Questions tagged [client]

In a client-server model, the server serves services to the client.

Filter by
Sorted by
Tagged with
39
votes
5answers
3k views

Client-side encryption, but cloud service can still decrypt data in the event of a death? Is this possible?

I've been worried about this password manager, PasswordBox that seems to be gathering quite a bit of steam lately. They seem to have raised VC funding and are offering a free password management and ...
24
votes
1answer
6k views

Why would the BBC web site always ask for a personal certificate, and how do I avoid giving it away?

After installing a CAcert personal certificate, every time I land on the BBC weather site it asks me to identify myself with a certificate. Why would any non-malicious web site do that unless I've ...
22
votes
8answers
6k views

How can I re-use my password and still protect the password if it is exposed from one source?

I know that all servers should at least store my credentials as hash(password + salt) + salt, with a secure and well known hash function and a salt unique for me, generated from a secure and well ...
22
votes
4answers
18k views

What are the security issues with “eval()” in JavaScript?

Every time that someone mentions eval(), everyone says that there are "security issues" with it, but nobody ever goes into detail about what they are. Most modern browsers seem to be able to debug ...
21
votes
2answers
4k views

What is PKCE actually protecting?

I'm trying to get my head around how PKCE works in a mobile app and there's something I don't quite understand. So from what I can gather the client app creates a random cryptographically secure ...
21
votes
5answers
4k views

Alternatives to HTML's deprecated <keygen> for client certs?

The keygen tag is used to make browsers generate private keys and POST the resulting CSR to the server, which can then issue a certificate. It's now been deprecated, for rather stupid reasons but that'...
13
votes
3answers
3k views

How to perform Login Authentication at the client-side? [closed]

How can we validate login credentials at the client-side itself without involving the server of a website?
12
votes
5answers
7k views

Is it worth the effort to store FTP passwords encrypted?

I have a project to build a system that needs to push files to multiple third-party FTP servers. I have asked these third parties to provide a more secure interface; all have declined. So now I have ...
12
votes
2answers
6k views

Client authentication vs. user authentication

I am currently looking into authentication protocols which work well with REST API, in java. There is something fundamental I don't understand: I read a lot of material about OAuth protocol, SSL, ...
11
votes
2answers
12k views

Validating an SSL certificate chain according to RFC 5280: Am I understanding this correctly?

we're in the process of replacing certificates with SHA1 hash due to Google's move to let them appear less secure in Chrome. The replacement certificates use a different intermediate CA than the ones ...
9
votes
5answers
7k views

How To Prove That Client Side Javascript Is Secure?

Imagine that you have a web application that encrypts the user's data, such as a note or spreadsheet, on both the server and client. The normal process for a user using this web application is ...
8
votes
3answers
14k views

Certificate Chain checking

I have a very specific question. A client verifies a server by taking the certificate and checking specific values and that the digital signature of the intermediate CA is correct (according to the ...
8
votes
2answers
6k views

How does a server validate the Certificate Verify message in SSL/TLS?

Client authentication may be used in a SSL/TLS negotiation. For this, the client will send a Certificate Verify Message after the server requested it. The Certificate Verify Message contains the ...
7
votes
1answer
16k views

SSL Cert Types and Key Usage

I want to use OpenSSL to create a CSR and submit it to my CA (which uses Microsoft PKI) and receive certificates that can be used for both Server Auth and Client Auth. I'm not clear on a couple of ...
6
votes
3answers
6k views

Revoke a certificate without index.txt

I generate self-signed client certificates for a little Apache server hosted under my stairs. The script below was hacked together for this purpose - note it uses the 'mini-CA' x509 method, therefore ...
6
votes
2answers
440 views

Secure Software: How to ensure caller is authentic?

