Tagged Questions
11
votes
4answers
455 views
Handling passwords in a web application
I am trying to learn how a secure web application is developed. Particularly, I am unsure of how passwords are sent from the client to the server. For a typical user/password login form. If the client ...
-1
votes
3answers
57 views
Secure transmission for desktop applications
Suppose I have a desktop application that does password hashing for login authentication.
Is the password normally hashed before it travels to the wires or does it travel to the wires first in plain ...
1
vote
1answer
83 views
How are root CAs for SSL distributed?
For internet explorer or whatever, I get it... It's in essence a sneakernet, you get them on the physical media from which you install your system and browser.
But what about for firefox and chrome?
...
6
votes
3answers
307 views
How secure is HTTPS with weak ciphersuites?
Today I came across the website https://mtgox.com/, which claimed to be secure because of the Verisign certificate. I checked the certificate out of curiosity (it's the first thing they claim, let's ...
10
votes
4answers
2k views
https security - should password be hashed server-side or client-side?
I am building a web application which requires users to login. All communication goes through https. I am using bcrypt to hash passwords.
I am facing a dilemma - I used to think it is safer to make a ...
12
votes
2answers
3k views
Which SSL/TLS ciphers can be considered secure?
The OpenSSL website provides a long list of different ciphers available for SSL and TLS.
My question is, which of those ciphers can be considered secure nowadays. I am especially interested in HTTPS, ...
14
votes
4answers
752 views
What to transfer? Password or its hash?
Let's say in my database I store passwords hashed with salt with a fairly expensive hash (scrypt, 1000 rounds of SHA2, whatever).
Upon login, what should I transfer over the network and why? Password ...
5
votes
2answers
158 views
Complexity of web certificate attacks
I heard a while ago about someone exploiting md5 weaknesses to create a web certificate with the same md5 that a different certificate has.
They were able to create a certificate through bad issuing ...
16
votes
9answers
582 views
Does hashing a file from an unsigned website give a false sense of security?
Consider this. Many websites with software downloads also make available MD5 or SHA1 hashes, for users to verify the integrity of the downloaded files. However, few of these sites actually use HTTPS ...
