Questions tagged [client]
In a client-server model, the server serves services to the client.
1
vote
1answer
81 views
Why is PKCE secure against man-in-the-middle attacks?
In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
0
votes
0answers
7 views
Any limitaion of clnt_call() in RPC communication?
I have a RPC server and RPC client. Am generating a secure key on client side using TPM1.2 chip. When i run my program for few times everything works fine. But When i run for many times then key is ...
1
vote
0answers
34 views
Verifying the authenticity of data coming to a server
I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text.
I have an express server and two android apps(for clients and admin)....
0
votes
2answers
149 views
How to Verify Integrity of Transferred Files in a Client Server Protocol
How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps:
The client ...
1
vote
1answer
51 views
How to authenticate a specific client program? [duplicate]
I have a server application which provides functions to a client program. The client is also programmed by me. Now I want to authenticate the client program itself (not any user) before using my ...
2
votes
4answers
113 views
Prove a client sent a request - voting system
Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP.
Is ...
1
vote
1answer
1k views
Client certificate common name? Subject alternative name?
For an IoT project, I want to secure client server communication. I want both the server (Apache) and the clients identify/authenticate each other (a client won't communicate with other clients) ...
0
votes
1answer
246 views
Root CA or Intermediate CA in firewall trust store
I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and ...
1
vote
1answer
363 views
How does do client authentication work over https?
I recently wrote an application that calls out to a 3rd party service to perform some work. This 3rd party service requires that I authenticate the client calling by using a client certificate. For ...
1
vote
2answers
108 views
Where can I find the specs for the X.509 certificate used in client-authenticated TLS handshake?
The TLS specs define how the handshake between client and server must be performed when the client wants to use a certificate to authenticate itself. There is a lot of documentation onlin that assumes ...
1
vote
1answer
73 views
limit client certificate to domain name
If i want to use client certificates for authentication to a certain part of my website, is it possible to make the client certificate only work on a certain domain name?
I know when requesting the ...
0
votes
0answers
271 views
Certificate based authentication using the windows computer certificate store
My question is based on an assumption:
Creating a certificate with a non-exportable private key in the windows store is more secure than creating a private key and certificate and then importing both ...
0
votes
0answers
26 views
How to improve the authorization and client-server interaction scheme?
I'm creating a Qt-server which uses SSL via TCP. Clients can authorize themselves on the server using login and password and become users. Only users can perform any actions with their accounts. ...
0
votes
0answers
525 views
No client cert sent with 2way SSL - Tomcat configuration
I'm trying to setup a client authentication (for mutual authentication) between 2 tomcats but at this point, I'm stuck with the thought that my client doesn't send its certificate. I have a private CA ...
2
votes
2answers
1k views
Can users read client SSL certificates from a react native mobile apps APK?
I want to secure an API used by a react native app. If an authorisation header is sent, the user can read the request and access data. To avoid this I want to use SSL client certificates.
Now if I ...
1
vote
1answer
335 views
Impersonating Client Certificate Authentication with Same Subject Name
I am looking into the security of a service which uses client certificates for authenticating only known callers. We run a C# Web API Service that checks every request certificate subject if it is ...
4
votes
1answer
234 views
SSH and man-in-the-middle
Assume the following scenario and please correct me if I am wrong somewhere:
There is a client and there is an SSH server that the client connects to. There is also a man-in-the-middle (MIM) which is ...
14
votes
2answers
2k views
What is PKCE actually protecting?
I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand.
So from what I can gather the client app creates a random cryptographically secure ...
2
votes
2answers
232 views
How secure is this communication chat?
I have created a chat between two parties (using c#), and I am wondering what kind of weaknesses have I overlooked.
Description of its functionality:
There are two individual applications: Client (2 ...
0
votes
1answer
424 views
Client Server TCP connection - sending a password
I'm new to cybersecurity and am writing a TCP server with the Java Socket API. There is a client and server class. The server class is what would be run on a server, it listens on a specified port and ...
3
votes
0answers
86 views
Does RenegotiateOnce in Go's crypto/tls package protect against triple handshake?
Looking into how to do client cert authentication from the Go HTTP client, I found out I needed renegotiation from the client side and I came across issue 5742 for Go on GitHub, which is the issue ...
4
votes
1answer
3k views
Usage of self-signed certificates for Client authentication
We have a server to server communication scenario, where we would use a CA signed certificate for the TLS server authentication and would like to use a self-signed certificate for the Client ...
2
votes
1answer
2k views
openssl s_server is expecting key and certificate in case of PSK cipher test
I am new to security domain,
In case of PSK why openssl s_server is expecting certificate and key. If I don't give then it gives error like below.
$ openssl s_server -psk ...
0
votes
3answers
241 views
Fuzzing client apps
Is it possible to file fuzz and network fuzz client apps written in C# .Net? The reason I ask is I am not a developer, but I am a security analyst and I have been given the task of file fuzzing the ...
1
vote
1answer
390 views
Storing data encryption key (client side)
I have moderate knowledge of programming , and currently I am writing a client-server messaging application for windows. My project is written from scratch using sockets , and all it does is data ...
0
votes
1answer
369 views
What security settings is Yahoo Mail looking for to consider IMAP client secure?
When setting up an IMAP client for Yahoo Mail, Yahoo requires the "Allow apps that use less secure signin" option to be enabled.
The client is configured to use SSL for IMAP (and SMTP).
What ...