For multiplayer (competitive) games, there is often the issue of needing to detect illegitimate players so they can be denied service. On the other hand, legitimate players should of course be ...
5
votes
1answer
4k views

Usage of self-signed certificates for Client authentication

We have a server to server communication scenario, where we would use a CA signed certificate for the TLS server authentication and would like to use a self-signed certificate for the Client ...
5
votes
1answer
4k views

Using client certificates for website authentication

I was wondering if there currently exists a Content Management System that supports PKI and client certificates for website authentication instead of username/passwords. If not, what's a good place to ...
4
votes
1answer
3k views

Client certificate common name? Subject alternative name?

For an IoT project, I want to secure client server communication. I want both the server (Apache) and the clients identify/authenticate each other (a client won't communicate with other clients) ...
4
votes
1answer
343 views

SSH and man-in-the-middle

Assume the following scenario and please correct me if I am wrong somewhere: There is a client and there is an SSH server that the client connects to. There is also a man-in-the-middle (MIM) which is ...
4
votes
1answer
1k views

Does client Authentication needs the server to have intermediate certificate?

I have a scenario where in the client send send a client certificate issued from trusted root. The path of the client cert is like : Trusted Root |-----Intermediate Issuer |---- ...
4
votes
2answers
9k views

What exactly is meant by serverAuth and clientAuth

I'm building a network that will allow employees and customers to access the company systems. To that end I'm using a Red Hat Enterprise Linux (RHEL) 7.0 server as a firewall/authentication server. ...
4
votes
1answer
5k views

OpenVPN: Storage location and creation of keys/certificates?

I am re-setting up some OpenVPN infrastructure to be more secure than the original and wanted some guidance. It's noted that the best security policy is to keep the Certificate Authority (CA) offline ...
4
votes
2answers
731 views

SSL/TLS Client Authentication by IP

Is there any mechanism in SSL/TLS which allows a certificate to be bound to a device? Example: There is a client who talks to a server, and during SSL/TLS setup, there is mutual authentication. ...
4
votes
2answers
422 views

Better safety: Webmail or POP3/IMAP clent?

Which offers a higher level of safety: Webmail or using a POP3/IMAP client? Assume the following for webmail: Access via HTTPS Rarely downloading any attachments, but in cases where it may be ...
4
votes
3answers
672 views

Server client verification

When writing a server sofware, what are the methods used to verificate the user connected to the server is actually using the official client program ? This is to prevent the access to the server ...
4
votes
1answer
208 views

What should I exchange with the server when I generate my AES 256 key?

I'm creating a mobile fast-paced game and currenly I'm working on login/registration/connecting. I'm trying to make it right so it won't mess in the future. For now, I have read multiple articles of ...
3
votes
6answers
3k views

When is it safe to use a web based FTP client?

Is it safe to use a web based FTP client? If so, when? What should I watch out for?
3
votes
1answer
135 views

Who is the Gate Keeper?

If using Basic security under an SSL connection (https), is is not true that the server matches the user/password combination, but what happens after that? What prevents the browser from accessing the ...
3
votes
3answers
10k views

How to troubleshoot “client certificate” related errors in 2 way HTTPS

I have a webserver which is asking for client certificate for mutual authentication. I have what I think is the right certificate loaded into my client browser. However, the browser is not able to ...
3
votes
1answer
202 views

How Vulnerable Is An Older Version Of Outlook As An Email Application?

I am significantly displeased with some of the newer versions of Microsoft Outlook. I would prefer to continue using my older version from Office 2000 (on Windows 7 using workarounds). As a networked ...
3
votes
1answer
1k views

Is it a safe to hardcode my secret key in my iOS app?

Cloudinary iOS SDK configuration suggests to hardcode your api_secret in your iOS app's source code. Isn't that a security vulnerability since string literals can be extracted from the app binary, e....
3
votes
1answer
2k views

When SSL detect a replay attack?

Suppose an attacker records all messages of a SSL handshake (RSA one-way), and starts a replay attack. When (after which message) can the server possibly detect the attack? Now suppose the attacker ...
3
votes
2answers
522 views

OpenSSL SSL enabled client application, server verification?

