The tag has no wiki summary.

learn more… | top users | synonyms

2
votes
1answer
122 views

Localhost WebSocket defense

If a malicious application has found its way onto a computer running a localhost only WebSocket server, would it help if the communications used SSL? If so, how could SSL fail if a malicious app ...
3
votes
2answers
302 views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
3
votes
2answers
561 views

Token authentication and storage / websocket issues

My application is running an API authentication that uses tokens rather than cookies. This leads me to ask a few questions : What is the most secure way to store the token ? By using random ...
-2
votes
2answers
299 views

Why don't we have any popular decentralized chat systems, social networks etc.? [closed]

Let's say two computers have the same decentralized chat program. Each user has to have an ip address and port number to send the message to another person. Each message is encrypted using, let's say, ...
0
votes
2answers
191 views

How do I securely identify a remote (self programmed embedded) device in PHP?

Is there a reliable way in PHP to identify a device that might be behind a Router (so the IP is not unique)? Background: I have several embedded devices (self programmed & adaptable) that contact ...
4
votes
2answers
623 views

Is it possible to create a secure chat web application relying on HTML5 web sockets?

Is it possible to create a secure chat web application using just HTML5 and Javascript? What possible security holes would there be if the server doesn't store the messages, just relay them using ...
4
votes
2answers
380 views

How does websocket frame masking protect against cache poisoning?

I've been studying the Websocket protocol (RFC 6455). Section 10.3 specifically talks about frame masking, which is prevents cache poisoning from http proxy servers. How does frame masking prevent ...
3
votes
1answer
238 views

Do websocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?

The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
0
votes
1answer
2k views

Websocket implication for firewalls

(I've read several questions here about websocket but apparently there's no websocket tag) If I understand correctly websockets are using TCP trafic over port 80. What are the implication, if any, ...