Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

learn more… | top users | synonyms

29
votes
3answers
10k views

What useful things can I do with the html5 “keygen” element?

There's a new* keygen element in the html5 spec. It's supported in major browsers excepting Internet Explorer and Safari. Here's what it looks like: <form action="processkey.cgi" method="post" ...
27
votes
4answers
6k views

How secure are my passwords in the hands of Firefox using a Master Password?

I'm relying on Firefox to remember my passwords, using a Master Password of more than 25 characters. How secure is this set-up?
25
votes
9answers
2k views

Why do some people really hate security via client-side?

For instance, lets look at a common login system for a website HTTPS connection is made User submits credentials via POST Server-side code hashes the password and looks if it matches the user name ...
20
votes
6answers
2k views

Is it fundamentally possible to validate that an unmodified version of your client connects to your server?

I'm cross posting this question from Programmers.SE because I think it's equally on-topic here and would like to pose the question to this community as well. This seems like a programming question ...
18
votes
5answers
3k views

How does preventing automatic download of pictures help to protect my privacy?

When viewing some emails in Microsoft Outlook, if the sender has included images, I get the following option appear at the top of the email: "To help protect your privacy, Outlook prevented ...
14
votes
6answers
4k views

Client side password hashing

Edit: Updated to put more emphasis on the goal - peace of mind for the user, and not beefing up the security. After reading through a few discussions here about client side hashing of passwords, I'm ...
13
votes
3answers
538 views

Can I use the same password both for SRP and for client-side encryption?

Suppose a less-than-trusted server is used to store users' confidential data (encrypted at the client side), and both tasks - authentication and encryption/decryption - should be doable with a single ...
11
votes
12answers
968 views

How to guarantee that password is hashed on server-side?

I'm worried when I send a password to a server, even with SSL or TLS, that the server stores the password in cleartext. Is this the case? If yes and the server gets hacked, all passwords are available ...
11
votes
4answers
2k views

Preventing reverse-engineering of client application

I have a web service which is used by a Flash client. Both the service and the Flash client is produced by me (read: my company). The Flash client communicates with the server over HTTPS. One of the ...
11
votes
3answers
1k views

How do RSA SecureID ® Keys Work?

I have been using RSA SecureID ® Keys for quite some time now (perhaps 10 years), for things such as securely my home banking account online or accessing my company's network of computers from home. ...
10
votes
5answers
3k views

How can I securely authenticate the client application sending me data?

We have a web service logging/recording user data sent over https by our client application. Is there a way to securely ensure that the data is getting sent by the client application and not by a fake ...
10
votes
3answers
8k views

help understanding client certificate verification

I am creating an API that only certain computers should have access to. Communication will be via SSL between the server and the clients. In order to verify that a client has access, I would like to ...
10
votes
3answers
850 views

If I am obliged to store a password/certificate on a client side, how can i make sure that it is protected?

In certain cases we need to establish a key/password/certificate as a first timer and then as a client we need to use this key/password/certificate to get authenticated. Therefore the ...
10
votes
2answers
2k views

How to protect against clickjacking attack but allow legit iframes?

I'm aware of modern anti-clickjacking approaches, such as X-Frame-Options header or framekiller scripts. But all these tactics prevent content to be inside iframe. But what if there is a requirement ...
9
votes
5answers
1k views

How to do client side hashing of password using BCrypt? [duplicate]

I am migrating an old application which used MD5 hashing to Spring Security with BCrypt encoding of passwords. I want to encode the password on new user creation page, change password page and on ...
9
votes
2answers
1k views

Security Concerns on clientside(Javascript)

We are going to design and implement a UI for a big website. Owner of the site is really cautious about security issues. I wonder if there is a check list for security issues at the client-side ,while ...
9
votes
2answers
149 views

Can client-side hashing improve after-the-fact security in response to password leaks?