I am writing an OpenSSL SSL enabled client application which connects to a Google server. I have the SSL working and I can monitor the traffic and see that it is definitely encrypted. I am using ...
3
votes
1answer
327 views

Client authentication flaw in old Netscape SSL protocol

Below is a screenshot from the paper "Prudent Engineering Practice for Cryptographic Protocols" by Martin Abadi and Roger Needham. I can't see what's wrong with the protocol and what the fix achieves. ...
3
votes
2answers
2k views

Can users read client SSL certificates from a react native mobile apps APK?

I want to secure an API used by a react native app. If an authorisation header is sent, the user can read the request and access data. To avoid this I want to use SSL client certificates. Now if I ...
3
votes
0answers
125 views

Does RenegotiateOnce in Go's crypto/tls package protect against triple handshake?

Looking into how to do client cert authentication from the Go HTTP client, I found out I needed renegotiation from the client side and I came across issue 5742 for Go on GitHub, which is the issue ...
2
votes
2answers
14k views

How to identify which root CA does the client certificate use?

How can we identify which root CA client used when there are multiple root CAs on the server? We can compare the public keys of the client certificate and the root certificate but if we have many ...
2
votes
4answers
117 views

Prove a client sent a request - voting system

Let's say I created a voting system where each voter would use an app and vote on a candidate. The app would send the vote to a server. The server would store the vote on a DB with the request IP. Is ...
2
votes
2answers
476 views

Web Service Security Checklist - Tracing and Debugging

I have been reading this security checklist about web service design: http://msdn.microsoft.com/en-us/library/ff648304.aspx One of the suggestions is that you should disable the following in ...
2
votes
2answers
829 views

SSL: How to send generated client certificate from server to avoid MITM?

The question I have is simply how do I prevent a MiTM attack on a certificate once the server side creates a new one and tries to send it to a client? Does the certificate get encrypted by rsa and ...
2
votes
1answer
39 views

Is it possible to setup 1-way TLS client authentication without server certificates?

Is it possible with TLS to only authenticate the client? In other words can one-way TLS be setup in such a way that only the host initiating the connection uses a client certificate and the second ...
2
votes
2answers
91 views

Testing non‐browser‐based https clients for Poodle

I have a command line tool that can download any URLs likewget (only for vcs systems) but not it’s source code, how can I test if it is vulnerable to POODLE? There are lot of online automated tools ...
2
votes
2answers
243 views

How secure is this communication chat?

I have created a chat between two parties (using c#), and I am wondering what kind of weaknesses have I overlooked. Description of its functionality: There are two individual applications: Client (2 ...
2
votes
1answer
3k views

openssl s_server is expecting key and certificate in case of PSK cipher test

I am new to security domain, In case of PSK why openssl s_server is expecting certificate and key. If I don't give then it gives error like below. $ openssl s_server -psk ...
2
votes
1answer
766 views

SSL Client Authentication Failure

I have a setup where the client wants to make https call to the server. The client has a certificate installed on the machine The trust chain of the cert: Root CA      |----...
2
votes
2answers
2k views

SSL/TLS client authentication - practical client cert validation

How do real HTTPS servers validate client certificates? My context is business-to-business rather than regular human clients. I understand basic chain validation to a trusted root CA cert. But do ...
2
votes
0answers
39 views

Distributed Shared Secret for RNG that only Distributor knows?

For one of my projects I want to create a way to sync up all participants' RNG with a seed where each participant does not know the seed of the RNG but also in a way that minimizes the number of times ...
2
votes
1answer
679 views

Can clients visit my site, and spam socket.emit(something); to my server, or is there some security behind socket.io?

I'm using Socket.IO and the client side looks like this. <script src="/socket.io/socket.io.js"></script> <script> var socket = io(); socket.emit("sendData", "hello!"); </...
1
vote
2answers
4k views

Create client certificates using signed certificate

We have a proper signed server certificate and intermediate CA from a trusted certificate authority. Is it true that we cannot use this certificate (so the intermediate CA) for creating our own ...