Collaborate Disseminate
Not sure if things belongs in Crypto SE or here but anyway:
I’m building an app and I’m trying to decide whatever is secure to protect user passwords in transit, in addition to TLS we already have.
In server side, we already have bcrypt pr… Continue reading Is using Argon2 with a public random on client side a good idea to protect passwords in transit?
This question asks whether one should hash on the client or the server. I want to know if there is any reason, aside from having to maybe handle one extra hashing library (if it’s not already in your security stack), why you wouldn’t want … Continue reading Does hashing client-side increase attack surface (assuming TLS and serverside salt+hash)? [duplicate]
When testing our c# application with a service from a new supplier our request was denied because the client certificate was not send.
Network traffic with a service where our application is known to work with shows us this:
Client Hello
S… Continue reading Can a client application volunteer to send a certificate?
Users can interfere with any piece of data transmitted between the client and the server, including request parameters, cookies, and HTTP headers. Where is the best way to filter user input, on the client side or in the server side ?
If th… Continue reading Where is the best way to filter user input?
What is sometimes called Zero Knowledge, sometimes end to end encryption occurs when a server only processes ciphered data (at least for sensitive data) with a result where a compromise of this server does not threat the confidentiality of… Continue reading How to validate client side safety in a Zero Knowlegde model
Recently in an website I had noticed that the data which is received from the server is not the data that is being displayed.I think it would have been modified on client-side. So, Is there any way by which I can know which action is being… Continue reading Can we know which client side script is performing a particular action on a website?
For client-side web applications that run in your machine (that you download at first visit – Blazor WebAssembly to be specific):
Do I need to enable SSL (HTTPS) for this application or web server that hosts this application as well, or i… Continue reading SSL Cert for client side web application, is it needed?
Using Javascript, say a customer buy a product that cost 10$.
Many payment gateways, like PayPal and Stripe, offer a client side Form where you input the sale data (price, amount, buyer address, etc), and it’s being sent to the gateway (e…. Continue reading How to secure a price passed to a payment gateway on client?
I am developing a zero-knowledge app, meaning the data is encrypted in the client before it’s transmitted (over SSL) and decrypted after the data is received. If the database is ever compromised, without the user’s decryption keys the atta… Continue reading Using the hash of the user’s password for encrypting/decrypting an E2E encryption/decryption key: is this good practice? [migrated]
TL;DR
I want to have “some thing” to handle client-certs on behalf a server that is unable to do it, for secure user authentication in addition to regular TLS encryption.
Context
In this question How can I double check security against … Continue reading Offloading TLS client-cert checking to OpenSSL (or similar) if server does not support it