6
votes
1answer
481 views

Implementing Digitally signed data in a Web Application

I understand PKI well from a conceptual point of view - i.e. private keys/public keys - the math behind them, use of hash & encryption to sign a certificate, Digital Signing of Transactions or ...
31
votes
5answers
5k views

How easy is it to hack JavaScript (in a browser)?

My question has to do with JavaScript security. Imagine an authentication system where you're using a JavaScript framework like Backbone or AngularJS, and you need secure endpoints. That's not a ...
5
votes
1answer
755 views

Means for (legit) cross-site scripting

Are there good means for allowing scripts from two or more domains to collaborate in the same browser page? I want to create an extensible platform, where I provide the model and some views, but also ...
0
votes
2answers
2k views

A good tool for browser automation/client-side Web scripting [closed]

I'm interested in adopting a tool/scripting language to automate some daily tasks connected with fighting forum spammers. A brief overview of these tasks: analyze new registrations and posts on a ...
10
votes
5answers
6k views

Best practices for web application Authentication/Security (Any Platform)

I got a question today from my manager asking me my thoughts on what is considered an acceptable design for authentication of a web form application, especially in regards to the nature of many ...
4
votes
2answers
257 views

Is there any risk of web browsers spying away localhost applications on an Internet-connected PC?

Despite what it might look like this is a serious question. After that story with Android OS and Chrome browser submitting to Google the details of the WiFi access points they see in the neighborhood ...
0
votes
2answers
152 views

Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()?

Why don't browsers have the ability to differentiate between events triggered via input devices and scripts ex: element.onEvent()? Wouldn't this be a very simple way counter attack web spam bots? Or ...