Questions tagged [server]

A server is a machine running a software daemon that is generally accessed over a network by other machines.

31 questions with no upvoted or accepted answers
Filter by
Sorted by
Tagged with
4
votes
0answers
86 views

Should I create a JWT on one server, and verify it on a different server?

So lets say I have 2 microservices: 1). A serverless / lambda function, triggered by some hardware event 2). A websocket server, to handle some data I want to ensure that only authenticated ...
2
votes
1answer
555 views

Why use .ENV? What's wrong with storing secrets in a config.php file outside root directory?

Seems to be the general practice these days is to store secrets (e.g., DB, API credentials) in a .ENV file then load it to $_ENV and $_SERVER automatically. This popular library does that and it's ...
2
votes
0answers
39 views

Distributed Shared Secret for RNG that only Distributor knows?

For one of my projects I want to create a way to sync up all participants' RNG with a seed where each participant does not know the seed of the RNG but also in a way that minimizes the number of times ...
2
votes
0answers
1k views

Mobile Backend Server: How to validate authenticated client is valid?

Consider this scenario Step 1: App asks user to "Sign In" using Google or Facebook. Step 2: Once authenticated, app sends user's Id (from Google/Facebook) to My App Server requested to app ...
2
votes
1answer
372 views

Is a TPM module insecure if not soldered to the board?

I am looking into Bitlocker for my headless Microserver N54l with windows server 2016 on it. I saw that the n54l has no TPM module, but I can buy one and plug it to the board. I am interested in it ...
2
votes
1answer
678 views

Can clients visit my site, and spam socket.emit(something); to my server, or is there some security behind socket.io?

I'm using Socket.IO and the client side looks like this. <script src="/socket.io/socket.io.js"></script> <script> var socket = io(); socket.emit("sendData", "hello!"); </...
1
vote
0answers
51 views

Identification of Unknown Potential MITM/Malware involving SSL Connections

On my server one of the services is a Discord bot. It was down which prompted me to look into why. In my syslogs I noticed three increasingly concerning items: do-agent[1066]: 2019/08/25 08:50:21 ...
1
vote
1answer
175 views

OPC-UA Certificate Handling

I am currently developing and extending an OPCUA-Server based on "node-opcua". The next steps would require to add certificate handling and that's also the point that makes me the most problems. My ...
1
vote
0answers
81 views

Verifying the authenticity of data coming to a server

I'm a newbie when it comes to information security. So pardon me if the solution can be found at page 12 of any introductory text. I have an express server and two android apps(for clients and admin)....
1
vote
0answers
38 views

Kerberos Protocol Centralized Server

If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
1
vote
0answers
68 views

OAuth2 auth server reusing the access token

I found some implementations of OAuth2 provider (auth server) which issues the same access token (for same user & scope) for different authentication request. Does the OAuth2 spec allows it? Any ...
1
vote
0answers
692 views

LOTs of filtered ports on my server

I'm setting up a dedicated server (4 days uptime, not in production yet). I'm a coder, not a sysadmin or a security expert so bear with me. I just tried to portscan it with nmap -p- -T5 -Pn -sV -v to ...
1
vote
0answers
237 views

Is it dangerous to give remote VNC access to a Server?

I have a Server powered by macOS Server on macOS Sierra. It serves as a file (AFP & SMB) server, VPN Server, and Web Server. It already has SSH enabled. I was wondering if it is safe to enable VNC ...
1
vote
1answer
253 views

How does a user get authenticated on server B if they are already authenticated on server A through OAuth2?

Lets say I have server A (a web server). Users initially use an external provider such as Google to get authenticated on that server. An entry is created in my database saying that this user has ...
1
vote
0answers
43 views

How to submit scores securely from app that uses only Facebook login?

Our android app only has Facebook login. Here's what happens on the server: A user is created when a POST request is sent using Facebook's user access token in the body. Whenever a user gets created ...
1
vote
0answers
120 views

How dm-verity can be implemented on server?

