Hot answers tagged

47

If so, then why do these companies not offer server side verification for video games, but rather continue to insist on trusting the client? It's less about insisting on trusting the client and more that there is no other viable anti-cheat model. Like DRM, and in fact, anti-cheat software like PB use a form of DRM, there's little that can be done. DRM ...


37

It is fundamentally impossible to validate a client on a system you don't control. That doesn't mean it can't be done to a sufficient degree. eBook readers, for example, generally try to ensure the client is authentic. They (seem to) do so in a manner that is secure enough to defend against their threat. Good enough to protect nuclear secrets? No. But ...


36

I know HTTPS can solve the problem, but I am still instructed to encode the password before sending it over network as per our organizational guidelines. This really defines your situation. Basically, you have a simple solution that you should use anyway (use HTTPS), if only because without HTTPS an active attacker could hijack the connection after the ...


35

Yes. You should research what exactly goes in an HTTP request. The user agent is easily changed as it is set by the client. There are many tools that allow you to change your user agent for your browser. If you are using curl, you can also just craft your own HTTP request and set the user agent to whatever you like. If a web application depends on a user ...


30

What you've described isn't improving the security of the system. Its not a matter of opinion or emotion, security just doesn't work that way. In your example the hash(salt+password) is now your password. If it wasn't over https, then an attacker could just replay that value. Also you didn't really address owasp a9 aka "firesheep" style attacks.


26

First it is important to understand what kind of images the client does not show. In your case, as the message states, these are images which would have been "download" ed. That means these are not images which are embedded in the email (multipart, etc.), but referenced (HTML img, etc.). Now imagine what kind of information the sender could gain if your ...


24

Yes it does work as you say. The chip is "tamper resistant" and will erase the "seed" (secret key) if any attempt is made to attack it. This is often accomplished by having a non-user-replaceable battery and a "trap" that breaks power to the device once the device is opened, or the chip surface is removed. The key is then stored in a SRAM, requiring power to ...


24

You have no security without authentication Just to explain it further, I am using JCryption API for encrypting the password using AES, so the value transmitted over network is AES(SHA1(MD5(plain password))) now I want to replace MD5 with Bcrypt only. Rest of the things remain unchanged. This approach works even against "Man in the middle attack"....


23

Hashing on the client side doesn't solve the main problem password hashing is intended to solve - what happens if an attacker gains access to the hashed passwords database. Since the (hashed) passwords sent by the clients are stored as-is in the database, such an attacker can impersonate all users by sending the server the hashed passwords from the database ...


21

Client side anticheat software in and of itself isn't about security, it's about the gameplay (and customer) experience. Thus, security rules aren't nearly as applicable. Trusting the client "hit pixel 1056 by 1723" is very different than trusting the client "can transfer $1000 to Nigera", or that the client "can access Bob's email". Note that I am ...


21

Yes, a modified user agent can be used for malicious purposes. However it is unlikely that your scenario of the googlebot UA being used for privileged access. How is UA more likely to be used? If your application parses the user agent to take some action, and you do not properly sanitize that input, Cross Site Scripting will be a very likely outcome. In a ...


19

It is fundamentally impossible to validate that an unmodified version of your client connects to your server. ... unless you do what is necessary to ensure it. This means client-side tamper-resistant hardware. When your code runs on the client's computer, the computer owner can run a debugger and modify the client code at any point with arbitrary values. ...


18

First: There are many games, which use 100% server side validation and don't trust the client. One example: Online Poker You simply do not send the value of any cards to the client which he cannot know. So even if he hacks the client and reads the matrix, there is nothing hidden which he can reveal and no moves he can make which he couldn't do with the ...


17

You raise several issues. Server trust You never know what the server will do with your password once you send it Password reuse Password reuse can be prevented by you: don't use the same password at multiple places. Hashing If you were to hash the password before sending it to the server, then the hashed password would become the password. If the ...


