Questions tagged [client-side]

Client-side refers to operations that are performed by the client in a client–server relationship in a computer network.

Filter by
Sorted by
Tagged with
2
votes
1answer
88 views

Would client side hashing provide security from a comprised server [duplicate]

I've been reading about hashing and encryption so I can make more informed decisions. I already know the benefits of ssl and password hashing serverside as best practises. However I was wondering, ...
1
vote
1answer
146 views

Client Side Encryption algorithm: security + is padding algorithm needed in this case?

I will be using CSE for a web application as follows. Generate a random AES key Encrypt the cleartext data with this AES key Encrypt the AES key with the service's public key, using RSA Obviously, ...
3
votes
2answers
90 views

Did any VT100 derivatives rely on client-side security?

VT100 terminals are "dumb terminals" - they just display data from the server, and send key strokes, with no local processing. In this setup, there can be server-side application flaws, and the ...
0
votes
2answers
73 views

Secure website with unique machine certificate

Is it possible to allow access to a website only for specific clients on specific machines? I'm no security expert, but one idea I had is to generate a certificate that would work only on a specific ...
1
vote
2answers
149 views

OWASP ASVS asking for client-side validation?

While perusing ASVS 3.0.1 I came across requirement V5.18: Verify that client side validation is used as a second line of defense, in addition to server side validation. Umm... is client-side ...
1
vote
1answer
309 views

Inject custom markup via vanilla JS without increasing risk of client-side XSS? [duplicate]

The world of business-to-business enterprise software has always required a high level of custom per-client markup associated with branding and customization. In a SPA that generally means injecting ...
4
votes
1answer
217 views

Logging error details in a (desktop) client application

I have a debate about how to properly log errors for the client part (Java Swing) of a client-server application from a security point of view. I think it is common sense that exposing error details ...
6
votes
2answers
5k views

Secure OAuth 2 flow for client-side or mobile app

I'm implementing an API and a client-side web app, and they are supposed to communicate via an API and use OAuth 2 for authentication. I can't get over my confusion on what's the right way to ...
4
votes
3answers
661 views

Server client verification

When writing a server sofware, what are the methods used to verificate the user connected to the server is actually using the official client program ? This is to prevent the access to the server ...
0
votes
2answers
481 views

Hashing sensitive data in request [duplicate]

We have set the https connection, between the client and server. The problem is that security guys, showed us it is possible to intercept the data using rogue invalid certificate (user must accept it ...
0
votes
1answer
1k views

Which WYSIWYG editor has the best security reputation? [closed]

I would like to use a pre-built WYSIWYG editor such as TinyMCE or CKEditor in a website that I'm building. Since I expect my users to be entering confidential information into the editor it is ...
-3
votes
4answers
540 views

Which cryptographic algorithm should be used on client side to encrypt file before uploading to a cloud which is only for storing purpose?

I want to develop a website which will take the files from my computer encrypt it with my key and upload it on cloud which is only for storage purpose and decrypt it after downloading it on my ...
1
vote
2answers
2k views

Access to raw html source code after angular client side processing

I need help to check if parameters are sensitive to XSS injections in a webpage generated by angularjs. Today, many websites are using angularjs in order to deport client page construction at the ...
3
votes
1answer
5k views

How secure is HTML5 web storage (sessionStorage and localStorage)?

I'm thinking of using either sessionStorage or localStorage to store some important user data. The extension's functionality will only work in the context of a particular website that defaults to ...
2
votes
2answers
498 views

I want to encrypt certain entries in a database. Is this a good plan?

I'm working on a web app and want to offer the users the option to "encrypt" their account. This wouldn't encrypt everything related to them in the database. Just certain critical fields. I've ...
-4
votes
1answer
273 views

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. However, I implemented jsencrypt [A Javascript library to perform OpenSSL RSA Encryption, ...
2
votes
2answers
136 views

How do I know that malware on the client computer does not modify data transmitted to my webapp?