I found out there's such thing as dm-verity and that it's used in various embed devices like phones. While I think it's quite fair that embeds can have some ROM memory that can't be modified and it ...
1
vote
0answers
210 views

Is there a solution for On-the-fly-encryption with active directory rules & policies?

I am looking at having our servers' sql databases for a few program and documents to be always encrypted on the HDD, but available to AD users. So one or multiple users with the right AD privileges ...
1
vote
0answers
270 views

Is a direct SIP video call (encrypted) between two computers more secure than going through a registrar service?

I learned recently about ZRTP-encrypted video calls using an SIP client, such as Jitsi or Linphone or Blink. I was able to make a direct encrypted video call between two clients on the same local ...
0
votes
0answers
14 views

Security bug in wildfly-security-manager

I have a question to this Common Vulnerabilities and Exposures about wildfly-security-manager: CVE-2019-14843 Does this security flaw imply an attacker could break into the wildfly server, or does it ...
0
votes
0answers
75 views

Port scanning - Idle scan 2.0?

I have some server applications and from time to time I'm being victim of some attacks which might be of interest and I'm going to describe in the following. The most recent attack originated from ...
0
votes
0answers
50 views

How can a server make sure client application sending data is not a modified copy?

I actually wouldn't care about a perfect copy (my program is free)being used, I just can't allow someone to use a copy to communicate with my server. I came accross this subject where the OP seemed ...
0
votes
2answers
132 views

How do I ensure a local Minecraft server (with admin wrapper) is inaccessible to the outside?

I'm running a Minecraft server on my local network for myself and my roommates. I would like to simplify some of the admin tasks by using an admin wrapper. Unlike most of the questions, tutorials, ...
0
votes
0answers
46 views

Real time chat - is it possible to see messages from it again

I have a theoretical question. If you went on a website which provides real time chat service, and only login information it requires is a username of your choice, and the website adress was https, ...
0
votes
1answer
266 views

over 100 scanner requests 5 min after domain registration

First off, I am no security expert! Yesterday I registered a .cf domain, I needed it for about 10 minutes. About 5 minutes after domain registration I got over 100 scanner requests (I checked all ...
0
votes
1answer
442 views

TLS 1.3 server_handshake_traffic_secret calculation

I'm currently reading the Transport Layer Security (TLS) Protocol Version 1.3. In section 4.3.1 (Encrypted Extensions) it says In all handshakes, the server MUST send the EncryptedExtensions ...
0
votes
0answers
51 views

Is there a pre-established method for cracking RSA SecureID codes?

I am using the most modern version of RSA SecureID's tokens with a RSA server (used with a lot of governments and larger organizations ). I was just wondering if there was a pre-established method for ...
0
votes
1answer
55 views

Server->Client distribution security

Apologies in advance if this is the wrong SE site for this topic, though it should be a fairly appropriate match. I am building a video game where one of the features available to users will be ...
0
votes
1answer
55 views

Which is better: detecting spam at receiver or source?

Background I researched a detection of spam sent out using bots. After studying different techniques used by bots to deliver spam, I have no generalised solution to detect spamming at the source ...
-1
votes
1answer
276 views

Which protocols are the most secure to achieve authentication and encryption for a client downloading data from a sever?

I'm new to Information Security so please bear with me if this question is quite trivial. I want to design a secure protocol that allows someone to download a piece of data that belongs to them from ...
-2
votes
1answer
55 views

Howto securely invoke a script on a remote server?

I have an application running on a dedicated (Ubuntu) server. There is also a desktop GUI which functions as dashboard for the application. I want to be able to start and stop the application from the ...
-2
votes
1answer
297 views

How safe is it to use tor on a monitored network?

So in a shape this question has been asked but mine is more specific. If It is a work network that blocks a huge number of websites and services, you can use tor to circumvent the blocks but can the ...