm using ...
10
votes
5answers
8k views

How to do client side hashing of password using BCrypt? [duplicate]

I am migrating an old application which used MD5 hashing to Spring Security with BCrypt encoding of passwords. I want to encode the password on new user creation page, change password page and on ...
3
votes
1answer
383 views

Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use?

WoSign has been in the media for offering free server and client certificates. Since one of my (free) S/MIME certificate from another CA is about to expire soon after one year and WoSign offers ...
2
votes
0answers
71 views

Safe to Encrypt ClientId (Integer value) to use as Client Key?

Asked a follow up question (see this link). Based on my understanding, I have to issue an unique ClientId and Client Secret Key to the API subscribers right after the registration phase (client lives ...
1
vote
2answers
34 views

Rembering password on client (not database) [closed]

I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again. Is there a secure way for my program to store this?...
2
votes
3answers
133 views

Don't trust the client?

I am a web developer, and have been trying to learn a bit about security, and the thing that seems to be the biggest principal is just to trust the client with as little as possible. Is this a correct ...
2
votes
1answer
87 views

Communicate through gpg

I need to frequently communicate with a server in the manner do stuff related to x or send me info of x My thoughts are to directly put the task I want to be executed into the package I want to send, ...
3
votes
2answers
396 views

Can an eavesdropper detect the use of a TLS client-side certificate?

Basically what the above says, assuming the eavesdropper must be completely passive, and cannot connect to the server to check if the server requires a client certificate.
1
vote
2answers
177 views

Several hashing routines support client side work. Doesn't the hash just become a password equivalent?

Isnt Secure Remote Password Protocol (SRP) pretty much client side hashing? Argon2 the winner of the PHC also allows for client side hashing. How do these systems avoid the plaintext equivalence ...
3
votes
2answers
362 views

Ways around browser xss detection

Most modern browsers will detect xss attempts (script code in the URL) and prevent execution. Are there any known standard ways around this or are xss attacks pretty much impossible now?
1
vote
2answers
74 views

Methods to keep an autonomous log with high integrity

I'm writing a .NET desktop application that is used to send orders to a server via a REST API. To avoid leaking of our authentication token I have made it so that, when used for the first time, the ...
1
vote
3answers
203 views

What are the disadvantages of combining client-side and server-side authentication security?

Imagine situation: Application might or might not be run via SSL/TLS Application should not know password of the client because client might reuse passwords Wouldn't then combined client-side and ...
1
vote
0answers
74 views

Possible vulnerabilities in private chat application implemented using web broadcasting

I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher. The workflow of this ...
0
votes
2answers
80 views

Is browser side encryption realistically secure?

I have a web app I'm hoping to write where a selection of files are zipped and encrypted in the browser before being uploaded to my server. I have a prototype of the system and it's working great. I ...
0
votes
3answers
151 views

Is it possible for an attacker to redirect a packet sent by a client, modify it then sent to original server

Theoretical question: Is it possible, or will it ever be possible, for an attacker to sniff/intercept it and redirect a packet, sent from a client through wireless, modify it and then sent to the ...
1
vote
1answer
118 views

Security concerns of browser injected JS

To employ end-to-end encryption, I am using a small tool that encrypts contents that is then posted and stored on our servers. While there are several concerns on client based encryption, I think it ...
3
votes
2answers
199 views

Securing user's data against an attacker that may gain server root

I'm designing a web application that is going to handle very sensitive data, storing it on behalf of its users. A kind of online safe, if you will. A user's secure data should only be visible to her, ...
3
votes
3answers
215 views

What's the best way to secure the responses in a single page web app after logout?

I've read some of the great responses to storing and passing session keys in a single page web application (i.e., a web "site" that runs mostly on the client-side, getting data from the server by ...
0
votes
1answer
688 views

How can I handle user authentication and sessions in my app?

I'm currently building an authentication module and I've got a question. I have set up a server with an API and want my users to authenticate to this server, but I use AngularJS for the site. ...
0
votes
2answers
273 views

Storing unencrypted, confidential data in client memory

I am currently working on a service which lets users store client-side encrypted data and access it anywhere. The client connects through a browser and the webapp is written in JavaScript. To easier ...
5
votes
1answer
688 views

Asymmetric / end to end encryption for web messaging app

Background I'm trying to design a secure and sustainable web app for messaging. The purpose is to learn how to create secure web application. The application is suppose to be written in Javascript ...
2
votes
0answers
196 views

How is Tresorit client-side encryption key stored and managed?

I am using Tresorit on Mac OS X and iPhone. When I am using it there is always applied client-side encryption before posting the file to cloud. The key used for encryption is AES-256 and CFB mode of ...