Several questions on this site address client-side password hashing, and none of them admit to any security benefit beyond protecting other sites the user might use the same password for. However, ...
8
votes
6answers
2k views

How to securely store my passwords?

Regarding this: Are passwords in memory? So does someone have a good idea on how to securely store my passwords? The: "passwords.txt" -> ctrl+c; ctrl+v a passw is not very secure. I have passwords ...
8
votes
5answers
214 views

Citations for inadvisability of globally unique password

I am looking for an authoritative source to back up my position in a disagreement over password policy. I am having a disagreement with a client about the user identification/authentication process ...
8
votes
1answer
2k views

How should I protect in-app Android payments when using a separate server?

I am currently implementing Android in-app payments, and am wondering what attack vectors I should look out for. I have a simple application to view server-generated content. I want to allow the user ...
7
votes
1answer
5k views

Drawbacks of storing an authentication token on the client side?

I am working on an ASP.NET MVC web application, which fetches its data from an API in the back. So authentication is currently done via ASP.NET Forms Authentication, which means the client sends email ...
6
votes
2answers
933 views

Is it better to hash n*x times in sha1 or n times in sha512 on the client side?

I already know I"m going to hash the user's password n times in either sha512 or n*x in sha1 before it is sent to the server. Once at the server, I'm going to use bcrypt set to use ~1/100th of a ...
6
votes
2answers
575 views

Client-side attacks with custom malware in penetration tests

I regularly perform pen-tests against web applications, operating systems, etc. Occasionally, I'm luck enough to do a 'red-teaming' exercise and get to attack at all conceivable points of a network ...
6
votes
4answers
805 views

Secure authentication: partial client-side key stretching… please review/criticize my idea

I am trying to figure out what would be the 'perfect' authentication system for a website. On one end, we know that simple hashing algorithms can be brute-forced or cracked in other ways. Hence why ...
5
votes
2answers
1k views

Web & insecure HTTP - Using RSA for encrypting passwords on the client side

I used client side password hashing in my register and login project. Its purpose is to prevent passive adversaries/eavesdroppers from discovering users' plaintext passwords when HTTP requests are in ...
5
votes
4answers
215 views

booting from linux CD and visiting https website only

my friend wants to make sure he visits certain websites very securely. Is booting from linux cd and visiting only https website secure, meaning only he'll have access to data? He'll be on wi-fi of ...
5
votes
2answers
2k views

Risks of client-side encryption using Stanford Crypto Library

I'm building a simple web application for encrypted chat. Each message will undergo 256-bit AES encryption on the client side, using the Stanford Javascript Crypto Library. No unencrypted data or ...
5
votes
2answers
7k views

Certificate Chain checking

I have a very specific question. A client verifies a sever by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (According to the ...
5
votes
2answers
745 views

Using Client-side certificates for Authentication

Why aren't client-side certificates used for Authentication? Then user has to remember only 1 password to unlock his windows account which stores the certificates. I understand that if user access ...
5
votes
2answers
2k views

How to remember a trusted machine using two factor authentication (like Google's system)

We are developing a web application that will use two factor authentication. We are likely to try and emulate something similar to that used by google, where to login you enter a username and ...
5
votes
2answers
1k views

Is it safe to use createHTMLDocument to sanitize HTML?

i'm wondering how safe it is to use createHTMLDocument to do HTML sanitization. I've tried to implement it like this: function sanitize(string) { var elm = ...
5
votes
1answer
1k views

Is 'Forge' Javascript crypto library secure? [closed]

I need a client-side crypto library. I've seen https://github.com/digitalbazaar/forge linked many times on stackexchange. Forge seems to be the most complete and well-documented crypto library for JS. ...
4
votes
4answers
2k views

How to prevent attacks against client side validations?

I have a login form where am accepting Mobile Number of the User for login. When Mobile Number is submitted, am calling a JavaScript to validate the Mobile Number. My client side validations ...
4
votes
4answers
2k views

How to securely share key between two remote devices?

