Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

learn more… | top users | synonyms

1
vote
1answer
55 views

Security concerns of browser injected JS

To employ end-to-end encryption, I am using a small tool that encrypts contents that is then posted and stored on our servers. While there are several concerns on client based encryption, I think it ...
1
vote
2answers
126 views

Securing user's data against an attacker that may gain server root

I'm designing a web application that is going to handle very sensitive data, storing it on behalf of its users. A kind of online safe, if you will. A user's secure data should only be visible to her, ...
1
vote
1answer
48 views

Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use?

WoSign has been in the media for offering free server and client certificates. Since one of my (free) S/MIME certificate from another CA is about to expire soon after one year and WoSign offers ...
0
votes
0answers
124 views

Client authentication with a collection of open source distributed servers

With a collection of open source distributed servers, all sharing every users data. How can the user authenticate with any server, without the passwords being compromised by a malicious server? ...
3
votes
3answers
122 views

What's the best way to secure the responses in a single page web app after logout?

I've read some of the great responses to storing and passing session keys in a single page web application (i.e., a web "site" that runs mostly on the client-side, getting data from the server by ...
0
votes
1answer
214 views

How can I handle user authentication and sessions in my app?

I'm currently building an authentication module and I've got a question. I have set up a server with an API and want my users to authenticate to this server, but I use AngularJS for the site. ...
0
votes
2answers
137 views

Storing unencrypted, confidential data in client memory

I am currently working on a service which lets users store client-side encrypted data and access it anywhere. The client connects through a browser and the webapp is written in JavaScript. To easier ...
3
votes
1answer
129 views

Asymmetric / end to end encryption for web messaging app

Background I'm trying to design a secure and sustainable web app for messaging. The purpose is to learn how to create secure web application. The application is suppose to be written in Javascript ...
2
votes
0answers
57 views

How is Tresorit client-side encryption key stored and managed?

I am using Tresorit on Mac OS X and iPhone. When I am using it there is always applied client-side encryption before posting the file to cloud. The key used for encryption is AES-256 and CFB mode of ...
1
vote
1answer
104 views

What precautions I can take to secure software against user?

I want to build a client that connects to my server and uses server API. You can consider this as a banking application because data security is the most important thing. Since the users or hackers ...
1
vote
4answers
223 views

Using client certificate to authenticate an app

I'm building a backend for the mobile app with a public-facing HTTP API endpoint. Despite being publicly visible, this endpoint is only meant to be used by my app, i.e. I don't want people to send ...
4
votes
1answer
53 views

Securing client-side data from users

So my problem, in its general form, is encrypting test questions such that a client-side testing application can access the questions while students cannot. The naive approach, in my opinion, is to ...
1
vote
2answers
139 views

How to be sure laptop's trusted certificates are safe

I have a Windows 8.1 Lenovo laptop. The evil Superfish app and certificate have been removed. My laptop has 36 certificates in certmgr.msc current user\third-party root certification ...
1
vote
2answers
57 views

Client side encryption with sustainability as a service

I only need 2 things. 1) The user to know that only him (not even then admins) can decrypt his data that rely on my server. He will always provide his key to decrypt data. 2) To be able to provide ...
0
votes
1answer
185 views

Verify CDN javascript's integrity

CDNs speed up the loading of websites by allowing caching for frequently used javascript libraries like jquery. How do we know if they have modified the javascript before serving it to my clients? ...
1
vote
1answer
47 views

Can a Certificate Authority associated with Active Directory publish a client certificate to a browser?

Can I use some integration of Windows Active Directory and a Certificate Authority to embed a client certificate in a browser that will be trusted by a server? I have a private domain and control ...
1
vote
1answer
55 views

SSL with client certificate authentication

can somebody explain to me if for example i use Server certificate, with 2048bit keys and client certificate with only 512bit strength, does this use in any way affect the security of the established ...
2
votes
3answers
83 views

Verify client-side created data

I have a Java applet, which records the whole screen of the user and uploads the images to the server. If one would be able to (and many people could, I know) falsify the screen recording they could ...
11
votes
3answers
802 views

How do RSA SecureID ® Keys Work?

I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
0
votes
1answer
43 views

Is there any security concern if I sent the security token, issued from a trusted IdP, to javaScript?

Is there any problem if I sent the identity token, which has been issued from a trusted IdP, to javaScript code in order to use it in an Ajax call to a web method with authentication? Is there any ...
13
votes
6answers
4k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
-1
votes
2answers
3k views

How are client side hacks created? [closed]

Many games today are prereleased in an alpha/beta state and instantly overwhelmed by "hackers" downloading programs manipulating the game itself to become overpowered. I guess they make injections ...
0
votes
1answer
157 views

Looking for [intentionally made] vulnerable applications suitable for practicing different penetration techniques (NOT a web apps, user side ones)

I'm looking for different kinds of applications which is intentionnaly (or not) made vulnerable and so are suitable for practicing different penetration techniques, like SQL injections, buffer ...
2
votes
1answer
58 views

Clarification on OAuth Client Secret

I have a little trouble understanding, how to use OAuth to secure an API. So I developed a RESTful service, which I would like to secure to authenticated access. I first opted for HTTP Basic + TLS, ...
5
votes
2answers
371 views

Using Client-side certificates for Authentication

Why aren't client-side certificates used for Authentication? Then user has to remember only 1 password to unlock his windows account which stores the certificates. I understand that if user access ...
20
votes
6answers
2k views

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

I'm cross posting this question from Programmers.SE because I think it's equally on-topic here and would like to pose the question to this community as well. This seems like a programming question ...
1
vote
2answers
3k views

iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates)

As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2. ...
2
votes
2answers
229 views

Does client side encryption really add security?

