The tag has no usage guidance.

learn more… | top users | synonyms

2
votes
0answers
18 views

Mixing Off-The-Record and classic SSL

I am developing some pubsub system on top of Node.js and Socket.io. I decided to implement Off-The-Record (OTR) encryption by default for all of data transfers between clients and server(s). Question ...
1
vote
2answers
62 views

Implications of replacing Java Applets with Client Side Websocket Server

I am no security expert, but do know some concepts. We have a enterprise web application which currently uses Java Applets to do some operations on files in Client's File system (Browse, create, ...
3
votes
2answers
152 views

Should I use websockets (ws) or secure websockets (wss) for my game?

I'm making a game and I'm using websockets for 99% of communication. The only http(s) is on initial page load and when logging in/registering. I'm a complete noob so correct me if I'm wrong, but SSL ...
0
votes
0answers
75 views

How to communicate securely between my Swift app and a localhost socket.io server?

I have written a tiny Swift app that uses NSTask to start up a nodejs socket.io server (bundled with the app), which it then connects to via the official socket.io Swift client (https://github.com/...
0
votes
1answer
35 views

How to check connectivity between raspberry pi and server [closed]

How to check connectivity between raspberry pi (which act as a client) and server using web-socket
9
votes
1answer
189 views

Is a very long living WSS WebSocket Secure connection really secure?

I am far from being a security expert, so please forgive any approximation in this question. As I understand it from this (very good) answer, a suite of HTTPS connection can be summarized as such : ...
0
votes
2answers
130 views

Is the Origin header really useful for securing a WebSocket?

I've been reading some posts about WebSockets security, and a few of them mention to use the Origin header for helping secure the connection. For example this one https://www.christian-schneider.net/...
0
votes
2answers
46 views

Is there any security implication of using WebRTC over unencrypted channel for streaming?

I've spend a few hours reading about WebRTC and everywhere it's recommended to use a secure connection for contacting with the signal server, so no MitM attacks could be possible. However, my project ...
3
votes
1answer
81 views

What's the purpose of the MASK in a WebSocket?

Reading the Web Socket RFC, at 5.1 it says: a client MUST mask all frames that it sends to the server (see Section 5.3 for further details). (Note that masking is done whether or not ...
2
votes
2answers
96 views

Sec-WebSocket-Key Header

Can anyone explain me which attacks the Sec-WebSocket-Key in the WebSocket handshake addresses? I don't understand it in the RFC, neither on google.
1
vote
1answer
48 views

What is the added value of dynamic payload in Ping/Heartbeat commands?

Many protocols, including TLS and WebSocket, have a ping/heartbeat packet format that we encapsulate a variable payload that the remote end must reply back. In other terms, If I (client) send a ping ...
3
votes
0answers
53 views

Local sockets: does SSL add security? [duplicate]

Situation We have a Windows Service that is listening on a TCP port. This service is responsible for capturing a user's fingerprint using the Windows Biometric Framework, when requested to do so by a ...
3
votes
1answer
132 views

Security of Web Game over WebSockets?

Project that I'm working on depends on WebSockets to communicate between the server and client browser for all interactions within the game. I'm attending university for Computer Security, but I'm ...
0
votes
1answer
277 views

How to secure a websocket connection with challenge-response?

TL;DR Given that all of the state information for a web browser is accessible to a (potentially hostile) user, how can challenge-response authentication between the browser and the server be ...
1
vote
0answers
74 views

Possible vulnerabilities in private chat application implemented using web broadcasting

I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher. The workflow of this ...
-1
votes
1answer
261 views

How to secure my node.js/socket.io application properly? [closed]

I do have multiple applications in .NET. Now I want that each user can talk within its application with other users of the same application. Therefore I programmed a node.js/socket.io-server. ...
1
vote
1answer
599 views

Secure socket communication between iOS device and 3rd party server

I'd like your advice on what is the best approach for the challenge in my hands... I'm developing an extension to a 3rd party software. I'm doing my development using Python/Twisted/Autobahn. The end ...
0
votes
2answers
2k views

using html5 websockets to bypass firewall TCP policy

I've read that html5 enables opening tcp sockets from the client side in its "websocket" feature. Firewalls as I recollect may be configured to block tcp connections initiated from "the outside" by ...
3
votes
1answer
148 views

Double socket connection

I'm busy experimenting with TCP socket connnections. I have made a client SOCK_STREAM socket andi've got a few questions: Is there any way that a streaming(TCP) socket can get data from another ...
1
vote
1answer
4k views

Preventing socket.join(“room”) client-side, listening for private room leaving

i'm developing an application with Socket.IO that needs to authenticate if user can join a room. Client side: var socket = io('http://<?php echo $_SERVER['HTTP_HOST'];?>:3000'); socket.on('...
6
votes
1answer
902 views

Preventing CSRF attacks against WebSocket communications

I have read the thread about CSRF attacks in websockets (Do websocket-powered web apps (e.g. "comet" apps) have to worry about CSRF?) and also some more material regarding websocket security,...
3
votes
3answers
5k views

Socket.IO Client Security

I am new to Node.js and Socket.IO. According to documentation the client side code is something like: <script src="/socket.io/socket.io.js"></script> <script> var socket = io('...
1
vote
0answers
574 views

Socket.IO & WebSocket security - query certificate/public key a leak?

Socket.IO and WebSocket do not provide underlying connection information (like the certificate or public key of the SSL/TLS channel), and I'm trying to understand the reasoning. The context for this ...
2
votes
1answer
481 views

Localhost WebSocket defense

If a malicious application has found its way onto a computer running a localhost only WebSocket server, would it help if the communications used SSL? If so, how could SSL fail if a malicious app ...
8
votes
2answers
4k views

Anti-DoS WebSockets Best Practices

What are the best practices for thwarting DoS attacks for a WebSocket server? Is there a comprehensive site or document that can be referenced?
3
votes
1answer
3k views

Token authentication and storage / websocket issues

My application is running an API authentication that uses tokens rather than cookies. This leads me to ask a few questions : What is the most secure way to store the token ? By using random ...
-2
votes
2answers
1k views

Why don't we have any popular decentralized chat systems, social networks etc.? [closed]

Let's say two computers have the same decentralized chat program. Each user has to have an ip address and port number to send the message to another person. Each message is encrypted using, let's say, ...
1
vote
2answers
1k views

How do I securely identify a remote (self programmed embedded) device in PHP?

Is there a reliable way in PHP to identify a device that might be behind a Router (so the IP is not unique)? Background: I have several embedded devices (self programmed & adaptable) that contact ...
5
votes
2answers
2k views

Is it possible to create a secure chat web application relying on HTML5 web sockets?

Is it possible to create a secure chat web application using just HTML5 and Javascript? What possible security holes would there be if the server doesn't store the messages, just relay them using ...
7
votes
2answers
2k views

How does websocket frame masking protect against cache poisoning?

I've been studying the Websocket protocol (RFC 6455). Section 10.3 specifically talks about frame masking, which is prevents cache poisoning from http proxy servers. How does frame masking prevent ...
5
votes
2answers
793 views

Do WebSocket-powered web apps (e.g. “comet” apps) have to worry about CSRF?

The standard advice for HTTP applications wanting to prevent Cross Site Request Forgery is to include a random token on each state-changing request (usually POST) which is verified by the server ...
1
vote
1answer
8k views

Websocket implication for firewalls

(I've read several questions here about websocket but apparently there's no websocket tag) If I understand correctly websockets are using TCP trafic over port 80. What are the implication, if any, ...