4
votes
2answers
335 views
Better safety: Webmail or POP3/IMAP clent?
Which offers a higher level of safety: Webmail or using a POP3/IMAP client?
Assume the following for webmail:
Access via HTTPS
Rarely downloading any attachments, but in cases where it may be ...
4
votes
1answer
134 views
Who is the Gate Keeper?
If using Basic security under an SSL connection (https), is is not true that the server matches the user/password combination, but what happens after that? What prevents the browser from accessing the ...
0
votes
2answers
28 views
Change Server IP used by Executeable [Client-Server Authentication]
for Authentication of my Executeable i use a TCP Server Module running on a VPS my Client(Executeable) connects to. Therefor i have to have the IP of the VPS inside the Executeable. I have two major ...
0
votes
0answers
74 views
Server security in open source projects
I have a question about open source, multi-user projects.
Let's say that you have an open source project, you also have a server on the internet, you distribute clients to the users, these client ...
1
vote
1answer
772 views
Hooking Windows SSL libraries
What libraries does Windows use to send ssl traffic? The ws2_32.dll has the tcp send function, but the traffic is encrypted before it reaches that function.
I'm looking to reach the code where the ...
1
vote
2answers
3k views
Create client certificates using signed certificate
We have a proper signed server certificate and intermediate CA from a trusted certificate authority.
Is it true that we cannot use this certificate (so the intermediate CA) for creating our own ...
0
votes
1answer
60 views
Client certification authentication as an option for securing a device to allow access
I am working on a commercial device (custom hardware with firmware and embedded software) that includes a Linux OS and will run in an unsecured network environment connected via Ethernet. It will be ...
1
vote
2answers
62 views
What kind of certificate to be used to consume web services?
I have my own application. My client wants me to use their web service. This web service sends some data to my database. For this, my client wants a certificate from me. In this scenario, what kind of ...
0
votes
1answer
54 views
Server->Client distribution security
Apologies in advance if this is the wrong SE site for this topic, though it should be a fairly appropriate match.
I am building a video game where one of the features available to users will be ...
0
votes
1answer
1k views
SSL Certificate pinning with Self Signed Certificates
I am trying to understand how Certificate Pinning works with Self Signed Certificates. My idea is that a Server with a Self Signed certificate will accept the connections only from the clients that ...
0
votes
1answer
292 views
Apache: Can I revoke certain client certificate on certain subdomain only
I would like to know if we can make the client certificate valid for certain sub domain (Virtual Host). For example if I have two client certificate A, B.
A is valid for subdomainX but not for ...
1
vote
0answers
1k views
Performing denial of service attack using Python [closed]
I am a student so please don't be rude for I miss something and this project is for research purpose only.
I am willing to perform a denial of service attack(on my own servers) I am not willing to do ...
1
vote
1answer
1k views
Client initiated cookie Vs Server initiated cookie [closed]
I'm finding similar comments and articles around client side cookies that they are initiated by client and store everything on the client side and server does not store anything. On the other hand ...
4
votes
1answer
190 views
What should I exchange with the server when I generate my AES 256 key?
I'm creating a mobile fast-paced game and currenly I'm working on login/registration/connecting. I'm trying to make it right so it won't mess in the future.
For now, I have read multiple articles of ...
5
votes
2answers
4k views
How does a server validate the Certificate Verify message in SSL/TLS?
Client authentication may be used in a SSL/TLS negotiation.
For this, the client will send a Certificate Verify Message after the server requested it.
The Certificate Verify Message contains the ...
0
votes
2answers
72 views
Secure website with unique machine certificate
Is it possible to allow access to a website only for specific clients on specific machines?
I'm no security expert, but one idea I had is to generate a certificate that would work only on a specific ...
1
vote
0answers
538 views
Simple Reverse-Shell-Script in java? [closed]
i have a simple script (written in C) and it connects back to a netcat server to open a shell, there, so a really simple reverse shell script. How to do the same in java?
#include <stdlib.h>
#...
4
votes
3answers
589 views
Server client verification
When writing a server sofware, what are the methods used to verificate the user connected to the server is actually using the official client program ?
This is to prevent the access to the server ...
0
votes
2answers
109 views
session credentials on the client
I am developing an IE11 based application running on a web server inside our corporate network
The application makes calls to a 3rd party API which requires client certificates and username/password ...
2
votes
2answers
84 views
Testing non‐browser‐based https clients for Poodle
I have a command line tool that can download any URLs likewget (only for vcs systems) but not it’s source code, how can I test if it is vulnerable to POODLE?
There are lot of online automated tools ...
2
votes
0answers
36 views
Distributed Shared Secret for RNG that only Distributor knows?
For one of my projects I want to create a way to sync up all participants' RNG with a seed where each participant does not know the seed of the RNG but also in a way that minimizes the number of times ...
0
votes
2answers
698 views
Securing Internal Mobile REST API
I am planning to create an internal API for mobile devices for a company.
They are planning to use this internal mobile app to get data from custom ERP, uploading contract, etc. Thus, it will be ...
8
votes
5answers
6k views
How To Prove That Client Side Javascript Is Secure?
Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client.
The normal process for a user using this web application is ...
1
vote
1answer
468 views
Mutual SSL - Using Public CA for Client Auth CSR signing
I have been reading a lot of articles regarding Mutual SSL, Two-Way Authentication or Client Authentication and I have a general enquiry which may have been answered in content that I've read but if ...
