Collaborate Disseminate
We live in a world where password reuse is common and most of the internet users are not using password managers, while hacks and breaches are becoming more common. The importance of those breaches lays not only in an access … Continue reading Benefits to client-side password hashing on top of other security mechanisms
Reading about hashing, salt and pepper, I can’t get my head around the following scenario:
If there’s a web application and you register on that site, should the password be hashed on the client or server-side? If you would … Continue reading Hash, salt and best practices
I’ve got a situation that is puzzling me. We have a vendor that is requiring mutual authentication when making a request to them. They are requesting we give them a client cert identifying our company for verification. Tha… Continue reading Mutual auth client certs for a pool of requesting servers behind a proxy
I’ve created an Capture The Flag challenge for me and a few of my mates, and for the final challenge, you’re goal is to log in as admin to a site. Now the site doesn’t use any server side languages (since it’s purposely inse… Continue reading How Secure Would Client Side Sha-512 Be In JavaScript
I’ve created an Capture The Flag challenge for me and a few of my mates, and for the final challenge, you’re goal is to log in as admin to a site. Now the site doesn’t use any server side languages (since it’s purposely inse… Continue reading How Secure Would Client Side Sha-512 Be In JavaScript
This question already has an answer here:
Why is client-side hashing of a password so uncommon?
9 answers
What to transfer?… Continue reading Client side password [duplicate]
On HTML5, we can use localStorage to keep data persistently on client side. It seems better from a non-security point of view (easy to access, not 5mb limit like cookies, etc).
https://www.w3schools.com/html/html5_webstorage… Continue reading Cookie vs HTML5 localStorage
I have a desktop application which creates and stores a fair amount of data (mostly on its own, not through traditional user input); mostly statistical in nature.
Currently the data is mostly accessible only to other applica… Continue reading API security where the server is also client-side
I am trying to test the following setup:
A RADIUS server works with the EAP-TLS protocol. The client and the server have the following certificates:
Client
Public Key: clientcert_intermediatecert_chain.pem
CA-certificate: r… Continue reading Should a server or a client be able to verify a client/server certificate – intermediate certificate chain with a known root ca?
See this diagram here:
edit this draw.io
My questions/concerns:
Can the same security & usability be achieved in a simpler way?
Is there a way to break this system without compromising 2 parts? (seeing the initial pas… Continue reading Usable client side file encryption on the web, can this be simplified / broken?