Questions tagged [client]

In a client-server model, the server serves services to the client.

Filter by
Sorted by
Tagged with
2
votes
1answer
2k views

How does do client authentication work over https?

I recently wrote an application that calls out to a 3rd party service to perform some work. This 3rd party service requires that I authenticate the client calling by using a client certificate. For ...
12
votes
2answers
14k views

Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?

we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
44
votes
2answers
11k views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...
10
votes
1answer
10k views

Client certificate common name? Subject alternative name?

For an IoT project, I want to secure client server communication. I want both the server (Apache) and the clients identify/authenticate each other (a client won't communicate with other clients) ...
8
votes
3answers
15k views

Certificate Chain checking

I have a very specific question. A client verifies a server by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (according to the ...
17
votes
2answers
13k views

How does a server validate the Certificate Verify message in SSL/TLS?

Client authentication may be used in a SSL/TLS negotiation. For this, the client will send a CertificateVerify after the server requested it. The CertificateVerify message contains the client ...
11
votes
5answers
9k views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
6
votes
2answers
474 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
4
votes
3answers
760 views

Server client verification

When writing a server sofware, what are the methods used to verificate the user connected to the server is actually using the official client program ? This is to prevent the access to the server ...
2
votes
2answers
5k views

Create client certificates using signed certificate

We have a proper signed server certificate and intermediate CA from a trusted certificate authority. Is it true that we cannot use this certificate (so the intermediate CA) for creating our own ...
26
votes
5answers
25k views

What are the security issues with “eval()” in JavaScript?

Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
29
votes
1answer
7k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
7
votes
3answers
1k views

Is it possible to store / record HTTPS client auth traffic as a signed document?

In a scenario where there are client RSA certificates (e.g. on a smart card), is it possible to record a form submission (or an AJAX request) in a form which makes it possible to later ascertain that ...
24
votes
6answers
6k views

Alternatives to HTML's deprecated <keygen> for client certs?

The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but that'...
14
votes
2answers
7k views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
13
votes
3answers
5k views

How to perform Login Authentication at the client-side? [closed]

How can we validate login credentials at the client-side itself without involving the server of a website?
13
votes
5answers
8k views

Is it worth the effort to store FTP passwords encrypted?

I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
6
votes
1answer
7k views

Usage of self-signed certificates for Client authentication

We have a server to server communication scenario, where we would use a CA signed certificate for the TLS server authentication and would like to use a self-signed certificate for the Client ...
0
votes
1answer
67 views

Client certification authentication as an option for securing a device to allow access

I am working on a commercial device (custom hardware with firmware and embedded software) that includes a Linux OS and will run in an unsecured network environment connected via Ethernet. It will be ...
-1
votes
2answers
3k views

Generate openSSL certificates from within C code using commands?

This is an openSSL command for generating a private key and a certificate, openssl req -out CSR.csr -new -newkey rsa:2048 -nodes -keyout privateKey.key The question I have is whether there is some ...
2
votes
1answer
135 views

Is it possible to setup 1-way TLS client authentication without server certificates?

Is it possible with TLS to only authenticate the client? In other words can one-way TLS be setup in such a way that only the host initiating the connection uses a client certificate and the second ...
1
vote
2answers
892 views

TLS or IPsec protocol for client-server communication? [duplicate]

What is the best protocol for client-server communication? TLS or IPsec? I have a public channel where users communicate with each other using a digital certificate like X.509.