Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [client-side]

Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

0
votes
1answer
29 views

Generate DEK from password using hashing on client-side

Important to know Will not be passing the DEK from client to the server The DEK will be used to encrypt all the data being placed within a github repository, it is possible that cipher-text will be ...
3
votes
2answers
223 views

Why not store password in cookie?

I've got a novice question - It is often said that you should not store plaintext passwords in a client-side cookie. (I'm imagining a web browser cookie, but I supposed this applies in general.) But ...
0
votes
0answers
17 views

Using client certificate from a file and a key pair from a hardware token

The question is about TLS client authentication using a browser. I have been using a smart card to authenticate to certain web sites. However, the card is a bit old and for whatever reason importing ...
0
votes
0answers
29 views

Clickjacking when essential JavaScript code accesses attribute of 'top'?

Given a website which doesn't use any protection specifically against Clickjacking (no X-Frame-Options or CSP), but which does access an attribute of top in essential JavaScript code, eg: // http://...
0
votes
1answer
42 views

How do JavaScript (and mobile) APIs keep user data clean?

Let's say we're running Google Analytics, and we're tracking user specific data (or displaying contents based on that data, such as most recently viewed pages) -- we add a pixel, and then we pass the ...
0
votes
1answer
60 views

what is the best algorithm for hashing stored users info on client-side on a web app

I have this scenario in a web app which I'm working on its client-side code(I'm building it with ReactJS): I obtain user's info hash 'em send it to the server for being authenticated and when I get ...
0
votes
1answer
47 views

Metasploit: java_signed_applet attack hangs after user response

I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at ...
2
votes
2answers
74 views

What is client side non-DOM XSS?

I've been reading on the new categories of XSS. According to OWASP, they're no longer just reflected, stored and DOM-based XSS, but rather server/client side, and then subdivided into reflected/stored....
1
vote
0answers
55 views

Client Side Encryption - The Last Mile

Is there any best practice on how to handle "the last mile" in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on ...
0
votes
0answers
17 views

Hyper-V keep enhanced session while blocking redirected drives

I'm creating a nested vm user desktop inside Windows 10 Enterprise. I'm using the hyper-v console, not mstsc.exe. The user desktop vm needs to use a headset and microphone which requires Enhanced ...
1
vote
0answers
80 views

Client authentication using certificates in M2M communication

We're planning to implement following scenario for a secure machine-to-machine (M2M) communication network. We have some gateways and a lot of secure sensors which should only be able to "speak" to ...
0
votes
2answers
156 views

Security-wise, is an in-browser JavaScript implementation fundamentally different from a server-side language (e.g. Python) implementation?

As I understand it, JavaScript implementations running in browsers need to run untrusted code and operate on untrusted data in a secure manner. Language (e.g. Python) implementations running on a ...
2
votes
1answer
74 views

Secure Ids in Browser [closed]

We frequently need to send entity ids to the client side. How could we protect this data (especially ids)? Even if we encrypt using same key every time, it can be identified by analysis. For ...
1
vote
1answer
68 views

limit client certificate to domain name

If i want to use client certificates for authentication to a certain part of my website, is it possible to make the client certificate only work on a certain domain name? I know when requesting the ...
1
vote
1answer
625 views

Session ID in the very First Client Hello

Is it normal to have Session ID in the first Client Hello, and then the server picks it up and accepts the same Session ID and uses it in all further TLS traffic. That is the "Client or Browser" tells ...
0
votes
0answers
28 views

Security of password to database in 2-layer SW model

I'm struggling with kinda old application which is written for Windows and has a 2-layer approach, meaning that the client SW is connecting to backend database directly. This of course mean that the ...
1
vote
0answers
228 views

How to make CNG certificates available for mutual authentication in browser?

I have implemented a CNG key storage provider and propagate my certificate according to the answer to this question to the MY store. I can see my certificate there using the MMC console. However, when ...
2
votes
1answer
53 views

What advantages would client-side certificates have over signature based auth such as Oauth2 or HMAC for HTTP Requests?

