Skip to main content
115 votes
Accepted

Sending a client-side high-score to a server securely

The server can't fully trust any data it receives from the client, so validating high scores is difficult. Here are a few options: Obfuscate the client-side code and traffic to the server. This is ...
grc's user avatar
  • 1,845
101 votes

Is there a way to hide HTML source code yet keeping it effective?

Well, IMHO the only reliable way to prevent the user to know the mail address it to have the mail sent server side instead of client side. Said differently the client only gives their own mail address ...
Serge Ballesta's user avatar
82 votes
Accepted

Are virtual keyboards not necessary anymore to protect against keyloggers?

Virtual keyboards were an easy-to-implement solution to malware that recorded keystrokes from the keyboard and hardware keyloggers. But the keylogger software developers quickly adjusted to this new ...
schroeder's user avatar
  • 131k
59 votes
Accepted

Is this idea for secure password storage a good one?

You recently asked about "security by obscurity". This is that. A very complicated process that fails once it is known. And if the database of hashes gets leaked, from one server, why do you ...
schroeder's user avatar
  • 131k
54 votes
Accepted

Is there a way to hide HTML source code yet keeping it effective?

You can't. The question doesn't even make sense on a conceptual level. A mailto: link is simply a convenient way to communicate to an end user where they can send email to. If your mailto link works, ...
Cubic's user avatar
  • 626
29 votes

Sending a client-side high-score to a server securely

If your attacker were a man-in-the-middle attacker on the network layer, then https would be enough. But unfortunately your attacker is the client, so this is rather pointless. Rule number one of ...
Philipp's user avatar
  • 49.4k
23 votes

How can I re-use my password and still protect the password if it is exposed from one source?

The established solution for this problem is to use different passwords for different websites along with a password manager. That way you won't have to reinvent the wheel. I know the rule don't ...
yeah_well's user avatar
  • 3,794
20 votes

Are virtual keyboards not necessary anymore to protect against keyloggers?

Virtual keyboards are commonly used in banking sites because they have (at least) two neat pros: they protect the password from naive keyloggers they prevent the user from storing the password in a ...
Serge Ballesta's user avatar
20 votes

Is this idea for secure password storage a good one?

Leaving aside some of the technical implementation issues (how you're generating the "random" characters, how your servers communicate to work out how many they need to strip off each side, ...
Gh0stFish's user avatar
  • 12.9k
17 votes

Sending a client-side high-score to a server securely

To achieve secure game high score, what you need is a "proof of work", or rather, more appropriately called proof of play. A proof of work/play is any data that's hard to compute before finishing the ...
Lie Ryan's user avatar
  • 31.4k
17 votes
Accepted

Why not store password in cookie?

Several points against the second model: Hashing the password should take a significant amount of time, so as to slow down brute forcing in the event of a database leak. Checking a password on every ...
AndrolGenhald's user avatar
15 votes

Is there a way to hide HTML source code yet keeping it effective?

You can't. And neither can Javascript. You have three options, and they all depend on a backend language. You have two options, one right way and two lunatic ways if you have no server: The right way:...
The Anathema's user avatar
11 votes

Is there a way to hide HTML source code yet keeping it effective?

You can HTML-encode it, like this: <form action="&#x6d;&#x61;&#x69;&#x6c;&#x74;&#x6f;&#x3a;&#x73;&#x6f;&#x6d;&#x65;&#x6f;&#x6e;&#x65;&#...
Sjoerd's user avatar
  • 31.2k
10 votes
Accepted

What exactly is client-side encryption?

would client-side encryption help hide messages being sent/received, so that [my local network administrator] would not be able to read them? Client-side encryption is not about transport encryption. ...
Arminius's user avatar
  • 44.9k
9 votes

Don't trust the client?

"Don't trust the client" means that whatever input comes from the client might have been sent maliciously, because you can't control it. So, for example, this means that authentication and ...
reed's user avatar
  • 15.8k
8 votes

How is the Premaster secret used in TLS generated?

TLS supports multiple key exchange schemes and hence there can be different ways of deriving a pre master secret. TLS can use RSA based key exchange which has been pretty well explained in previous ...
harshc's user avatar
  • 141
8 votes
Accepted

No SSL: Web Application Security using html fragment identifier (#)

I am currently running my website in shared hosting, and I am not able to register TLS/SSL for my website. There is no reasonable alternative to TLS, and trying to re-create it on your own is ...
Mark E. Haase's user avatar
8 votes

Sending a client-side high-score to a server securely

I just wanted to mention that there is a sort of solution to this problem but it is likely to not be available for you; the solution is called "homomorphic encryption" and it allows for a client to ...
CR Drost's user avatar
  • 221
7 votes

Is there a way to hide HTML source code yet keeping it effective?

TL;DR: No. If I understand your problem correctly, you do not want to hide the e-mail address from the users, but from bots which parse the source code to collect e-mail addresses for spamming. Sure,...
rexkogitans's user avatar
6 votes
Accepted

How secure is HTML5 web storage (sessionStorage and localStorage)?

The user can modify and delete anything stored in their browser. Any malware installed in the user's system with the user's privilege can also do so. The system administrator can also modify and ...
Lie Ryan's user avatar
  • 31.4k
6 votes

Is there a way to hide HTML source code yet keeping it effective?

To accomplish what you're trying to do, get a gmail address or forwarding address that you use in your form, which serves your purpose of keeping your real email address secret.
Lort Fasd's user avatar
6 votes
Accepted

How to store user credentials in browser securely?

Anything stored client side (and not encrypted) can be seen and/or modified by the user. The usual way of implementing a "Remember Me" functionality is to set a cookie with an encrypted username, ...
Chris Murray's user avatar
  • 1,295
6 votes

Offloading TLS client-cert checking to OpenSSL (or similar) if server does not support it

Would be this TLS offloading a normal setup? Offloading TLS to something else if your server doesn't support what you want is a normal setup. If so, is OpenSSL a good handler for this ...
gowenfawr's user avatar
  • 72.9k
5 votes

Sending a client-side high-score to a server securely

Everything on client side can be spoofed. So the answer is no. EDIT I removed the security mechanism I wrote here because it only assure legitime sessions... but spoofed scores can be sent through ...
OscarAkaElvis's user avatar
5 votes

What exactly is client-side encryption?

Client-side encryption means that the client is encrypting the data and NOT sharing the key with the server. When done properly, this would prevent anyone without the key from deciphering the data. ...
Marc's user avatar
  • 4,301
5 votes
Accepted

Does client side hashing add any benefit here?

When you hash passwords on the client, the shared secret between client and server is no longer the cleartext password but the hash of the cleartext password. Your password is no longer monkey, your ...
Philipp's user avatar
  • 49.4k
5 votes

Logging secrets in the user agent (browser)

I see no real problem with doing this in development environments. However, I am not sure I would do it in production for a number of reasons: Why log stuff to the console in production at all? It ...
Anders's user avatar
  • 65.6k
4 votes
Accepted

Does exposing a session ID create security risks?

Does exposing a session ID create a security risk? Not necessarily. You're exposing session id's to the browser whenever you store a session id in a cookie. This is how sessions work - the browser ...
Out of Band's user avatar
  • 9,283

Only top scored, non community-wiki answers of a minimum length are eligible