Assuming I have a server/client topology, currently I'm facing the problem that I want to generate some key on the client side and somehow make the remote server get it securely. I'm using AES on ...
4
votes
2answers
340 views

Can an eavesdropper detect the use of a TLS client-side certificate?

Basically what the above says, assuming the eavesdropper must be completely passive, and cannot connect to the server to check if the server requires a client certificate.
4
votes
1answer
670 views

SSL, SSH, OPENVPN, etc which one?

To start with I am not a security professional, in fact I am on the other end of the spectrum. In the opinion of people on this site what would you choose for secure internet browsing. I will be ...
4
votes
3answers
498 views

Client-Side Hashing to decrease value of password guessing heuristics

Yes, this is 'yet another client-side hashing' question. But, don't leave yet, I think there is some value here. I'd like to do something to mitigate the affect on the community as a whole when my ...
4
votes
1answer
5k views

Is it safe to give an Oauth token to client side javascript so it can directly make requests to a server?

I currently have a simple backbone.js application served from my domain (example.com), which is provided an Oauth token. Specifically, I pass the Oauth token through my page template into the ...
4
votes
2answers
157 views

Changing windows client form values at runtime

I am performing a code audit of an older VB6 application which uses dynamically constructed SQL to execute against the database. While I see this as a SQL injection point, the developer contends that ...
4
votes
2answers
344 views

What criteria do you use for evaluating Client-Side / Endpoint security products?

What features are important to you in client-side AV and Firewall products? Who benefits from these features? Managment, the end user, helpdesk. Are there features that are being 'sold' by the ...
4
votes
1answer
224 views

Asymmetric / end to end encryption for web messaging app

Background I'm trying to design a secure and sustainable web app for messaging. The purpose is to learn how to create secure web application. The application is suppose to be written in Javascript ...
4
votes
1answer
96 views

Securing client-side data from users

So my problem, in its general form, is encrypting test questions such that a client-side testing application can access the questions while students cannot. The naive approach, in my opinion, is to ...
4
votes
2answers
656 views

How to implement client side encryption for CalDav & CardDav content?

I'm looking for a client-side encryption implementation that would be able to secure CardDav & CalDav data so that they couldn't be compromised even by the hosting provider. Server side: PHP or ...
3
votes
2answers
302 views

Ways around browser xss detection

Most modern browsers will detect xss attempts (script code in the URL) and prevent execution. Are there any known standard ways around this or are xss attacks pretty much impossible now?
3
votes
3answers
5k views

Disabling SSL v2 and weak ciphers on client PC's

Is it a requirement to also disable SSL v2 and weak ciphers on client PC's? I have seen quite a few posts for disabling them on servers, but nothing about a regular client PC, say, running Windows XP ...
3
votes
2answers
81 views

Is letting just anybody see the appearance/html/javascript of your admin pages a security risk?

Ok so consider the scenario in which you have two projects, one is a RESTful API, and the other is a public facing website. The API uses cookie/token based authentication, and contains all of the ...
3
votes
4answers
971 views

How password hashing is useful in MITM attack?

Even though I read a lot about hashing and how passwords are protected, I am still confused about it. If passwords are hashed at client side, it will be useless because it can be sniffed and used by ...
3
votes
1answer
108 views

How to (programmaticaly or by other means) encrypt or protect customer data

I am working on a web project and I want to (as far as possible) handle user data in a way that reduces damage to the users privacy in case of someone compromising our servers/databases. Of course we ...
3
votes
1answer
970 views

SQLMap: How to test JavaScript generated field names?

I have a pretty simple HTML page that submits a username and password to the server via POST method: <doctype html> <head> <title>SQLMap dynamic parameters</title> ...
3
votes
5answers
499 views

Can web application do anything to prevent risk from client-side malware?

Client side malware (keyloggers, screenscrapers etc.) is a great risk. It can't be effectively stopped from side of ordinary application. Only users themselves can do some measures to prevent risk ...