Questions tagged [client]

In a client-server model, the server serves services to the client.

Filter by
Sorted by
Tagged with
2
votes
2answers
115 views

Testing non‐browser‐based https clients for Poodle

I have a command line tool that can download any URLs likewget (only for vcs systems) but not it’s source code, how can I test if it is vulnerable to POODLE? There are lot of online automated tools ...
2
votes
2answers
322 views

How secure is this communication chat?

I have created a chat between two parties (using c#), and I am wondering what kind of weaknesses have I overlooked. Description of its functionality: There are two individual applications: Client (2 ...
2
votes
1answer
5k views

openssl s_server is expecting key and certificate in case of PSK cipher test

I am new to security domain, In case of PSK why openssl s_server is expecting certificate and key. If I don't give then it gives error like below. $ openssl s_server -psk ...
2
votes
1answer
1k views

SSL Client Authentication Failure

I have a setup where the client wants to make https call to the server. The client has a certificate installed on the machine The trust chain of the cert: Root CA      |----...
2
votes
0answers
43 views

Distributed Shared Secret for RNG that only Distributor knows?

For one of my projects I want to create a way to sync up all participants' RNG with a seed where each participant does not know the seed of the RNG but also in a way that minimizes the number of times ...
1
vote
1answer
212 views

Client vs Server security for business critical application (crossplatform)

We have the option to develop a software either based on Java (but then it is only available for desktop clients using Java SE and can run maybe also as tomcat app can be multithreaded, stable, ...
1
vote
2answers
304 views

Why Thunderbird has private IP address as remote host?

Why Mozilla Thunderbird configured to access Yahoo IMAP server, uses a private IP address, even if there is no other device in the network. Every time, Thunderbird is restarted, it changes remote-host ...
1
vote
4answers
588 views

Authentication with an untrusted server

I asked a related question earlier, but I want to ask a broader version this time: To simplify things let's say I've developed an application that allows users to send messages in a chat room, and to ...
1
vote
1answer
95 views

How to authenticate a specific client program? [duplicate]

I have a server application which provides functions to a client program. The client is also programmed by me. Now I want to authenticate the client program itself (not any user) before using my ...
1
vote
1answer
667 views

Impersonating Client Certificate Authentication with Same Subject Name

I am looking into the security of a service which uses client certificates for authenticating only known callers. We run a C# Web API Service that checks every request certificate subject if it is ...
1
vote
1answer
2k views

Hooking Windows SSL libraries

What libraries does Windows use to send ssl traffic? The ws2_32.dll has the tcp send function, but the traffic is encrypted before it reaches that function. I'm looking to reach the code where the ...
1
vote
2answers
565 views

Verifying Client with Server

I'm currently designing a basic Java program that uses sockets to communicate from a server to multiple clients. I want the clients to be unmodified, however, to prevent against users trying to use ...
1
vote
1answer
259 views

Wildcard Certificates and Client Authentication for Machine Authentication

If a wildcard certificate is provisioned for *.domain.fqdn, and has Client Authentication as a defined usage, does this mean the certificate can be used to essentially impersonate any domain machine? ...
1
vote
1answer
221 views

On TLS-enabled nginx/httpd, is "ssl_verify_client optional_no_ca" disabling TLS's "CertificateVerify" checks?

I'm looking for an helping hand with my https nginx setup. I require my application to be exposed through an nginx frontend, offloading TLS. Easy ! The thing is, I need to have Certificate-based ...
1
vote
2answers
261 views

Where can I find the specs for the X.509 certificate used in client-authenticated TLS handshake?

The TLS specs define how the handshake between client and server must be performed when the client wants to use a certificate to authenticate itself. There is a lot of documentation onlin that assumes ...
1
vote
1answer
274 views

limit client certificate to domain name

If i want to use client certificates for authentication to a certain part of my website, is it possible to make the client certificate only work on a certain domain name? I know when requesting the ...
1
vote
2answers
74 views

What kind of certificate to be used to consume web services?

