The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [client]

In a client-server model, the server serves services to the client.

Filter by
Sorted by
Tagged with
0
votes
1answer
66 views

SSL Handshake problems

I captured my network traffic to a web server and the SSL Handshake consists only of two packets. Why does that happen and why aren't there all the other packets?
22
votes
8answers
6k views

How can I re-use my password and still protect the password if it is exposed from one source?

I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
0
votes
0answers
26 views

Is using an outdated eLux Thin Client for RDP access over VPN posing a security risk?

This is the situation: There is a Windows Server 2012 R2 RDP server at the main office. A worker in another city needs RDP access that should be isolated from his local network. Concept of solution: ...
8
votes
2answers
6k views

How does a server validate the Certificate Verify message in SSL/TLS?

Client authentication may be used in a SSL/TLS negotiation. For this, the client will send a Certificate Verify Message after the server requested it. The Certificate Verify Message contains the ...
3
votes
3answers
10k views

How to troubleshoot “client certificate” related errors in 2 way HTTPS

I have a webserver which is asking for client certificate for mutual authentication. I have what I think is the right certificate loaded into my client browser. However, the browser is not able to ...
13
votes
3answers
3k views

How to perform Login Authentication at the client-side? [closed]

How can we validate login credentials at the client-side itself without involving the server of a website?
9
votes
5answers
7k views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
0
votes
1answer
74 views

Client-only authentication instead of server-only authentication, using OpenSSL [duplicate]

First, some background: I've got a C++-based client/server system that uses the OpenSSL C library to encrypt the client/server connections. This is done in (what I believe is) the canonical OpenSSL ...
0
votes
1answer
138 views

Ways to verify Data Integrity

I've had looks to existing subjects but it usually gets heavily complicated while I'm new to this kind of stuff and I'd prefer to understand concepts first in order to understand better concrete ...
2
votes
1answer
39 views

Is it possible to setup 1-way TLS client authentication without server certificates?

Is it possible with TLS to only authenticate the client? In other words can one-way TLS be setup in such a way that only the host initiating the connection uses a client certificate and the second ...
21
votes
2answers
4k views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...
0
votes
0answers
50 views

How can a server make sure client application sending data is not a modified copy?

I actually wouldn't care about a perfect copy (my program is free)being used, I just can't allow someone to use a copy to communicate with my server. I came accross this subject where the OP seemed ...
0
votes
2answers
70 views

How to keep track of file authenticity while offline

I have an application running the client/server model and offering an online and an offline mode. Each user can read, create or modify text files (even in offline mode) that will be present on his ...
21
votes
5answers
4k views

Alternatives to HTML's deprecated <keygen> for client certs?

The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but that'...
1
vote
1answer
249 views

Why is PKCE secure against man-in-the-middle attacks?

In attempting to implement OAuth2 into a natively installed client application, we face the problem that we cannot securely store the pre-shared client secret. After doing some research, I came across ...
0
votes
0answers
14 views

Any limitaion of clnt_call() in RPC communication?

I have a RPC server and RPC client. Am generating a secure key on client side using TPM1.2 chip. When i run my program for few times everything works fine. But When i run for many times then key is ...
1
vote
0answers
83 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
0
votes
2answers
486 views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
4
votes
1answer
344 views

SSH and man-in-the-middle

Assume the following scenario and please correct me if I am wrong somewhere: There is a client and there is an SSH server that the client connects to. There is also a man-in-the-middle (MIM) which is ...
2
votes
4answers
117 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
1
vote
1answer
61 views

How to authenticate a specific client program? [duplicate]

I have a server application which provides functions to a client program. The client is also programmed by me. Now I want to authenticate the client program itself (not any user) before using my ...
4
votes
1answer
3k views

Client certificate common name? Subject alternative name?

For an IoT project, I want to secure client server communication. I want both the server (Apache) and the clients identify/authenticate each other (a client won't communicate with other clients) ...
0
votes
1answer
627 views

Root CA or Intermediate CA in firewall trust store

I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and ...
1
vote
1answer
802 views

How does do client authentication work over https?

I recently wrote an application that calls out to a 3rd party service to perform some work. This 3rd party service requires that I authenticate the client calling by using a client certificate. For ...
1
vote
2answers
167 views

Where can I find the specs for the X.509 certificate used in client-authenticated TLS handshake?

The TLS specs define how the handshake between client and server must be performed when the client wants to use a certificate to authenticate itself. There is a lot of documentation onlin that assumes ...
1
vote
1answer
98 views

limit client certificate to domain name

If i want to use client certificates for authentication to a certain part of my website, is it possible to make the client certificate only work on a certain domain name? I know when requesting the ...
8
votes
3answers
14k views

Certificate Chain checking

I have a very specific question. A client verifies a server by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (according to the ...
2
votes
2answers
243 views

How secure is this communication chat?

