last day (15 days later) » 

Dan
Dan
23:42
So there are a few problems with your approach:
the client is doing the authentication check - the code segment you've linked indicates the client downloads a document, then checks that document to determine if its HWID is within the document - this has a few problems
1. someone could just circumvent using your client and access the website directly (since the website doesnt verify the information) and 2. anyone can visit the website and see the permissible hwids and just copy one to gain access.
You want to modify your code such that the client sends its own secret (HWID) to the server and the server tells the client whether or not it has been accepted. You shouldn't expose the list of acceptable HWIDs to anyone. However:
1) unless HWIDs are GUIDs (very big numbers that are hard to guess), they are prone to being guessed by computers. and since the attacker would only need to guess one to have a successful attack (ie to gain access), this makes GUIDs not a suitable solution on their own for securing access to a server
2) you're sending traffic over HTTP, which means anyone can intercept the traffic between client and server to 'see' the secret.
you would solve this by generating a long string using a crytogrpahic function specifically designed to be resistant to brute force attacks, such as SHA256. this sorts the guessability problem.
As for being able to view traffic over HTTP, you should use HTTPS and certificate pinning to ensure that 1) the traffic is encrypted and 2) only someone with a certificate that matches your public key is able to decrypt the traffic, although you should be aware these come with problems of their own
Furthermore, WindowsIdentity.GetCurrent() isn't appropriate for use in distrbuted systems - the value of it depends on the machine running it and it's only as secure as the machine that's running the code.
honestly, I would recommend using a username and password combination instead, like most websites do
@Dan Is that a new room?
Hello. :)
Dan
Dan
it's a new room to respond to a question yeah
hoping OP drops by and reads what's up rather than being discouraged by the pretty bad reception they got
@Dan Give the room a good name rather than default names. :)
Dan
Dan
This isn't a default name
I named it this because lucifers sister is the name of the OP :')
@Dan I know for that I said give it a name.
Dan
Dan
23:54
room topic changed to Dan & lucifers sister: Response to stackoverflow.com/questions/68137934/… (no tags)
i think the current name is fine when coupled with a description
but /shrug
@Dan Good :)
@Dan I have started it for reference.
Good Work, Wish you luck. :)

last day (15 days later) »