Collaborate Disseminate
If i want to use client certificates for authentication to a certain part of my website, is it possible to make the client certificate only work on a certain domain name?
I know when requesting the client certificate you can… Continue reading limit client certificate to domain name
Is it normal to have Session ID in the first Client Hello, and then the server picks it up and accepts the same Session ID and uses it in all further TLS traffic. That is the “Client or Browser” tells what Session ID to use and “Server” ac… Continue reading Session ID in the very First Client Hello
I have implemented a CNG key storage provider and propagate my certificate according to the answer to this question to the MY store. I can see my certificate there using the MMC console. However, when a website requires the c… Continue reading How to make CNG certificates available for mutual authentication in browser?
My application currently supports these two authentications methods OAuth2 and HMAC Auth.
OAuth2 https://tools.ietf.org/html/rfc6749
HMAC https://tools.ietf.org/html/draft-cavage-http-signatures-09
We have a request to supp… Continue reading What advantages would client-side certificates have over signature based auth such as Oauth2 or HMAC for HTTP Requests?
i have a python application which uses the requests module to send the client certificate as well as the key for mutual authentication.
Is there any specific standard or set of best practices for storing/managing client sid… Continue reading best practices for storing client certificate and key on linux?
I know more specific questions asked this for ajax and that the answer is no, but I’m wanting to see a broader and newer scope.
If I’m getting redirected to a random url through a http 302 redirect which again redirects to f… Continue reading How to catch http redirects programmatically?
I know more specific questions asked this for ajax and that the answer is no, but I’m wanting to see a broader and newer scope.
If I’m getting redirected to a random url through a http 302 redirect which again redirects to f… Continue reading How to catch http redirects programmatically?
My situation is this:
User credentials are stored on the server, bcrypt, random hashes.
I’m designing a REST API, so I’d like to keep this as stateless as possible!
The client is an Android/iPhone app.
All communication is … Continue reading Does client side hashing add any benefit here?
I’ve done a bit of research on client-side encryption, I’ve looked on Wikipedia and various other sources, I was just curious, however, if you had a network administrator watching over all traffic, all POST data, etc. would client-side enc… Continue reading What exactly is client-side encryption?
We live in a world where password reuse is common and most of the internet users are not using password managers, while hacks and breaches are becoming more common. The importance of those breaches lays not only in an access … Continue reading Benefits to client-side password hashing on top of other security mechanisms