I am working on a web application and have had an idea of a new feature I would like to add. The feature includes getting data from the user on their open system and receiving it on my server. For the ...
4
votes
0answers
1k views

How exactly does “Apache Shiro's” hashing work when using a Desktop-Client

I was looking at this question How does storing hash passwords work? and every answer essentially says that Hashing is done via the server, or most of it should, as that is the safest way to do it. ...
1
vote
3answers
76 views

Is there an added benefit to authentication within a part of an application, after authenticated into the main application?

Essentially I have a application that is 2 parts. One part is on the user's machine, which will upload files to my server, and the other part is a web application that works with those files. ...
3
votes
1answer
4k views

Client-side encryption using public-key

My situation: Login password from a POST request is left in browser memory in clear text as long as cache is not cleared (manually/closing browser). Connection is HTTPS. Possible Solution: Generate ...
4
votes
1answer
91 views

REST and confidential state - the trusted client problem etc?

With REST client sessions are not handled by maintaining server side state. Any such state needed for subsequent calls is passed to the client and then passed back to the server as part of those calls....
3
votes
0answers
186 views

How to remember the trusted machine in an application

We need to remember trusted devices in our application. I have done some R&D for this and found out that Facebook achieves this using cookies. But, if I see Google, they don't use cookies, I guess....
9
votes
5answers
6k views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
0
votes
1answer
118 views

Decrypting packets sent from a server to a client, how to figure out the key, having both decoded packets and encoded packets

I have written a packet sniffer which succesfully intercepts all the packets sent from a server to my computer. The problem is that the packets are encrypted(of course) and i need to decrypt them. An ...
25
votes
7answers
6k views

Is it possible to modify your user agent http header for malicious use?

The Google crawl bot uses the user agent "Googlebot", and I am wondering if this knowledge can be used maliciously. Let's say in a random website, the Googlebot user agent is allowed to access an ...
36
votes
9answers
13k views

If “you can never trust the client”, then why do companies such as Valve rely solely on client-side verification?

In video games, most anticheat software is run clientside (e.g. PunkBuster or Valve Anti-Cheat)- but isn't one of the first rules of security to never trust the client? If so, then why do these ...
3
votes
1answer
202 views

How Vulnerable Is An Older Version Of Outlook As An Email Application?

I am significantly displeased with some of the newer versions of Microsoft Outlook. I would prefer to continue using my older version from Office 2000 (on Windows 7 using workarounds). As a networked ...
3
votes
3answers
150 views

Is it possible to modify jQuery client code to call a remote API in an unintended way?

Is it possible for someone to modify the JQuery code of a remote page and make it call the remote APIs in a different way than intended? Suppose the website www.domain.com has a jquery.js script ...
1
vote
0answers
126 views

Web Scraper with client-side certs [closed]

I am building a web scraper that logs into websites, does some searches and collects results. The websites I've been logging into right now have all been pretty standard. I have been notified that ...
3
votes
1answer
501 views

Licensing system for client side code web application

I have a client-side web application running on SharePoint Site Collection, each site collection has it's own unique id. I want to use a licensing process to lock the app to a site collection. This ...
2
votes
1answer
254 views

Where to store IV and salt when doing clientside encryption with no server

I'm making a chrome app that does client side encryption of user messages. There is no server in my architecture. The encrypted text messages are saved as files in the user's Google Drive. I'm using ...
2
votes
1answer
1k views

Is the Framekiller really safe against clickjacking?

I am using this code. In the header section of the page, this CSS rule: html{display:none;} And then this javascript: if (self == top) document.documentElement.style.display = 'block'; else top....
2
votes
0answers
189 views

Safe to Encrypt ClientId (Integer value) to use as Client Key?

