In a client-server model, the server serves services to the client.
20
votes
1answer
2k views
Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?
After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate.
Why would any non-malicious web site do that unless I've ...
1
vote
1answer
45 views
Client authentication flaw in old Netscape SSL protocol
Below is a screenshot from the paper "Prudent Engineering Practice for Cryptographic Protocols" by Martin Abadi and Roger Needham. I can't see what's wrong with the protocol and what the fix achieves. ...
1
vote
1answer
44 views
Using client certificates for website authentication
I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
0
votes
1answer
24 views
What are the risks of connecting via VNC to an untrusted host?
There are questions about connecting to an untrusted host via SSH [1] [2], RDP, and with X11 forwarding enabled.
What about when connecting via VNC? What risks are there to the client?
To be clear: ...
0
votes
1answer
441 views
iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates)
As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2.
...
0
votes
1answer
87 views
Transmission of messages
I am currently developing a game which will be run in a client, they will sign up for this game online and create their account there, their information will be stored into a MySQL database. I am ...
3
votes
3answers
568 views
Revoke a certificate without index.txt
I generate self-signed client certificates for a little Apache server hosted under my stairs. The script below was hacked together for this purpose - note it uses the 'mini-CA' x509 method, therefore ...
1
vote
2answers
168 views
How to uniquely identify / tag client devices to whitelist VPN access?
I'm just wondering if there is any way to uniquely identify or tag client devices like laptops and towers in order to whitelist them for vpn access.
(Note: This is a thought-experiment at the moment, ...
2
votes
2answers
210 views
Web Service Security Checklist - Tracing and Debugging
I have been reading this security checklist about web service design:
http://msdn.microsoft.com/en-us/library/ff648304.aspx
One of the suggestions is that you should disable the following in ...
2
votes
2answers
145 views
SSL/TLS Client Authentication by IP
Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example:
There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
4
votes
2answers
2k views
Certificate Chain checking
I have a very specific question.
A client verifies a sever by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (According to the ...
35
votes
5answers
2k views
Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?
I've been worried about this password manager, PasswordBox that seems to be gathering quite a bit of steam lately.
They seem to have raised VC funding and are offering a free password management and ...
1
vote
2answers
359 views
SSL: How to send generated client certificate from server to avoid MITM?
The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
-1
votes
2answers
285 views
Generate openSSL certificates from within C code using commands?
This is an openSSL command for generating a private key and a certificate,
openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key
The question I have is whether there is some ...
6
votes
1answer
2k views
SSL Cert Types and Key Usage
I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
6
votes
2answers
305 views
Client authentication vs. user authentication
I am currently looking into authentication protocols which work well with REST API, in java.
There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
1
vote
0answers
201 views
Fuzz a client with sulley [closed]
I want sulley to bind to an interface, wait for a connection and fuzz the reply to the client. How can I act as a server with sulley to fuzz a client ?
1
vote
1answer
127 views
Client vs Server security for business critical application (crossplatform)
We have the option to develop a software either based on
Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
0
votes
2answers
378 views
Keeping the password secret over regular http
I would like to at first be clear that this is for poor site owners who can't afford the SSL option but require logins to their site, potentially from a public kiosk, and need a secure method of ...
10
votes
5answers
2k views
Is it worth the effort to store FTP passwords encrypted?
I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