A lot of password managers seems to promote client-side encryption as a key feature of their service. For example : LastPass, Firefox Sync, PasswordBox, etc... They all say something like Even we ...
0
votes
0answers
26 views

Client side ssl auth by signing with server key [duplicate]

So I followed this for setting up client ssl certs using openssl: http://drumcoder.co.uk/blog/2011/oct/19/client-side-certificates-web-apps/ It basically walks through creating a new CA key, and then ...
0
votes
1answer
111 views

How to execute an XSS attack against a site that uses client side protection?

Say I have a site that allows me to save my name to the database, and that name is then displayed to other users. I have determined that if I save the following as my name: Abe ...
1
vote
1answer
92 views

Encrypted NAS where only clients know the (decryption) key

Is there an implementation of a file-sharing network protocol where the server has no idea what data is being stored, but can serve the encrypted files to clients that will decrypt them on-the-fly (if ...
0
votes
5answers
919 views

What voip client support manual encryption?

In pidgin there is a plugin that we can use to encrypt our messages in chat windows .. Is there anything simular for voip (pc to pc) ? any client that support manual encryption for voice data?(linux)
5
votes
2answers
838 views

Is it safe to use createHTMLDocument to sanitize HTML?

i'm wondering how safe it is to use createHTMLDocument to do HTML sanitization. I've tried to implement it like this: function sanitize(string) { var elm = ...
2
votes
1answer
1k views

Correct way to perform secure two way encryption on a web site

I'm currently working a project that requires me to store sensitive information (mainly passwords and other information) on a web server via a standard python/flask website. This information is to be ...
4
votes
2answers
580 views

How to implement client side encryption for CalDav & CardDav content?

I'm looking for a client-side encryption implementation that would be able to secure CardDav & CalDav data so that they couldn't be compromised even by the hosting provider. Server side: PHP or ...
1
vote
2answers
119 views

Creating an application in which all user content is encrypted

Does any one have references or sources on how to approach developing a web application in which the content is encrypted and unreadable for the developers or company owners; I'm referring to content ...
1
vote
2answers
177 views

How can one find keyloggers in javascript?

Assuming no XSS and a client-side only page, how can a keylogger be identified in javascript code? Should I simply look for the id of the targeted fields and possibly some sort of DOM traversal to ...
0
votes
2answers
202 views

How can a keylogger gather & transmit data from a client-only webapp run from file?

For a client-side only webapp run from file, how can a keylogger gather data and then transmit it? In this scenario, please limit the scope to the client code only, that an attacker somehow has ...
27
votes
4answers
5k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
0
votes
2answers
1k views

client SSL authentication .pem file and .crt files

So I have minimal knowledge of security really but I'm a primary developer on an application which handles some sensitive data that we want to be secure. The application communicates with one other ...
1
vote
1answer
2k views

How is the Premaster secret used in TLS generated?

I believe that it uses some combination of the random values sent in the hello messages. From RFC 2246: (TLSv1.0) RSA encrypted premaster secret message Meaning of this message: If RSA is ...
0
votes
1answer
31 views

Can JS templates for admin-only pages be public

In my page admins-only section is very responsive, so I have to use both server and client side templating. Obviously server side templates are stored outside of web-root and routing takes care of ...
2
votes
2answers
137 views

Client Authentication Certificate Not Expiring, but “parent” cert IS

So I have a client-authencation cert installed on client PCs, which doesn't expire for 5 more years. Unfortunately, the cert on our gateway which is used to validate the client cert, expires this ...
3
votes
1answer
91 views

How to (programmaticaly or by other means) encrypt or protect customer data

I am working on a web project and I want to (as far as possible) handle user data in a way that reduces damage to the users privacy in case of someone compromising our servers/databases. Of course we ...
2
votes
1answer
138 views

What should a client verify after getting a client certificate?

I have a client that generates a csr, sends it to a server, the server then sign it and return the certificate as a String. the String is then decoded to a x509Certificate (using Bouncycastle's ...
3
votes
2answers
74 views

Is letting just anybody see the appearance/html/javascript of your admin pages a security risk?

Ok so consider the scenario in which you have two projects, one is a RESTful API, and the other is a public facing website. The API uses cookie/token based authentication, and contains all of the ...
0
votes
2answers
128 views

For a computer client, is physical security the most important measure?

Is being online all the time the root of all evil, when it comes down to private computer clients security? Would a not-always-connected-to-the-internet system, solve most of our problems? In a ...
2
votes
2answers
781 views

XSS in HTML meta tag

There is a web application which contains a search function. When I search for aaaaaaaaxss I get this: <meta property="the:property" content="100 Results for aaaaaaaaxss (Page 1)" /> It strips ...
4
votes
1answer
960 views

Is 'Forge' Javascript crypto library secure? [closed]

I need a client-side crypto library. I've seen https://github.com/digitalbazaar/forge linked many times on stackexchange. Forge seems to be the most complete and well-documented crypto library for JS. ...
0
votes
2answers
818 views

Heartbleed client side attack: What can the attacker obtain? [duplicate]

If I have got this right in my head it would be a simple enough task to combine arp spoofing on a public WiFi to redirect clients to an evil SSL server which sends malformed heartbeat requests or to ...