In a client-server model, the server serves services to the client.
0
votes
1answer
168 views
iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates)
As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2.
...
0
votes
1answer
85 views
Transmission of messages
I am currently developing a game which will be run in a client, they will sign up for this game online and create their account there, their information will be stored into a MySQL database. I am ...
3
votes
3answers
428 views
Revoke a certificate without index.txt
I generate self-signed client certificates for a little Apache server hosted under my stairs. The script below was hacked together for this purpose - note it uses the 'mini-CA' x509 method, therefore ...
1
vote
2answers
157 views
How to uniquely identify / tag client devices to whitelist VPN access?
I'm just wondering if there is any way to uniquely identify or tag client devices like laptops and towers in order to whitelist them for vpn access.
(Note: This is a thought-experiment at the moment, ...
2
votes
2answers
197 views
Web Service Security Checklist - Tracing and Debugging
I have been reading this security checklist about web service design:
http://msdn.microsoft.com/en-us/library/ff648304.aspx
One of the suggestions is that you should disable the following in ...
2
votes
2answers
130 views
SSL/TLS Client Authentication by IP
Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example:
There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
4
votes
2answers
1k views
Certificate Chain checking
I have a very specific question.
A client verifies a sever by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (According to the ...
33
votes
5answers
2k views
Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?
I've been worried about this password manager, PasswordBox that seems to be gathering quite a bit of steam lately.
They seem to have raised VC funding and are offering a free password management and ...
1
vote
2answers
343 views
SSL: How to send generated client certificate from server to avoid MITM?
The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
-1
votes
2answers
254 views
Generate openSSL certificates from within C code using commands?
This is an openSSL command for generating a private key and a certificate,
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
The question I have is whether there is some ...
6
votes
1answer
2k views
SSL Cert Types and Key Usage
I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
6
votes
2answers
274 views
Client authentication vs. user authentication
I am currently looking into authentication protocols which work well with REST API, in java.
There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
1
vote
0answers
187 views
Fuzz a client with sulley [closed]
I want sulley to bind to an interface, wait for a connection and fuzz the reply to the client. How can I act as a server with sulley to fuzz a client ?
1
vote
1answer
123 views
Client vs Server security for business critical application (crossplatform)
We have the option to develop a software either based on
Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
-1
votes
2answers
342 views
Keeping the password secret over regular http
I would like to at first be clear that this is for poor site owners who can't afford the SSL option but require logins to their site, potentially from a public kiosk, and need a secure method of ...
10
votes
5answers
1k views
Is it worth the effort to store FTP passwords encrypted?
I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