I have my own application. My client wants me to use their web service. This web service sends some data to my database. For this, my client wants a certificate from me. In this scenario, what kind of ...
1
vote
1answer
3k views

SSL Certificate pinning with Self Signed Certificates

I am trying to understand how Certificate Pinning works with Self Signed Certificates. My idea is that a Server with a Self Signed certificate will accept the connections only from the clients that ...
1
vote
1answer
937 views

Client/server communication keystore and tls

I want to establish a client-server communication using TLS protocol. The point is I dont understand a few things since I don't know many oner security. I have created certificates for my server and a ...
1
vote
1answer
241 views

What should a client verify after getting a client certificate?

I have a client that generates a csr, sends it to a server, the server then sign it and return the certificate as a String. the String is then decoded to a x509Certificate (using Bouncycastle's ...
1
vote
1answer
867 views

What are the risks of connecting via VNC to an untrusted host?

There are questions about connecting to an untrusted host via SSH [1] [2], RDP, and with X11 forwarding enabled. What about when connecting via VNC? What risks are there to the client? To be clear: ...
1
vote
2answers
7k views

iOS, Android, and OS X SHA-2 support (in the context of SSL/TLS certificates)

As there is currently a move away from SHA-1 being used as part of TLS, we're examining moving our SSL certificates, used to protected traffic in transit to/from our webservers, to use SHA-2. However,...
1
vote
1answer
75 views

Denial of Service question

I am studying for an exam in computer security, and I got stuck on the following question from a past exam: A random program generator service S allows clients to generate random data. Each client Ci ...
1
vote
1answer
2k views

Client initiated cookie Vs Server initiated cookie [closed]

I'm finding similar comments and articles around client side cookies that they are initiated by client and store everything on the client side and server does not store anything. On the other hand ...
1
vote
1answer
819 views

Mutual SSL - Using Public CA for Client Auth CSR signing

I have been reading a lot of articles regarding Mutual SSL, Two-Way Authentication or Client Authentication and I have a general enquiry which may have been answered in content that I've read but if ...
1
vote
2answers
56 views

Rembering password on client (not database) [closed]

I am trying to implement the capability for my program (C++) to remember a user/password combination, so the user does not need to type it in again. Is there a secure way for my program to store this?...
1
vote
2answers
906 views

TLS or IPsec protocol for client-server communication? [duplicate]

What is the best protocol for client-server communication? TLS or IPsec? I have a public channel where users communicate with each other using a digital certificate like X.509.
1
vote
2answers
195 views

How do server know the CSR sender is approved client?

Suppose I have a server provide a POST URL to send CSR. The response certificate then will be used for later SSL client-cert auth connection. The problem is anyone can POST a CSR to the server and ...
1
vote
1answer
773 views

Is it safe to store public key encrypted password in the Mobile Device for authentication purposes?

I have a Apache Cordova hybrid mobile app that needs to authenticate users, but we don't want to prompt for credentials every time the app is used. Some options came to my mind: Store the password ...
1
vote
0answers
55 views

Bettercap TLS handshake phase information

I wanted to know if bettercap has a feature that allows to view TLS handshake phase information (as Wireshark does), for example the "Client Hello" ?
1
vote
1answer
242 views

Client-only authentication instead of server-only authentication, using OpenSSL [duplicate]

First, some background: I've got a C++-based client/server system that uses the OpenSSL C library to encrypt the client/server connections. This is done in (what I believe is) the canonical OpenSSL ...
1
vote
0answers
157 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
1
vote
1answer
629 views

Storing data encryption key (client side)

I have moderate knowledge of programming , and currently I am writing a client-server messaging application for windows. My project is written from scratch using sockets , and all it does is data ...
1
vote
0answers
1k views

Performing denial of service attack using Python [closed]

