The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

95

You are trying to solve a problem that you shouldn't have in the first place: Password Reuse The concept is simple. You think of a "good" password and use that for everything. Your bank account, online shopping, your e-Mail provider, etc. The problem is, if it gets leaked by any one of them, then all of the other accounts are potentially in danger. This is ...


61

You can't. The reason is that you can't trust the client at all. An attacker can modify the client as they wish, and circumvent any and all security measures you may have put in place. But what if we digitally sign our code? The attacker can't modify it then, right? Yes, they can. If you sign your code, the machine of the attacker needs to validate the ...


41

You shouldn't really be worrying about this, the certificate contains only your public key, which is supposed to be public anyway. The only issue is the privacy concern of giving away the information in your certificate to any site that asks for it. Summary of the issue: The BBC weather page has a request to http://www.live.bbc.co.uk. HTTPS Everywhere is ...


30

eval() executes a string of characters as code. You use eval() precisely because the string contents are not known in advance, or even generated server-side; basically, you need eval() because the JavaScript itself will generate the string from data which is available only dynamically, in the client. Thus, eval() makes sense in situations where the ...


23

The established solution for this problem is to use different passwords for different websites along with a password manager. That way you won't have to reinvent the wheel. I know the rule don't invent your own crypto/protocol, that's why I want to know if there exists a know protocol for a client securing himself? Not every problem has to be solved ...


21

Update: PasswordBox responded to my inquiry on the subject. Personally, I couldn't really figure out what they're talking about. It could be a problem in my understanding. Below is a screenshot of their reply This is a very interesting question. PasswordBox seem claim that they can never have access to your passwords. According to their FAQ page: ...


16

There is X.509, and there is SSL/TLS. TLS expects the server to send an X.509 certificate chain, from which the client will extract the server's public key. Then things diverge: In pure X.509, the server should send its certificate for the client to validate; possibly, the server may add an unordered bunch of extra certificates that could prove useful to ...


14

eval() is a possible vector for cross-site scripting. Under normal circumstances, an attacker attempting XSS might want to get script <script></script> tags past whatever encoding, filters or firewalls might be in place. If eval() is there operating on user input, it eliminates the need for script tags. Eval is present in many malicious scripts ...


12

The server will provide its own certificate, and optionally (but recommended) all intermediate CA certs in the chain (aka the CA bundle). It need not provide the root CA cert of the chain, and the client should disregard that cert if provided in the bundle anyway, see this question for more details on that. Since the complete bundle is quite possibly ...


11

The reason PKCE is important is that on mobile OS, the OS allows apps to register to handle redirect URIs so a malicious app can register and receive redirects with the authorization code for legitimate apps. This is known as an Authorization Code Interception Attack. Authorization Code Interception Attack This is described by WSO2 here: Since multiple ...


10

Notice the phrase "This master password is NOT stored on our servers, so your secure data can't be retrieved by anyone but you." Actually, one does not necessarily mean the other, depending on the details. Consider the following system: A symmetric key is generated on the client software by hashing your master password, hopefully with something reasonably ...


9

The client is a network concept: the data is transported between two machines, the server and the client. The client is the one who initiates the conversation; the server is the one who is sitting all day, waiting for clients to connect. The user is the biological entity (presumed human) who controls the client. Authentication is about the server making ...


9

In this post in the chromium forum there are alternatives mentioned Within the browser space, alternatives exist such as: Use the device's native management capabilities if an enterprise use case. On Windows, this is Group Policy. On iOS/Android, this is the mobile device management suites. On OS X, this is Enterprise settings. On ChromeOS, ...


9

You can't be sure it hasn't been tampered with. An attacker is running code on your system - given sufficient effort, they can manipulate anything that happens within the browser context that you're running in (so, a plugin doesn't suffer the same way - it's in a different context). Not all of the points in the Matasano link from @SmokeDispenser are totally ...


9

This write-up Okta has on this subject explains this pretty well IMHO. I believe it's because PKCE is intended for native applications (e.g. Android, iOS, UWP, Electron, etc.) where you leave the security context of your application and go to the browser to authenticate, and rely on the secure return to your application from the browser. You don't ...


