Web security in general

manwingbb 0
Viewed 33

I am somewhat confused by how web security works in general so I hope someone can clear things up for me.

  1. Can I rely on HTTPS on the integrity (because the attacker cannot just encrypt an arbitrary message and choose to send that along instead) and confidentially of the in-between network traffic? Even if the initial request is sniffed by some man-in-middle?

  2. Why is it bad to store sensitive information (that I don’t mind my client has access to) client side (in a cookie)? Isn’t it true that other domains cannot gain access to the cookie from my domain?

  3. Say my browser got hacked, all JWTs, and certificates are exposed and can be tampered with any way. Does that mean there is no way to guard against that?

  4. I kept seeing HMAC but not sure what its purpose is. It is a symmetrical encryption method so if an attacker gets hold of the secret key then it is doomed. So it just prevents man-in-middle? But do we already have HTTPS for that? Is it because TLS/SSL is a stream cipher method so HMAC is to add an extra layer of security?

Any comments and help are appreciated. Thank you very much.

websecurity security
1 Answers

  1. HTTPS just encrypts the traffic but if you have the session key then using Wireshark you can easily decrypt it.

  2. cookies if stored using just jwt instead of some other method into the client's systems for instance if the jwt is not properly defined by hiding some crucial data that if tampered can get other clients for example if the code is like this.

    { "userId":"1001", "iss": "https://provider.domain.com/", "sub": "auth/some-hash-here", "exp": 153452683 } Then by manipulating the userId field of the token you have a high chance of accessing the account of other users it is doing an IDOR attack over jwt.

  3. To safeguard from getting hacked via a browser you need to be careful with javascript we won't realize it but it's super useful for hackers to hack and take control of your browser's database(cookies, passwords, usernames) and that's bad.

  4. Exactly having the HMAC or the master encryption key is what helps conduct the decryption I mentioned in the first point even HTTPS cannot save your data when the hacker has the keys he can conduct a MITM attack to capture the packet decrypt it using Wireshark and view it realtime or after some time.

remember nothing is safe

morpheuslord0
Related