We’re rewarding the question askers & reputations are being recalculated! Read more.
129

You cannot hide HTML and expect the browser to be able to interpret it. The browser needs full access to the HTML in order to display all parts of the site. As soon as the browser has access to it, the user can also gain access to it. On a further note, JavaScript is also not able to "hide" the content of the site and still make it accessible to the browser,...


113

The server can't fully trust any data it receives from the client, so validating high scores is difficult. Here are a few options: Obfuscate the client-side code and traffic to the server. This is the easiest option - it will still be possible to cheat, but probably won't be worth anyone's time. Send a full or partial replay of the game to the server for ...


101

Well, IMHO the only reliable way to prevent the user to know the mail address it to have the mail sent server side instead of client side. Said differently the client only gives their own mail address and the text, it is uploaded to the server by the form, and the mail is sent by the server application which is the only part knowing the recipient address. ...


95

You are trying to solve a problem that you shouldn't have in the first place: Password Reuse The concept is simple. You think of a "good" password and use that for everything. Your bank account, online shopping, your e-Mail provider, etc. The problem is, if it gets leaked by any one of them, then all of the other accounts are potentially in danger. This is ...


84

Virtual keyboards were an easy-to-implement solution to malware that recorded keystrokes from the keyboard and hardware keyloggers. But the keylogger software developers quickly adjusted to this new technique (sometimes by simply taking a screenshot focused around where the mouse clicks). In the end, it is not clear that a virtual keyboard provided any ...


54

You can't. The question doesn't even make sense on a conceptual level. A mailto: link is simply a convenient way to communicate to an end user where they can send email to. If your mailto link works, the end user will by definition know where the email is going to, the same way the end user will by definition know where a link they're clicking will be going ...


47

If so, then why do these companies not offer server side verification for video games, but rather continue to insist on trusting the client? It's less about insisting on trusting the client and more that there is no other viable anti-cheat model. Like DRM, and in fact, anti-cheat software like PB use a form of DRM, there's little that can be done. DRM ...


45

I know HTTPS can solve the problem, but I am still instructed to encode the password before sending it over network as per our organizational guidelines. This really defines your situation. Basically, you have a simple solution that you should use anyway (use HTTPS), if only because without HTTPS an active attacker could hijack the connection after the ...


43

Hashing on the client side doesn't solve the main problem password hashing is intended to solve - what happens if an attacker gains access to the hashed passwords database. Since the (hashed) passwords sent by the clients are stored as-is in the database, such an attacker can impersonate all users by sending the server the hashed passwords from the database ...


37

First it is important to understand what kind of images the client does not show. In your case, as the message states, these are images which would have been "download" ed. That means these are not images which are embedded in the email (multipart, etc.), but referenced (HTML img, etc.). Now imagine what kind of information the sender could gain if your ...


37

It is fundamentally impossible to validate a client on a system you don't control. That doesn't mean it can't be done to a sufficient degree. eBook readers, for example, generally try to ensure the client is authentic. They (seem to) do so in a manner that is secure enough to defend against their threat. Good enough to protect nuclear secrets? No. But ...


34

Yes. You should research what exactly goes in an HTTP request. The user agent is easily changed as it is set by the client. There are many tools that allow you to change your user agent for your browser. If you are using curl, you can also just craft your own HTTP request and set the user agent to whatever you like. If a web application depends on a user ...


32

Yes it does work as you say. The chip is "tamper resistant" and will erase the "seed" (secret key) if any attempt is made to attack it. This is often accomplished by having a non-user-replaceable battery and a "trap" that breaks power to the device once the device is opened, or the chip surface is removed. The key is then stored in a SRAM, requiring power to ...


28

If your attacker were a man-in-the-middle attacker on the network layer, then https would be enough. But unfortunately your attacker is the client, so this is rather pointless. Rule number one of cheat-proofing games: Never trust the client! The client is in the hands of the enemy. Javascript games run in the user's web browser. As you as a web developer ...


25

You have no security without authentication Just to explain it further, I am using JCryption API for encrypting the password using AES, so the value transmitted over network is AES(SHA1(MD5(plain password))) now I want to replace MD5 with Bcrypt only. Rest of the things remain unchanged. This approach works even against "Man in the middle attack". ...


