0
votes
1answer
75 views

Native app, token authentication without login/password

I'm working on a always online mobile game (native android/iOS app with Unity) and i would like to be able to authenticate the player without requiring any login/password at the beginning. For those ...
1
vote
0answers
17 views

PBKDF2 hashing over TLS for encrptig password [closed]

i wanna use PBKDF2 hashing over TLS for encrypting password and session and that way stop hackers from breaking into my connection. How to do it in java.
5
votes
3answers
574 views

Does checking the fingerprint of a self signed certificate improve security?

I am currently developing a component for an application that does TCP communication with a device inside a local area network. I use TLS to provide data encryption, integration and authorisation. ...
1
vote
2answers
268 views

Could a user never store a password if a username/email hash was used instead?

So I was just thinking about token_authenticatable setup from devise (rails gem), and this thought occurred to me: Could we strengthen web security by hashing username/password with javascript before ...
11
votes
4answers
1k views

Handling passwords in a web application

I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
-1
votes
3answers
125 views

Secure transmission for desktop applications

Suppose I have a desktop application that does password hashing for login authentication. Is the password normally hashed before it travels to the wires or does it travel to the wires first in plain ...
1
vote
1answer
106 views

How are root CAs for SSL distributed?

For internet explorer or whatever, I get it... It's in essence a sneakernet, you get them on the physical media from which you install your system and browser. But what about for firefox and chrome? ...
7
votes
3answers
437 views

How secure is HTTPS with weak ciphersuites?

Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
5
votes
9answers
4k views

What is the best way of securing a website logon without SSL or preshared keys?

Today I sniffed some unencrypted wlan traffic during class and I found quite a few passwords by a simple search for "pass" and "user" in wireshark. Turns out about half the sites we use for school ...
21
votes
4answers
6k views

https security - should password be hashed server-side or client-side?

I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
21
votes
3answers
8k views

Which SSL/TLS ciphers can be considered secure?

The OpenSSL website provides a long list of different ciphers available for SSL and TLS. My question is, which of those ciphers can be considered secure nowadays. I am especially interested in HTTPS, ...
16
votes
4answers
2k views

What to transfer? Password or its hash?

Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever). Upon login, what should I transfer over the network and why? Password ...
5
votes
2answers
174 views

Complexity of web certificate attacks

I heard a while ago about someone exploiting md5 weaknesses to create a web certificate with the same md5 that a different certificate has. They were able to create a certificate through bad issuing ...
26
votes
10answers
915 views

Does hashing a file from an unsigned website give a false sense of security?

Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...