My application currently supports these two authentications methods OAuth2 and HMAC Auth. OAuth2 https://tools.ietf.org/html/rfc6749 HMAC https://tools.ietf.org/html/draft-cavage-http-signatures-09 ...
1
vote
2answers
142 views

What is the best practice for encrypting and storing temp data on client?

I have a client-server system, where the client is an Android app. The client and the server communicate over HTTP. If the server/network is not available, then the client has to store the data ...
0
votes
1answer
206 views

Does client side hashing add any benefit here?

My situation is this: User credentials are stored on the server, bcrypt, random hashes. I'm designing a REST API, so I'd like to keep this as stateless as possible! The client is an Android/iPhone ...
3
votes
2answers
1k views

What exactly is client-side encryption?

I've done a bit of research on client-side encryption, I've looked on Wikipedia and various other sources, I was just curious, however, if you had a network administrator watching over all traffic, ...
1
vote
3answers
419 views

Benefits to client-side password hashing on top of other security mechanisms [duplicate]

We live in a world where password reuse is common and most of the internet users are not using password managers, while hacks and breaches are becoming more common. The importance of those breaches ...
46
votes
3answers
10k views

Are virtual keyboards not necessary anymore to protect against keyloggers?

My bank has issued a new version of their online banking site. This new version has no virtual keyboard to enter the PIN. I asked them how are they protecting me against keyloggers but I didn't ...
4
votes
1answer
2k views

Hash, salt and best practices [duplicate]

Reading about hashing, salt and pepper, I can't get my head around the following scenario: If there's a web application and you register on that site, should the password be hashed on the client or ...
1
vote
0answers
49 views

Mutual auth client certs for a pool of requesting servers behind a proxy

I've got a situation that is puzzling me. We have a vendor that is requiring mutual authentication when making a request to them. They are requesting we give them a client cert identifying our ...
1
vote
0answers
110 views

How Secure Would Client Side Sha-512 Be In JavaScript

I've created an Capture The Flag challenge for me and a few of my mates, and for the final challenge, you're goal is to log in as admin to a site. Now the site doesn't use any server side languages (...
1
vote
1answer
2k views

Cookie vs HTML5 localStorage

On HTML5, we can use localStorage to keep data persistently on client side. It seems better from a non-security point of view (easy to access, not 5mb limit like cookies, etc). https://www.w3schools....
0
votes
1answer
149 views

API security where the server is also client-side

I have a desktop application which creates and stores a fair amount of data (mostly on its own, not through traditional user input); mostly statistical in nature. Currently the data is mostly ...
1
vote
2answers
296 views

Should a server or a client be able to verify a client/server certificate - intermediate certificate chain with a known root ca?

I am trying to test the following setup: A RADIUS server works with the EAP-TLS protocol. The client and the server have the following certificates: Client Public Key: ...
2
votes
0answers
85 views

How to securely manage generating files on the client-side to download

While searching for a way to convert an HTML table to .CSV file, I found there are 2 ways to generate files to download on the client side with JavaScript: using data URLs by generating the file on ...
0
votes
1answer
108 views

Potential risks of allowing custom javascript

I'm planning a tool that will allow users to publish collections of their writing for publish consumption. Any modification of content or account settings will be done through a secure management / ...
1
vote
1answer
336 views

What are the risks associated with a vulnerable javascript in a client context?

Background: it is not difficult to introduce vulnerabilities in backend/API code when not coding with security in mind. This typically leads to vulnerabilities such as XSS or various injections (or ...
0
votes
1answer
520 views

How can I store user contacts (address book) with zero knowledge?

