0
votes
1answer
136 views

Browser security and payments

I've been finding a lot of blog posts claiming JS encryption is unsafe, here's a couple of detailed ones: http://www.matasano.com/articles/javascript-cryptography/ ...
6
votes
1answer
541 views

Implementing Digitally signed data in a Web Application

I understand PKI well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of Transactions or ...
31
votes
5answers
6k views

How easy is it to hack JavaScript (in a browser)?

My question has to do with JavaScript security. Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a ...
5
votes
1answer
824 views

Means for (legit) cross-site scripting

Are there good means for allowing scripts from two or more domains to collaborate in the same browser page? I want to create an extensible platform, where I provide the model and some views, but also ...
0
votes
2answers
3k views

A good tool for browser automation/client-side Web scripting [closed]

I'm interested in adopting a tool/scripting language to automate some daily tasks connected with fighting forum spammers. A brief overview of these tasks: analyze new registrations and posts on a ...
10
votes
5answers
6k views

Best practices for web application Authentication/Security (Any Platform)

I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many ...
4
votes
2answers
266 views

Is there any risk of web browsers spying away localhost applications on an Internet-connected PC?

Despite what it might look like this is a serious question. After that story with Android OS and Chrome browser submitting to Google the details of the WiFi access points they see in the neighborhood ...
0
votes
2answers
155 views

Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()?

Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()? Wouldn't this be a very simple way counter attack web spam bots? Or ...