I am a student so please don't be rude for I miss something and this project is for research purpose only. I am willing to perform a denial of service attack(on my own servers) I am not willing to do ...
1
vote
0answers
736 views

Simple Reverse-Shell-Script in java? [closed]

i have a simple script (written in C) and it connects back to a netcat server to open a shell, there, so a really simple reverse shell script. How to do the same in java? #include <stdlib.h> #...
1
vote
0answers
84 views

How to authorize users for rest service

me and my friend are doing a project for a company. It involves getting some information from the database and display it on a smartglass device (epson, sony, ...). Now we want to build a RESTful ...
1
vote
2answers
991 views

How to uniquely identify / tag client devices to whitelist VPN access?

I'm just wondering if there is any way to uniquely identify or tag client devices like laptops and towers in order to whitelist them for vpn access. (Note: This is a thought-experiment at the moment, ...
0
votes
2answers
1k views

Keeping the password secret over regular http

I would like to at first be clear that this is for poor site owners who can't afford the SSL option but require logins to their site, potentially from a public kiosk, and need a secure method of ...
0
votes
1answer
47 views

Client Cert Authentication: Accept cert in request or retrieve from host?

Is it more secure to retrieve a client cert from their host rather than accept the cert presented in request? Example: B2B Client pre-shares public cert with me I store public cert in database Later, ...
0
votes
2answers
155 views

Getting a "so-called valid" certificate to work inside the application

There's is a python client app connecting to a java server app via a secure socket. The connection works great with a self-signed certificate, however, it fails when I attempt to utilize a given valid ...
0
votes
2answers
1k views

How to Verify Integrity of Transferred Files in a Client Server Protocol

How do I implement integrity verification using the checksum of files in a client-server protocol where the client sends multiple files to the server. I am using the following steps: The client ...
0
votes
1answer
1k views

Client Server TCP connection - sending a password

I'm new to cybersecurity and am writing a TCP server with the Java Socket API. There is a client and server class. The server class is what would be run on a server, it listens on a specified port and ...
0
votes
2answers
28 views

Change Server IP used by Executeable [Client-Server Authentication]

for Authentication of my Executeable i use a TCP Server Module running on a VPS my Client(Executeable) connects to. Therefor i have to have the IP of the VPS inside the Executeable. I have two major ...
0
votes
1answer
348 views

Apache: Can I revoke certain client certificate on certain subdomain only

I would like to know if we can make the client certificate valid for certain sub domain (Virtual Host). For example if I have two client certificate A, B. A is valid for subdomainX but not for ...
0
votes
2answers
80 views

Secure website with unique machine certificate

Is it possible to allow access to a website only for specific clients on specific machines? I'm no security expert, but one idea I had is to generate a certificate that would work only on a specific ...
0
votes
1answer
73 views

Storing client keys in cloud app

I'm using Azure to store customer data. In a specific country, there are multiple partners. Each partner has his clients. The issue is they don't want us to have access to this data. In other words, ...
0
votes
1answer
106 views

How to select a random node when nodes are untrusted in a distributed network?

Assume in a distributed network, where the nodes are not trusted and are identified by their public keys, we intend to select one of them in a random process. In such a situation, all of the nodes ...
0
votes
2answers
138 views

Is it safe to publish a REST API client on npm even though the API is not intended for public use?

I am build a website in Angular which communicates over my REST API on my backend server. I have managed to auto-generate the code (TypeScript) for my client and now I need it to be available on ...
0
votes
1answer
1k views

Root CA or Intermediate CA in firewall trust store

I am implementing a PKI for a test environment and have everything just about configured. The architecture consists of a Root CA, two issuing (intermediate CAs), and clients. Client certificates and ...
0
votes
3answers
407 views

Fuzzing client apps

Is it possible to file fuzz and network fuzz client apps written in C# .Net? The reason I ask is I am not a developer, but I am a security analyst and I have been given the task of file fuzzing the ...