15

It has to do with the general scope of what you are trying to protect. If you are developing a server-side application, you are trying to protect the server from both the user and his client system. Having the user's system (ie, the client) do your security work for you doesn't really help the server stay protected. There's usually an assumption that when ...


15

If so, then why do these companies not offer server side verification for video games, but rather continue to insist on trusting the client? They do! Most online games have some consistency check every now and then. Player32517 moved 100 units in 3 seconds, is that possible? However, checking if every single move is valid is an enormous amount of ...


14

A recent example can be found in a Joomla exploit. Joomla stored the user agent in the session, and this allowed for a use-after-free vulnerability in PHP to be exploited.


13

You can't. A server fundamentally can't trust a client (there are some exceptions - if the client machine is hardened (hardware verifies firmware, firmware verifies OS, OS verifies every application running), it might be possible to do that (but not really - someone with a soldering iron could always modify the hardware verification), but if you don't 100% ...


13

In order to sign client certificates, you will need a CA certificate you control. Paying for one is out of the question in most cases, as global-trusted CA certificates are a security hazard for the rest of the Internet. So in these cases you have to make your own CA and create your own server and client certificates. So let's start with a basic openssl....


13

Obfuscation might look as the first obvious step, but obfuscation has to protect something in the code and that something cannot be webservice functionality because that is reverse engineered by intercepting the traffic even if it is SSL encrypted. Certificate pinning can prevent simple SSL interception by trusting a predefined certificate. You can ...


12

The core reason is not hate... it's insecurity. A general principle is to trust nothing you don't have control of. In the case of a user authenticating to an application, unless you provided the laptop to the user, configured its controls, and those of the environment it sits in, you can't trust it. The traditional way to look at it is that if an attacker ...


12

If your "paranoid dial" is turned up all the way to 11, the short answer is "No". No matter how you store your passwords, there will at some point be a transfer in memory that is a cleartext representation of some authenticator. That "cleartext" may be your ASCII password, or it may be a hash of it, but it will still be enough to independently validate ...


11

There will never be a single perfect checklist, but here's a few things worth going through: Wikipedia doesn't do half bad on this one More for AJAX or other rich interfaces, but worth a read depending on your architecture - OWASP This seems worth a test drive - haven't tried it myself - Javascript sandbox Yes, none of these is a true "checklist" - IMO ...


11

One reason for this is automatic image loading can be used to track users opening the mail (in the same way as a read receipt). Say a marketing company sends out a mail to a thousand users and for each user they place a link to a different image in the mail (so user one gets image0001.jpg, user two gets image0002.jpg and so on), and host the images on their ...


11

You could try Cryptographic Obfuscation when it exists Cryptographic Obfuscation is were, in certain senses, you make a programs source code unreadable. What you can then do is hardcode a cyrptographic key into the program. You would also want the server to supply a random seed to your program since the computer could not be trusted. The only problem with ...


10

A man-in-the-middle attack is when an attacker inserts himself between client and server, and impersonates the client when talking to the server, and impersonates the server when talking to the client. "Impersonation" makes sense only insofar as there is an expected peer identity; you cannot impersonate an anonymous client. From the point of view of the ...


10

To do 10 checks on the server side is likely not going to put any real stress on your server. Unless you are at the point of thousands of request per second, you will be okay. At that point, you would probably implement clustering, etc. Security is always worth the extra cycles. Client side validation is never sufficient. When you think about validation, you ...


9

Greetings, there are plenty of password managers out there that will do what you need. A popular option is KeePass , which is free and also has the advantage of having apps for a few platforms out there (Windows phone, IOS, Android).


9

This sounds a bit stretched, maybe counter-productive, sub-optimal and it doesn't really offer much added security. The "password" is actually seen in plaintext, because the password is the string you finally send in the place of the real password. What exactly are you trying to achieve? In any way, if you are really trying to have the 'real' password 'not ...



Only top voted, non community-wiki answers of a minimum length are eligible