Collaborate Disseminate
I have this scenario in a web app which I’m working on its client-side code(I’m building it with ReactJS):
I obtain user’s info
hash ’em
send it to the server for being authenticated
and when I get the result back
I have … Continue reading what is the best algorithm for hashing stored users info on client-side on a web app
I am trying to perform a client side attack with Metasploit on a 32 bit Windows 7 Professional N (SP1) victim. I have Windows Defender and Firewall disabled and Java Control Panel Security set at Medium on the victim.
On the attacker machi… Continue reading Metasploit: java_signed_applet attack hangs after user response
I have multiple clients who all run state machines and one mediator, who is used by the clients to communicate with each other. Is it possible for the client to proof that a proposed state change is legal/valid, without revil… Continue reading Is it possible to "prove" that a state change in a state machine is valid, without revealing the stat machine?
I have multiple clients who all run state machines and one mediator, who is used by the clients to communicate with each other. Is it possible for the client to proof that a proposed state change is legal/valid, without revil… Continue reading Is it possible to "prove" that a state change in a state machine is valid, without revealing the stat machine?
I’ve been reading on the new categories of XSS. According to OWASP, they’re no longer just reflected, stored and DOM-based XSS, but rather server/client side, and then subdivided into reflected/stored.
According to the site,… Continue reading What is client side non-DOM XSS?
Is there any best practice on how to handle “the last mile” in a cloud stored, client side encrypted scenario for a web application? (Sensitive data has to be encrypted before being sent and stored on the server)
Where are t… Continue reading Client Side Encryption – The Last Mile
We’re planning to implement following scenario for a secure machine-to-machine (M2M) communication network. We have some gateways and a lot of secure sensors which should only be able to “speak” to each other if they can auth… Continue reading Client authentication using certificates in M2M communication
As I understand it, JavaScript implementations running in browsers need to run untrusted code and operate on untrusted data in a secure manner. Language (e.g. Python) implementations running on a server, OTOH, run trusted cod… Continue reading Security-wise, is an in-browser JavaScript implementation fundamentally different from a server-side language (e.g. Python) implementation?
We frequently need to send entity ids to the client side.
How could we protect this data (especially ids)?
Even if we encrypt using same key every time, it can be identified by analysis.
For example, if I encrypt id “1” to… Continue reading Secure Ids in Browser [on hold]
If i want to use client certificates for authentication to a certain part of my website, is it possible to make the client certificate only work on a certain domain name?
I know when requesting the client certificate you can… Continue reading limit client certificate to domain name