I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
Suppose I have a desktop application that does password hashing for login authentication. Is the password normally hashed before it travels to the wires or does it travel to the wires first in plain ...
For internet explorer or whatever, I get it... It's in essence a sneakernet, you get them on the physical media from which you install your system and browser. But what about for firefox and chrome? ...
Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords. I am facing a dilemma - I used to think it is safer to make a ...
The OpenSSL website provides a long list of different ciphers available for SSL and TLS. My question is, which of those ciphers can be considered secure nowadays. I am especially interested in HTTPS, ...
Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever). Upon login, what should I transfer over the network and why? Password ...
I heard a while ago about someone exploiting md5 weaknesses to create a web certificate with the same md5 that a different certificate has. They were able to create a certificate through bad issuing ...
Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...