I have created a chat between two parties (using c#), and I am wondering what kind of weaknesses have I overlooked. Description of its functionality: There are two individual applications: Client (2 ...
3
votes
2answers
2k views

Can users read client SSL certificates from a react native mobile apps APK?

I want to secure an API used by a react native app. If an authorisation header is sent, the user can read the request and access data. To avoid this I want to use SSL client certificates. Now if I ...
1
vote
1answer
404 views

Impersonating Client Certificate Authentication with Same Subject Name

I am looking into the security of a service which uses client certificates for authenticating only known callers. We run a C# Web API Service that checks every request certificate subject if it is ...
0
votes
1answer
507 views

Client Server TCP connection - sending a password

I'm new to cybersecurity and am writing a TCP server with the Java Socket API. There is a client and server class. The server class is what would be run on a server, it listens on a specified port and ...
3
votes
0answers
127 views

Does RenegotiateOnce in Go's crypto/tls package protect against triple handshake?

Looking into how to do client cert authentication from the Go HTTP client, I found out I needed renegotiation from the client side and I came across issue 5742 for Go on GitHub, which is the issue ...
5
votes
1answer
4k views

Usage of self-signed certificates for Client authentication

We have a server to server communication scenario, where we would use a CA signed certificate for the TLS server authentication and would like to use a self-signed certificate for the Client ...
0
votes
3answers
288 views

Fuzzing client apps

Is it possible to file fuzz and network fuzz client apps written in C# .Net? The reason I ask is I am not a developer, but I am a security analyst and I have been given the task of file fuzzing the ...
2
votes
1answer
3k views

openssl s_server is expecting key and certificate in case of PSK cipher test

I am new to security domain, In case of PSK why openssl s_server is expecting certificate and key. If I don't give then it gives error like below. $ openssl s_server -psk ...
1
vote
1answer
474 views

Storing data encryption key (client side)

I have moderate knowledge of programming , and currently I am writing a client-server messaging application for windows. My project is written from scratch using sockets , and all it does is data ...
1
vote
1answer
1k views

Hooking Windows SSL libraries

What libraries does Windows use to send ssl traffic? The ws2_32.dll has the tcp send function, but the traffic is encrypted before it reaches that function. I'm looking to reach the code where the ...
0
votes
1answer
411 views

What security settings is Yahoo Mail looking for to consider IMAP client secure?

When setting up an IMAP client for Yahoo Mail, Yahoo requires the "Allow apps that use less secure signin" option to be enabled. The client is configured to use SSL for IMAP (and SMTP). What ...
4
votes
2answers
426 views

Better safety: Webmail or POP3/IMAP clent?

Which offers a higher level of safety: Webmail or using a POP3/IMAP client? Assume the following for webmail: Access via HTTPS Rarely downloading any attachments, but in cases where it may be ...
3
votes
1answer
135 views

Who is the Gate Keeper?

If using Basic security under an SSL connection (https), is is not true that the server matches the user/password combination, but what happens after that? What prevents the browser from accessing the ...
2
votes
2answers
14k views

How to identify which root CA does the client certificate use?

How can we identify which root CA client used when there are multiple root CAs on the server? We can compare the public keys of the client certificate and the root certificate but if we have many ...
0
votes
2answers
28 views

Change Server IP used by Executeable [Client-Server Authentication]

for Authentication of my Executeable i use a TCP Server Module running on a VPS my Client(Executeable) connects to. Therefor i have to have the IP of the VPS inside the Executeable. I have two major ...
1
vote
2answers
179 views

How do server know the CSR sender is approved client?

Suppose I have a server provide a POST URL to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The problem is anyone can POST a CSR to the server and ...
1
vote
2answers
4k views

Create client certificates using signed certificate

We have a proper signed server certificate and intermediate CA from a trusted certificate authority. Is it true that we cannot use this certificate (so the intermediate CA) for creating our own ...
0
votes
1answer
63 views

Client certification authentication as an option for securing a device to allow access

I am working on a commercial device (custom hardware with firmware and embedded software) that includes a Linux OS and will run in an unsecured network environment connected via Ethernet. It will be ...
1
vote
2answers
64 views

What kind of certificate to be used to consume web services?

I have my own application. My client wants me to use their web service. This web service sends some data to my database. For this, my client wants a certificate from me. In this scenario, what kind of ...
0
votes
1answer
55 views

Server->Client distribution security

Apologies in advance if this is the wrong SE site for this topic, though it should be a fairly appropriate match. I am building a video game where one of the features available to users will be ...
6
votes
2answers
440 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
0
votes
1answer
1k views

SSL Certificate pinning with Self Signed Certificates

I am trying to understand how Certificate Pinning works with Self Signed Certificates. My idea is that a Server with a Self Signed certificate will accept the connections only from the clients that ...
0
votes
1answer
321 views

Apache: Can I revoke certain client certificate on certain subdomain only

I would like to know if we can make the client certificate valid for certain sub domain (Virtual Host). For example if I have two client certificate A, B. A is valid for subdomainX but not for ...