Questions tagged [client]

In a client-server model, the server serves services to the client.

Filter by
Sorted by
Tagged with
1 vote
1 answer
55 views

Defining scope of a software pen test

If I own a software and I want to conduct a pen test with pen testers, should I define the scope or do the pen testers assess the software first and they define the scope? How does scope definition ...
user avatar
0 votes
0 answers
50 views

Client Identification using Self Signed Certificates

Taking the concept from the Gemini protocol that allows clients to identify themselves using their own self-signed certificate - is this a valid concept that could be used in other protocols and what ...
user avatar
0 votes
1 answer
21 views

is client server model to do some root operations without asking everytime secure?

I'm writing a python application that will do some operations that will require root privileges.So instead of asking for user password every time i decided to use server client model. A python script ...
user avatar
0 votes
1 answer
89 views

Is braintree clientToken supposed to be public?

I'm building an app that uses Braintree for processing payments. According to the documentation, I need a server-side endpoint that returns the clientToken, which is then used to manage a user's vault ...
user avatar
1 vote
1 answer
454 views

Wildcard Certificates and Client Authentication for Machine Authentication

If a wildcard certificate is provisioned for *.domain.fqdn, and has Client Authentication as a defined usage, does this mean the certificate can be used to essentially impersonate any domain machine? ...
user avatar
0 votes
1 answer
166 views

How is CertificateVerify SSL is created? It can be cached?

When a HTTPS connection with a client certificate request is done, the client sends a CertificateVerify message with his public certificate so the server can verify that the client has a valid private ...
user avatar
  • 3
0 votes
1 answer
114 views

Storing client keys in cloud app

I'm using Azure to store customer data. In a specific country, there are multiple partners. Each partner has his clients. The issue is they don't want us to have access to this data. In other words, ...
user avatar
1 vote
1 answer
115 views

Denial of Service question

I am studying for an exam in computer security, and I got stuck on the following question from a past exam: A random program generator service S allows clients to generate random data. Each client Ci ...
user avatar
  • 23
0 votes
1 answer
84 views

Client Cert Authentication: Accept cert in request or retrieve from host?

Is it more secure to retrieve a client cert from their host rather than accept the cert presented in request? Example: B2B Client pre-shares public cert with me I store public cert in database Later, ...
user avatar
  • 113
0 votes
0 answers
97 views

Certificates between services in a single machine

I'd like to know if it's possible to protect communications between a heavy client on a machine and a remote server accessible by a web interface on this machine using certificates. Or the only way is ...
user avatar
  • 31
0 votes
1 answer
167 views

How to select a random node when nodes are untrusted in a distributed network?

Assume in a distributed network, where the nodes are not trusted and are identified by their public keys, we intend to select one of them in a random process. In such a situation, all of the nodes ...
user avatar
  • 1,217
1 vote
1 answer
2k views

"unsupported certificate purpose" for nginx client auth

Please concern the following setup: A client certificate is issued like this: Root CA → Intermediate CA → Client Cert Let's assume everything is fine up to here, the intermediate CA cert is properly ...
user avatar
  • 133
1 vote
0 answers
104 views

Bettercap TLS handshake phase information

I wanted to know if bettercap has a feature that allows to view TLS handshake phase information (as Wireshark does), for example the "Client Hello" ?
user avatar
0 votes
0 answers
121 views

Addressing SSL/TLS vulnerabilities in IoT Device client side implementation

I understand SSL/TLS is the most commonly data transmission protocol for a secured communication. I need to implement the same in one of the IoT device (ARM® Cortex®-M4 Core at 80 MHz). This will be ...
user avatar
0 votes
2 answers
215 views

Getting a "so-called valid" certificate to work inside the application

There's is a python client app connecting to a java server app via a secure socket. The connection works great with a self-signed certificate, however, it fails when I attempt to utilize a given valid ...
user avatar
8 votes
3 answers
1k views

Is it possible to store / record HTTPS client auth traffic as a signed document?

In a scenario where there are client RSA certificates (e.g. on a smart card), is it possible to record a form submission (or an AJAX request) in a form which makes it possible to later ascertain that ...
user avatar
0 votes
0 answers
75 views

How does authentication and certificate exchange occur when connecting to a website and how is the trust verification performed? [duplicate]

I'm learning PKI infrastructure but i have some questions that my teacher don't respond. Thank you for the possible answers.
user avatar
1 vote
2 answers
378 views

Why Thunderbird has private IP address as remote host?

Why Mozilla Thunderbird configured to access Yahoo IMAP server, uses a private IP address, even if there is no other device in the network. Every time, Thunderbird is restarted, it changes remote-host ...
user avatar
1 vote
1 answer
333 views

On TLS-enabled nginx/httpd, is "ssl_verify_client optional_no_ca" disabling TLS's "CertificateVerify" checks?

I'm looking for an helping hand with my https nginx setup. I require my application to be exposed through an nginx frontend, offloading TLS. Easy ! The thing is, I need to have Certificate-based ...
user avatar
  • 11
7 votes
1 answer
3k views

Should repositories with server-code and client-code be separate?

I have a project that runs a website with a frontend SPA and REST API backend. Currently the code is split into /client and /server folders and they run independently. However, they are currently in ...
user avatar
0 votes
2 answers
170 views

Is it safe to publish a REST API client on npm even though the API is not intended for public use?

I am build a website in Angular which communicates over my REST API on my backend server. I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on ...
user avatar
  • 1,047
0 votes
1 answer
213 views

Why is there only two packets in a TLS handshake?

I captured my network traffic to a web server and the SSL Handshake consists only of two packets. Why does that happen and why aren't there all the other packets?
user avatar
  • 1
22 votes
8 answers
6k views

How can I re-use my password and still protect the password if it is exposed from one source?