Asked a follow up question (see this link). Based on my understanding, I have to issue an unique ClientId and Client Secret Key to the API subscribers right after the registration phase (client lives ...
1
vote
2answers
51 views

Rembering password on client (not database) [closed]

I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again. Is there a secure way for my program to store this?...
6
votes
5answers
898 views

Don't trust the client?

I am a web developer, and have been trying to learn a bit about security, and the thing that seems to be the biggest principal is just to trust the client with as little as possible. Is this a correct ...
2
votes
1answer
102 views

Communicate through gpg

I need to frequently communicate with a server in the manner do stuff related to x or send me info of x My thoughts are to directly put the task I want to be executed into the package I want to send, ...
3
votes
2answers
547 views

Can an eavesdropper detect the use of a TLS client-side certificate?

Basically what the above says, assuming the eavesdropper must be completely passive, and cannot connect to the server to check if the server requires a client certificate.
1
vote
2answers
382 views

Several hashing routines support client side work. Doesn't the hash just become a password equivalent?

Isnt Secure Remote Password Protocol (SRP) pretty much client side hashing? Argon2 the winner of the PHC also allows for client side hashing. How do these systems avoid the plaintext equivalence ...
13
votes
3answers
450 views

Can client-side hashing improve after-the-fact security in response to password leaks?

Several questions on this site address client-side password hashing, and none of them admit to any security benefit beyond protecting other sites the user might use the same password for. However, ...
3
votes
2answers
677 views

Ways around browser xss detection

Most modern browsers will detect xss attempts (script code in the URL) and prevent execution. Are there any known standard ways around this or are xss attacks pretty much impossible now?
18
votes
5answers
41k views

How to do client side hashing of password using BCrypt? [duplicate]

I am migrating an old application which used MD5 hashing to Spring Security with BCrypt encoding of passwords. I want to encode the password on new user creation page, change password page and on ...
1
vote
2answers
136 views

Methods to keep an autonomous log with high integrity

I'm writing a .NET desktop application that is used to send orders to a server via a REST API. To avoid leaking of our authentication token I have made it so that, when used for the first time, the ...
1
vote
3answers
539 views

What are the disadvantages of combining client-side and server-side authentication security?

Imagine situation: Application might or might not be run via SSL/TLS Application should not know password of the client because client might reuse passwords Wouldn't then combined client-side and ...
1
vote
0answers
93 views

Possible vulnerabilities in private chat application implemented using web broadcasting

I have never used web-sockets but I am working in a PHP framework which has builtin broadcasting facility. This broadcasting use web-sockets technologies named Redis and Pusher. The workflow of this ...
0
votes
2answers
308 views

Is browser side encryption realistically secure?

I have a web app I'm hoping to write where a selection of files are zipped and encrypted in the browser before being uploaded to my server. I have a prototype of the system and it's working great. I ...
1
vote
3answers
420 views

Is it possible for an attacker to redirect a packet sent by a client, modify it then sent to original server

Theoretical question: Is it possible, or will it ever be possible, for an attacker to sniff/intercept it and redirect a packet, sent from a client through wireless, modify it and then sent to the ...
1
vote
1answer
175 views

Security concerns of browser injected JS

To employ end-to-end encryption, I am using a small tool that encrypts contents that is then posted and stored on our servers. While there are several concerns on client based encryption, I think it ...
3
votes
1answer
479 views

Are WoSign S/MIME certificates generated on the server side and therefore unsafe to use?

WoSign has been in the media for offering free server and client certificates. Since one of my (free) S/MIME certificate from another CA is about to expire soon after one year and WoSign offers ...
1
vote
2answers
822 views

Storing unencrypted, confidential data in client memory

I am currently working on a service which lets users store client-side encrypted data and access it anywhere. The client connects through a browser and the webapp is written in JavaScript. To easier ...
8
votes
1answer
2k views

Asymmetric / end to end encryption for web messaging app

Background I'm trying to design a secure and sustainable web app for messaging. The purpose is to learn how to create secure web application. The application is suppose to be written in Javascript ...