8

I wouldn't bother to be honest. Most application store their database passwords in plain text, i don't see this as being very different. If you are on a shared host, make sure only your user account has read access to the file. I also strongly recommend using SFTP or FTPS, if you aren't using one of these protocols then you are begging to be hacked.


8

Probably not - if you enter your FTP details into a website, you have no idea where they could end up. Furthermore, FTP is insecure anyway - any data transferred over it (including your login details) is viewable in transit in clear text. This could be between the web service and the FTP server, even if the connection to the web service uses HTTPS. In this ...


8

Is it safe to use a web-based FTP client? If so, when? What should I watch out for? It depends. A web-based FTP client is in a way like a proxy. How much you trust such a proxy depends on how much control you have over it. If this web -based FTP gateway is in your company’s network, you could probably trust it like you trust your local proxy, because the ...


8

[This is a re-write of the question addressing the update. See the original in the revision history] TLS client auth is something that almost always requires you to extend your TLS engine by writing your own cert custom validation code on the server-end. It seems like you've avoided this by piggy-backing on the trust-store with no additional validation code....


7

nsCertType is an old Netscape-specific extension, which was used by the Netscape browser at a time when that browser was still alive. You can forget it nowadays. The signing CA, by principle, acts in any way as it sees fit. It can put whatever it wishes in your certificate. Your certificate request is just a suggestion. You can more or less count on the CA ...


7

In short: Just go to startssl.com and get your SSL certificate for free. The protocol is not specific enough. If you aim to implement this yourself, you will likely introduce flaws in the signing and encryption steps. How are users going to validate the server's public key here? Do you expect them to compare hex-digits? You also seem to assume that clients ...


7

The flow provided is remarkably lacking in technical detail. It provides the personnel process, but not the technical one. Hard to say, seeing it, what it means. My original thought reading the FAQ was that the password is something a human can remember, but the "master password" is an inscruitable number built from the password and a process of salting it....


6

Note that there might a difference between the password and the encryption key! The first statements says that there is no way that they would be able to decrypt your stuff without having your password. Considering the second statement, I believe that they are probably encrypting either an encryption key or all your files (duplicate) with their own ...


6

In a fight between a polar bear and a white shark, who will win ? Guess what, if this is a pool fight, the shark will munch through the bear in less than two minutes (this site makes unsubstantiated claims to the contrary, but there are strong clues that a shark eating a polar bear really happened). Now put them both on a land, and I will put my money on the ...


6

Your method is trivially vulnerable to a Man in the Middle (MitM) attack. There are two benefits of using SSL: Sensitive traffic over the wire is sent encrypted (which your method effectively accomplishes) and you can cryptographically verify that you are going to the right website and not a fake version of the website. (Again note the URL in the address ...


6

First off, let's be clear: the client certificates are not self-signed. They are signed by a CA, and that CA's certificate is self-signed. This is important, because a self-signed certificate cannot be revoked at all, by definition: revocation is an information coming from the issuing CA; a self-signed certificate is its own CA. A second important point is ...


6

The handshake part of the TLS 1.3 protocol has three goals: exchange certificates; let the server confirms that the client really have the secret key associated with the provided public certificate, without exchanging the secret key; exchange ephemeral keys. Part 1 - Trust of certificate Client sends its certificate with Certificate message. Server ...


6

Your CA issued you an intermediate CA cert if: they have provided you a certificate that has the CA extension set to TRUE (with or without a depth) they have provided you a certificate that has suitable keyUsage extensions, that is keyCertSign and cRLSign (see https://superuser.com/questions/738612/ddg#738644) you control/own the private key that matches ...


5

A simple Google search on "django client certificate" reveals this, and this, and this, which all answer to your question as: yes, Django can work with certificate-based client authentication. People don't do that often in practice, because client certificates work only if you can arrange for clients to have certificates, basically meaning that you must ...


5

I lean towards "naah, don't bother", though I don't think there's a single clearcut answer. In principle it depends upon what data and resources those passwords grant access to, as well as how tightly secured the machine where you'll be storing them is. If the passwords will be stored on a machine that is reasonably well-secured, and if the data they grant ...


Only top voted, non community-wiki answers of a minimum length are eligible