I want to provide a user with remote contact list (address book) that they can access and update from arbitrary clients on multiple devices. But I want to have zero knowledge of those contacts. ...
0
votes
0answers
74 views

Server security in open source projects

I have a question about open source, multi-user projects. Let's say that you have an open source project, you also have a server on the internet, you distribute clients to the users, these client ...
2
votes
3answers
123 views

What to do about compromised passwords through malicious sites or site hacks [duplicate]

So my question or hypothesis is that: most people use only a few passwords for all online services, getting one of these passwords means you could access that person's sites easily which don't have ...
2
votes
1answer
195 views

Client security using UDP

Introduction I am currently trying to build up a networking layer for Unity from scratch. Currently I am testing the communication via UDP using Node.js for the server and the client. However I guess ...
1
vote
2answers
91 views

How to determine if software on many client machines is up to date? [closed]

I have to take care of 200+ client machines (mainly Windows 8,8.1, 10) in an organization. There are many apps installed: web browsers, Java, Flash & many more. Are there any tools/techniques to ...
1
vote
2answers
148 views

Can storing a secret in the client be considered “good enough” security?

I have spent the better part of 2 weeks looking at a solution to secure my game. It's a game for Android/iOS that has its own server/database. So far, the only security I have is salt+hash passwords....
0
votes
0answers
47 views

Deny/Identify compromised machine sending information to a server?

i was wondering - consider i have 2 machines - client and server. the Client is opened to the internet, and sends very sensitive data to the server. If fake data will be sent to the server and is ...
0
votes
2answers
2k views

Does exposing a session ID create security risks?

I'm looking to make a cross-domain + single app login, since you can't store cookies on other domains from one website, I'm using img tags with a href link to each website (eg: example.com/...
39
votes
6answers
11k views

Sending a client-side high-score to a server securely [duplicate]

I'm creating an web-application that has a simple javascript game in it. Once the player finished playing the game the high-score is sent to the server and saved. After a specific period the player ...
2
votes
0answers
101 views

Key Management and Authentication in Note Taking App with Client-Side Encryption

I've been working for some time on a pet project of mine: a note-taking application similar to Evernote with the difference that all content is client-side encrypted. I would like to get some feedback ...
4
votes
2answers
6k views

Best practice for storing auth token client side

I'm building a frontend/backend separated system where the user 2FA auths in and gets a JWT back to the client side. I'm using angular and for now I just store that token in $window.sessionStorage ...
1
vote
1answer
77 views

Would client side hashing provide security from a comprised server [duplicate]

I've been reading about hashing and encryption so I can make more informed decisions. I already know the benefits of ssl and password hashing serverside as best practises. However I was wondering, ...
1
vote
1answer
129 views

Client Side Encryption algorithm: security + is padding algorithm needed in this case?

I will be using CSE for a web application as follows. Generate a random AES key Encrypt the cleartext data with this AES key Encrypt the AES key with the service's public key, using RSA Obviously, ...
3
votes
2answers
82 views

Did any VT100 derivatives rely on client-side security?

VT100 terminals are "dumb terminals" - they just display data from the server, and send key strokes, with no local processing. In this setup, there can be server-side application flaws, and the ...
0
votes
2answers
72 views

Secure website with unique machine certificate

Is it possible to allow access to a website only for specific clients on specific machines? I'm no security expert, but one idea I had is to generate a certificate that would work only on a specific ...
1
vote
2answers
137 views

OWASP ASVS asking for client-side validation?

While perusing ASVS 3.0.1 I came across requirement V5.18: Verify that client side validation is used as a second line of defense, in addition to server side validation. Umm... is client-side ...
1
vote
1answer
259 views

Inject custom markup via vanilla JS without increasing risk of client-side XSS? [duplicate]

The world of business-to-business enterprise software has always required a high level of custom per-client markup associated with branding and customization. In a SPA that generally means injecting ...
4
votes
0answers
193 views

Logging error details in a (desktop) client application

I have a debate about how to properly log errors for the client part (Java Swing) of a client-server application from a security point of view. I think it is common sense that exposing error details ...