I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
user avatar
  • 389
13 votes
3 answers
6k views

How to perform Login Authentication at the client-side? [closed]

How can we validate login credentials at the client-side itself without involving the server of a website?
user avatar
  • 155
1 vote
1 answer
310 views

Client-only authentication instead of server-only authentication, using OpenSSL [duplicate]

First, some background: I've got a C++-based client/server system that uses the OpenSSL C library to encrypt the client/server connections. This is done in (what I believe is) the canonical OpenSSL ...
user avatar
2 votes
1 answer
231 views

Is it possible to setup 1-way TLS client authentication without server certificates?

Is it possible with TLS to only authenticate the client? In other words can one-way TLS be setup in such a way that only the host initiating the connection uses a client certificate and the second ...
user avatar
  • 21
0 votes
0 answers
123 views

How can a server make sure client application sending data is not a modified copy?

I actually wouldn't care about a perfect copy (my program is free)being used, I just can't allow someone to use a copy to communicate with my server. I came accross this subject where the OP seemed ...
user avatar
0 votes
2 answers
116 views

How to keep track of file authenticity while offline

I have an application running the client/server model and offering an online and an offline mode. Each user can read, create or modify text files (even in offline mode) that will be present on his ...
user avatar
0 votes
1 answer
453 views

Ways to verify Data Integrity

I've had looks to existing subjects but it usually gets heavily complicated while I'm new to this kind of stuff and I'd prefer to understand concepts first in order to understand better concrete ...
user avatar
3 votes
1 answer
1k views

Why is PKCE secure against man-in-the-middle attacks?

In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
user avatar
  • 131
1 vote
0 answers
196 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
user avatar
  • 111
0 votes
2 answers
1k views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
user avatar
1 vote
1 answer
148 views

How to authenticate a specific client program? [duplicate]

I have a server application which provides functions to a client program. The client is also programmed by me. Now I want to authenticate the client program itself (not any user) before using my ...
user avatar
  • 113
2 votes
4 answers
157 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
user avatar
12 votes
1 answer
12k views

Client certificate common name? Subject alternative name?

For an IoT project, I want to secure client server communication. I want both the server (Apache) and the clients identify/authenticate each other (a client won't communicate with other clients) ...
user avatar
0 votes
1 answer
1k views

Root CA or Intermediate CA in firewall trust store

I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and ...
user avatar
  • 1,417
2 votes
1 answer
2k views

How does do client authentication work over https?

I recently wrote an application that calls out to a 3rd party service to perform some work. This 3rd party service requires that I authenticate the client calling by using a client certificate. For ...
user avatar
  • 123
1 vote
2 answers
313 views

Where can I find the specs for the X.509 certificate used in client-authenticated TLS handshake?

The TLS specs define how the handshake between client and server must be performed when the client wants to use a certificate to authenticate itself. There is a lot of documentation onlin that assumes ...
user avatar
1 vote
1 answer
383 views

limit client certificate to domain name

If i want to use client certificates for authentication to a certain part of my website, is it possible to make the client certificate only work on a certain domain name? I know when requesting the ...
user avatar
  • 155
3 votes
2 answers
2k views

Can users read client SSL certificates from a react native mobile apps APK?

I want to secure an API used by a react native app. If an authorisation header is sent, the user can read the request and access data. To avoid this I want to use SSL client certificates. Now if I ...
user avatar
  • 131
1 vote
1 answer
761 views

Impersonating Client Certificate Authentication with Same Subject Name

I am looking into the security of a service which uses client certificates for authenticating only known callers. We run a C# Web API Service that checks every request certificate subject if it is ...
user avatar
4 votes
1 answer
646 views

SSH and man-in-the-middle

Assume the following scenario and please correct me if I am wrong somewhere: There is a client and there is an SSH server that the client connects to. There is also a man-in-the-middle (MIM) which is ...
user avatar
51 votes
2 answers
13k views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...
user avatar
  • 647
2 votes
2 answers
365 views

How secure is this communication chat?

I have created a chat between two parties (using c#), and I am wondering what kind of weaknesses have I overlooked. Description of its functionality: There are two individual applications: Client (2 ...
user avatar
0 votes
1 answer
1k views

Client Server TCP connection - sending a password

I'm new to cybersecurity and am writing a TCP server with the Java Socket API. There is a client and server class. The server class is what would be run on a server, it listens on a specified port and ...
user avatar
3 votes
0 answers
256 views

Does RenegotiateOnce in Go's crypto/tls package protect against triple handshake?

Looking into how to do client cert authentication from the Go HTTP client, I found out I needed renegotiation from the client side and I came across issue 5742 for Go on GitHub, which is the issue ...
user avatar
6 votes
1 answer
7k views

Usage of self-signed certificates for Client authentication

We have a server to server communication scenario, where we would use a CA signed certificate for the TLS server authentication and would like to use a self-signed certificate for the Client ...
user avatar
2 votes
1 answer
5k views

openssl s_server is expecting key and certificate in case of PSK cipher test

I am new to security domain, In case of PSK why openssl s_server is expecting certificate and key. If I don't give then it gives error like below. $ openssl s_server -psk ...
user avatar
  • 147
0 votes
3 answers
460 views

Fuzzing client apps

Is it possible to file fuzz and network fuzz client apps written in C# .Net? The reason I ask is I am not a developer, but I am a security analyst and I have been given the task of file fuzzing the ...
user avatar
1 vote
1 answer
713 views

Storing data encryption key (client side)

I have moderate knowledge of programming , and currently I am writing a client-server messaging application for windows. My project is written from scratch using sockets , and all it does is data ...
user avatar