Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

learn more… | top users | synonyms

16
votes
6answers
5k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
31
votes
4answers
7k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
8
votes
6answers
2k views

How to securely store my passwords?

Regarding this: Are passwords in memory? So does someone have a good idea on how to securely store my passwords? The: "passwords.txt" -> ctrl+c; ctrl+v a passw is not very secure. I have passwords ...
26
votes
9answers
2k views

Why do some people really hate security via client-side?

For instance, lets look at a common login system for a website HTTPS connection is made User submits credentials via POST Server-side code hashes the password and looks if it matches the user name ...
22
votes
6answers
2k views

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

I'm cross posting this question from Programmers.SE because I think it's equally on-topic here and would like to pose the question to this community as well. This seems like a programming question ...
7
votes
2answers
10k views

Certificate Chain checking

I have a very specific question. A client verifies a server by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (according to the ...
13
votes
3answers
598 views

Can I use the same password both for SRP and for client-side encryption?

Suppose a less-than-trusted server is used to store users' confidential data (encrypted at the client side), and both tasks - authentication and encryption/decryption - should be doable with a single ...
4
votes
3answers
3k views

Do client certificates provide protection against MITM?

I'm looking for a way to protect clients from a MITM attack without using a VPN, and ToR. My thought is that client certificates might do the job, but I'm not entirely sure since not too much server ...
12
votes
4answers
3k views

Preventing reverse-engineering of client application

I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS. One of the ...
5
votes
2answers
2k views

Web & insecure HTTP - Using RSA for encrypting passwords on the client side

I used client side password hashing in my register and login project. Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
2
votes
1answer
991 views

Vulnerabilities in Host Proof Hosting

I've recently been doing some research on Host-Proof Hosting, specifically in a web app environment. It seems like a pretty rock solid method of security, but I'm certainly not a security expert and ...
1
vote
1answer
117 views

How to verify that a clientside-generated object is genuine?

I know that general best-practice states not to trust anything generated by the client. With that in mind, I want to write an HTML5 app that utilises the browser to generate various objects ...
0
votes
1answer
414 views

Looking for [intentionally made] vulnerable applications suitable for practicing different penetration techniques (NOT a web apps, user side ones)

I'm looking for different kinds of applications which is intentionnaly (or not) made vulnerable and so are suitable for practicing different penetration techniques, like SQL injections, buffer ...
12
votes
3answers
12k views

help understanding client certificate verification

I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
9
votes
2answers
2k views

Security Concerns on clientside(Javascript)

We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
5
votes
2answers
2k views

Is it safe to use createHTMLDocument to sanitize HTML?

i'm wondering how safe it is to use createHTMLDocument to do HTML sanitization. I've tried to implement it like this: function sanitize(string) { var elm = ...
4
votes
5answers
11k views

How to validate a client certificate

My understanding is that when using a client certificate for security one issues a private and public key cert (for example X509) of some sort and sends that of to the consumer of the service that one ...
3
votes
2answers
393 views

Can an eavesdropper detect the use of a TLS client-side certificate?

Basically what the above says, assuming the eavesdropper must be completely passive, and cannot connect to the server to check if the server requires a client certificate.
3
votes
1answer
1k views

Verify CDN javascript's integrity

CDNs speed up the loading of websites by allowing caching for frequently used javascript libraries like jquery. How do we know if they have modified the javascript before serving it to my clients? ...
3
votes
4answers
2k views

How to prevent attacks against client side validations?

I have a login form where am accepting Mobile Number of the User for login. When Mobile Number is submitted, am calling a JavaScript to validate the Mobile Number. My client side validations ...
1
vote
1answer
1k views

Securing clients side scripts [duplicate]

Most browsers allow users to view the source of a web-page quite easily and modern even provided detailed analysis. Often this code includes critical client side scripts in the form of JS/jQuery, ...
0
votes
5answers
991 views

What voip client support manual encryption?

In pidgin there is a plugin that we can use to encrypt our messages in chat windows .. Is there anything simular for voip (pc to pc) ? any client that support manual encryption for voice data?(linux)
5
votes
1answer
6k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
4
votes
3answers
664 views

Are there any addons that disable only some functionality of scripts?

Tor comes bundled with NoScript. Correct me if I'm wrong but that's because client sided scripts can determine the originating IP address regardless of who the traffic is passed through. But NoScript ...
3
votes
1answer
362 views

Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use?

WoSign has been in the media for offering free server and client certificates. Since one of my (free) S/MIME certificate from another CA is about to expire soon after one year and WoSign offers ...
3
votes
3answers
548 views

Client-Side Hashing to decrease value of password guessing heuristics

Yes, this is 'yet another client-side hashing' question. But, don't leave yet, I think there is some value here. I'd like to do something to mitigate the affect on the community as a whole when my ...
1
vote
2answers
931 views

Digital Signatures of XML, PDF and Office Documents on every platform

I'm trying to develop a website that performs digital signatures on client-side and then sent the signed document to the server-side. I want to do the signatures on client, due to the fact of not ...