23

The established solution for this problem is to use different passwords for different websites along with a password manager. That way you won't have to reinvent the wheel. I know the rule don't invent your own crypto/protocol, that's why I want to know if there exists a know protocol for a client securing himself? Not every problem has to be solved ...


21

A man-in-the-middle attack is when an attacker inserts himself between client and server, and impersonates the client when talking to the server, and impersonates the server when talking to the client. "Impersonation" makes sense only insofar as there is an expected peer identity; you cannot impersonate an anonymous client. From the point of view of the ...


21

Client side anticheat software in and of itself isn't about security, it's about the gameplay (and customer) experience. Thus, security rules aren't nearly as applicable. Trusting the client "hit pixel 1056 by 1723" is very different than trusting the client "can transfer $1000 to Nigera", or that the client "can access Bob's email". Note that I am ...


20

Yes, a modified user agent can be used for malicious purposes. However it is unlikely that your scenario of the googlebot UA being used for privileged access. How is UA more likely to be used? If your application parses the user agent to take some action, and you do not properly sanitize that input, Cross Site Scripting will be a very likely outcome. In a ...


20

Virtual keyboards are commonly used in banking sites because they have (at least) two neat pros: they protect the password from naive keyloggers they prevent the user from storing the password in a file But they do have cons: specialized keyloggers can still spy the passwords (see @schroeder's answer for a more in-depth explanation) then prevent usage of ...


19

From a high level perspective, three things have to happen: The client has to prove that it is the proper owner of the client certificate. The web server challenges the client to sign something with its private key, and the web server validates the response with the public key in the certificate. The certificate has to be validated against its signing ...


19

It is fundamentally impossible to validate that an unmodified version of your client connects to your server. ... unless you do what is necessary to ensure it. This means client-side tamper-resistant hardware. When your code runs on the client's computer, the computer owner can run a debugger and modify the client code at any point with arbitrary values. ...


18

First: There are many games, which use 100% server side validation and don't trust the client. One example: Online Poker You simply do not send the value of any cards to the client which he cannot know. So even if he hacks the client and reads the matrix, there is nothing hidden which he can reveal and no moves he can make which he couldn't do with the ...


17

You raise several issues. Server trust You never know what the server will do with your password once you send it Password reuse Password reuse can be prevented by you: don't use the same password at multiple places. Hashing If you were to hash the password before sending it to the server, then the hashed password would become the password. If the ...


17

In order to sign client certificates, you will need a CA certificate you control. Paying for one is out of the question in most cases, as global-trusted CA certificates are a security hazard for the rest of the Internet. So in these cases you have to make your own CA and create your own server and client certificates. So let's start with a basic openssl....


17

To achieve secure game high score, what you need is a "proof of work", or rather, more appropriately called proof of play. A proof of work/play is any data that's hard to compute before finishing the game, but easy to compute once you finished the game and is easy to be verified by the server. For example, for a Sudoku game, a proof of work is the solution ...


16

If so, then why do these companies not offer server side verification for video games, but rather continue to insist on trusting the client? They do! Most online games have some consistency check every now and then. Player32517 moved 100 units in 3 seconds, is that possible? However, checking if every single move is valid is an enormous amount of ...


16

You can't. And neither can Javascript. You have three options, and they all depend on a backend language. You have two options, one right way and two lunatic ways if you have no server: The right way: You do a form submit to a server, and the server handles this e-mail over SMTP. The okay way: You submit to another domain or API that can handle it server-...


13

One reason for this is automatic image loading can be used to track users opening the mail (in the same way as a read receipt). Say a marketing company sends out a mail to a thousand users and for each user they place a link to a different image in the mail (so user one gets image0001.jpg, user two gets image0002.jpg and so on), and host the images on their ...


13

Obfuscation might look as the first obvious step, but obfuscation has to protect something in the code and that something cannot be webservice functionality because that is reverse engineered by intercepting the traffic even if it is SSL encrypted. Certificate pinning can prevent simple SSL interception by trusting a predefined certificate. You can ...


Only top voted, non community-wiki answers of a minimum length are eligible